CVE-2018-17141
HylaFAX 6.0.6 / 5.6.0 Uninitialized Pointer / out of Bounds Write
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.
HylaFAX 6.0.6 y HylaFAX+ 5.6.0 permite que los atacantes remotos ejecuten código arbitrario mediante una sesión dial-in que proporciona una página FAX con el bit JPEG habilitado, el cual se manipula incorrectamente en FaxModem::writeECMData() en el archivo faxd/CopyQuality.c++.
Multiple bugs were found in the code handling fax page reception in JPEG format that allow arbitrary writes to an uninitialized pointer by remote parties dialing in. When processing an specially crafted input, the issue could lead to remote code execution. HylaFAX versions 6.0.6 and 5.6.0 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-17 CVE Reserved
- 2018-09-20 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-787: Out-of-bounds Write
- CWE-824: Access of Uninitialized Pointer
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://git.hylafax.org/HylaFAX?a=commit%3Bh=c6cac8d8cd0dbe313689ba77023e12bc5b3027be | X_refsource_confirm | |
| https://lists.debian.org/debian-lts-announce/2018/09/msg00026.html | Mailing List |
|
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2018/09/20/1 | 2024-08-05 | |
| https://seclists.org/bugtraq/2018/Sep/49 | 2024-08-05 | |
| https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2018/dsa-4298 | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Hylafax Search vendor "Hylafax" | Hylafax Search vendor "Hylafax" for product "Hylafax" | 6.0.6 Search vendor "Hylafax" for product "Hylafax" and version "6.0.6" | - |
Affected
| ||||||
| Hylafax Search vendor "Hylafax" | Hylafax\+ Search vendor "Hylafax" for product "Hylafax\+" | 5.6.0 Search vendor "Hylafax" for product "Hylafax\+" and version "5.6.0" | - |
Affected
| ||||||