CVE catalog

CVE-2005-3069

hylafax affected and fixed versions

xferfaxstats in HylaFax 4.2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on the xferfax$$ temporary file.

Severity: Medium
Published: Sep 27, 2005, 7:03:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.38% · Oct 27, 2026

Projects and upstream resources

[hylafax][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debiantrixie	hylafax	`3:6.0.7-11.1`	Fixed	[CVE-2005-3069]
Debiansid	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debiansid	hylafax	`3:6.0.7-13`	Fixed	[CVE-2005-3069]
Debianforky	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debianforky	hylafax	`3:6.0.7-13`	Fixed	[CVE-2005-3069]
Debianbookworm	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debianbookworm	hylafax	`3:6.0.7-5`	Fixed	[CVE-2005-3069]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debianbookworm	hylafax	`3:6.0.7-5`	Fixed	[CVE-2005-3069]
Debianforky	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debianforky	hylafax	`3:6.0.7-13`	Fixed	[CVE-2005-3069]
Debiansid	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debiansid	hylafax	`3:6.0.7-13`	Fixed	[CVE-2005-3069]
Debiantrixie	hylafax	`1:4.2.2+rc1`	FixedDistribution-reported fixed boundary	[CVE-2005-3069]
Debiantrixie	hylafax	`3:6.0.7-11.1`	Fixed	[CVE-2005-3069]

Original provider fields

{
  "package_releases": [
    {
      "name": "hylafax",
      "status": "fixed",
      "release": "sid",
      "version": "3:6.0.7-13"
    },
    {
      "name": "hylafax",
      "status": "fixed",
      "release": "forky",
      "version": "3:6.0.7-13"
    },
    {
      "name": "hylafax",
      "status": "fixed",
      "release": "trixie",
      "version": "3:6.0.7-11.1"
    },
    {
      "name": "hylafax",
      "status": "fixed",
      "release": "bookworm",
      "version": "3:6.0.7-5"
    }
  ],
  "fixed_versions": [
    {
      "bug": 329384,
      "name": "hylafax",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "low",
      "fixed_version": "1:4.2.2+rc1"
    },
    {
      "bug": 329384,
      "name": "hylafax",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "low",
      "fixed_version": "1:4.2.2+rc1"
    },
    {
      "bug": 329384,
      "name": "hylafax",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "low",
      "fixed_version": "1:4.2.2+rc1"
    },
    {
      "bug": 329384,
      "name": "hylafax",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "low",
      "fixed_version": "1:4.2.2+rc1"
    }
  ],
  "distribution_packages": []
}

[Debian bug #329384]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[hylafax-client]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-5 · amd64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12
- 3:6.0.7-5 · arm64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12
[hylafax-client-dbg]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-5 · amd64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12
- 3:6.0.7-5 · arm64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12
[hylafax-server]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-5 · amd64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12
- 3:6.0.7-5 · arm64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12
[hylafax-server-dbg]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-5 · amd64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12
- 3:6.0.7-5 · arm64 · bookworm
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

[Debian 13 (Trixie)]

[hylafax-client]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-11.1 · amd64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13
- 3:6.0.7-11.1 · arm64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13
[hylafax-client-dbg]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-11.1 · amd64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13
- 3:6.0.7-11.1 · arm64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13
[hylafax-server]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-11.1 · amd64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13
- 3:6.0.7-11.1 · arm64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13
[hylafax-server-dbg]Unknown
Source package: [hylafax]
Details (2)
- 3:6.0.7-11.1 · amd64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13
- 3:6.0.7-11.1 · arm64 · trixie
  Fixed · Fixed: 1:4.2.2+rc1
  dsa · hylafax · debian · 13

Observed: Oct 23, 2026, 5:02:39 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]