HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).
References
Configurations
History
21 Nov 2024, 05:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.html - | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00040.html - | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00046.html - | |
| References | () http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00054.html - | |
| References | () https://bugzilla.suse.com/show_bug.cgi?id=1173519 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J52QFVREJWJ35YSEEDDRMZQ2LM2H2WE6/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y46FOVJUS5SO44A2VEKR7DXEHTI4WK5L/ - | |
| References | () https://security.gentoo.org/glsa/202007-06 - | |
| References | () https://sourceforge.net/p/hylafax/HylaFAX+/2534/ - Patch, Third Party Advisory |
07 Nov 2023, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
Information
Published : 2020-06-30 12:15
Updated : 2024-11-21 05:05
NVD link : CVE-2020-15397
Mitre link : CVE-2020-15397
CVE.ORG link : CVE-2020-15397
JSON object : View
Products Affected
ifax
- hylafax_enterprise
hylafax\+_project
- hylafax\+
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource