GitLab

HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page
with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c file.

References:

https://www.openwall.com/lists/oss-security/2018/09/20/1
https://nvd.nist.gov/vuln/detail/CVE-2018-17141

Patch:

http://git.hylafax.org/HylaFAX?a=commit;h=82fa7bdbffc253de4d3e80a87d47fdbf68eabe36

(from redmine: issue id 9456, created on 2018-09-24, closed on 2018-10-09)

• Relations:
  • parent #9455 (closed)
• Changesets:
  • Revision d4ebd7cc on 2018-10-09T06:08:39Z:

main/hylafax: security fix (CVE-2018-17141)

Fixes #9456