PT-2020-19926 · Opensuse+1 · Hylafax+1

Johannes Segitz + 1 · Published 2020-06-29 · Updated 2024-06-15 · CVE-2020-8024

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions hylafax+ versions prior to 7.0.2-lp152.2.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions hylafax+ versions prior to 7.0.2-2.1

Description A vulnerability in the packaging of hylafax+ allows local attackers to escalate from user uucp to users calling hylafax binaries.

Recommendations For openSUSE Leap 15.2, update hylafax+ to version 7.0.2-lp152.2.1 or later. For openSUSE Leap 15.1, update hylafax+ to a version later than 5.6.1-lp151.3.7. For openSUSE Factory, update hylafax+ to version 7.0.2-2.1 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-8024

OPENSUSE-SU-2020:0958-1

OPENSUSE-SU-2020_0958-1

OPENSUSE-SU-2024:10852-1

Affected Products

Suse

Hylafax

References · 16

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00022.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0958-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8024 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1172731 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8024 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-8024 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10852-1 · Vendor Advisory
• https://t.me/cvenotify/4692 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/XHWPHMKS35ISNF5JZ56E5H5RJWYOEWF5 · Note
• https://suse.com/security/cve/CVE-2018-17141 · Note
• https://suse.com/security/cve/CVE-2020-8024 · Note
• https://bugzilla.suse.com/1172731 · Note
• https://suse.com/security/cve/CVE-2020-15396 · Note