Out-of-bounds Write Affecting ifax/hylafax package, versions [0,]


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
10.85% (96th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UNMANAGED-IFAXHYLAFAX-2364997
  • published26 Jan 2022
  • disclosed21 Sept 2018
  • creditUnknown

Introduced: 21 Sep 2018

CVE-2018-17141  (opens in a new tab)
CWE-787  (opens in a new tab)
CWE-824  (opens in a new tab)

How to fix?

There is no fixed version for ifax/hylafax.

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.

References

CVSS Base Scores

version 3.1