CVE-2020-8024 Problematic permissions in hylafax+ packaging allow escalation from uucp to other users
MediumCVSS 5.3
EPSS 0.54%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openSUSE hylafax+ | < 7.0.2-lp152.2.1 | 7.0.2-lp152.2.1 |
| openSUSE hylafax+ | < 5.6.1-lp151.3.7 | 5.6.1-lp151.3.7 |
| openSUSE hylafax+ | < 7.0.2-2.1 | 7.0.2-2.1 |
| ubuntu/hylafax(Ubuntu:24.04) | All versions | No fix listed |
| openSUSE Leap 15.2 | >= hylafax+, < 7.0.2-lp152.2.1 | 7.0.2-lp152.2.1 |
| openSUSE Leap 15.1 | >= hylafax+, <= 5.6.1-lp151.3.7 | No fix listed |
| openSUSE Factory | >= hylafax+, < 7.0.2-2.1 | 7.0.2-2.1 |
| ubuntu/hylafax(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/hylafax(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/hylafax(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- openSUSE-SU-2020:0958 mailing-list patch vendor-advisory
- bugzilla.suse.com issue-tracking vendor-advisory
- Debian Security Tracker CVE-2020-8024 vendor-advisory