High severity7.8NVD Advisory· Published Jun 30, 2020· Updated Jun 17, 2026
CVE-2020-15397
CVE-2020-15397
Description
HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- cpe:2.3:a:ifax:hylafax_enterprise:-:*:*:*:*:*:*:*
- HylaFAX/HylaFAX+description
- osv-coords5 versionspkg:rpm/opensuse/hylafax+&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/hylafax+&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/hylafax+&distro=openSUSE%20Tumbleweedpkg:rpm/suse/hylafax+&distro=SUSE%20Package%20Hub%2015%20SP1pkg:rpm/suse/hylafax+&distro=SUSE%20Package%20Hub%2015%20SP2
< 7.0.3-lp151.4.6.1+ 4 more
- (no CPE)range: < 7.0.3-lp151.4.6.1
- (no CPE)range: < 7.0.3-lp152.3.6.1
- (no CPE)range: < 7.0.3-5.1
- (no CPE)range: < 7.0.3-bp151.6.4.1
- (no CPE)range: < 7.0.3-bp152.3.4.1
Patches
Vulnerability mechanics
References
9- sourceforge.net/p/hylafax/HylaFAX+/2534/nvdPatchThird Party Advisory
- bugzilla.suse.com/show_bug.cginvdExploitIssue TrackingThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00040.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00046.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00054.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J52QFVREJWJ35YSEEDDRMZQ2LM2H2WE6/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y46FOVJUS5SO44A2VEKR7DXEHTI4WK5L/nvd
- security.gentoo.org/glsa/202007-06nvd
News mentions
0No linked articles in our index yet.