CVE catalog

CVE-2018-17141

hylafax: CVE-2018-17141

[CVE catalog]

Severity
Critical · CVSS 9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.59% · Oct 25, 2026

HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianhylafaxsid3:6.0.7-13fixed
Debianhylafaxforky3:6.0.7-13fixed
Debianhylafaxtrixie3:6.0.7-11.1fixed
Debianhylafaxbookworm3:6.0.7-5fixed
Opensusehylafax+tumbleweed7.0.3-5.1fixed
Alpinehylafax3.106.0.6-r5fixed
Alpinehylafax3.116.0.6-r5fixed
Alpinehylafax3.126.0.6-r5fixed
Alpinehylafax3.136.0.6-r5fixed
Alpinehylafax3.146.0.6-r5fixed
Alpinehylafax3.156.0.6-r5fixed
Alpinehylafax3.166.0.6-r5fixed
Alpinehylafax3.176.0.6-r5fixed
Alpinehylafax3.186.0.6-r5fixed
Alpinehylafax3.196.0.6-r5fixed
Alpinehylafax3.206.0.6-r5fixed
Alpinehylafax3.56.0.6-r4fixed
Alpinehylafax3.66.0.6-r5fixed
Alpinehylafax3.76.0.6-r4fixed
Alpinehylafax3.86.0.6-r5fixed
Alpinehylafax3.96.0.6-r5fixed
Ubuntuhylafax16.043:6.0.6-6vulnerable
Ubuntuhylafax16.043:6.0.6-6+deb8u1build0.16.04.1fixed
Ubuntuhylafax18.043:6.0.6-8vulnerable
Ubuntuhylafax18.043:6.0.6-8.1~ubuntu0.18.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianhylafaxsourcesid3:6.0.6-8.1not yet assignedNot reported[909161]
Debianhylafaxsourceforky3:6.0.6-8.1not yet assignedNot reported[909161]
Debianhylafaxsourcetrixie3:6.0.6-8.1not yet assignedNot reported[909161]
Debianhylafaxsourcebookworm3:6.0.6-8.1not yet assignedNot reported[909161]
Opensusehylafax+rpmtumbleweed7.0.3-5.1Not reportedOPENSUSE-SU-2024:10852-1Not reported
Alpinehylafaxapk3.106.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.116.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.126.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.136.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.146.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.156.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.166.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.176.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.186.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.196.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.206.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.56.0.6-r4Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.66.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.76.0.6-r4Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.86.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Alpinehylafaxapk3.96.0.6-r5Not reportedALPINE-CVE-2018-17141Not reported
Ubuntuhylafaxdeb16.043:6.0.6-6+deb8u1build0.16.04.1Not reportedUBUNTU-CVE-2018-17141Not reported
Ubuntuhylafaxdeb18.043:6.0.6-8.1~ubuntu0.18.04.1Not reportedUBUNTU-CVE-2018-17141Not reported

[Debian bug #909161]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [hylafax-client]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-5 · amd64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

    • 3:6.0.7-5 · arm64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

  • [hylafax-client-dbg]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-5 · amd64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

    • 3:6.0.7-5 · arm64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

  • [hylafax-server]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-5 · amd64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

    • 3:6.0.7-5 · arm64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

  • [hylafax-server-dbg]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-5 · amd64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

    • 3:6.0.7-5 · arm64 · bookworm

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · bookworm; dsa · hylafax · debian · 12

[Debian 13 (Trixie)]

  • [hylafax-client]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-11.1 · amd64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

    • 3:6.0.7-11.1 · arm64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

  • [hylafax-client-dbg]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-11.1 · amd64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

    • 3:6.0.7-11.1 · arm64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

  • [hylafax-server]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-11.1 · amd64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

    • 3:6.0.7-11.1 · arm64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

  • [hylafax-server-dbg]Unknown

    Source package: [hylafax]

    Details (2)

    • 3:6.0.7-11.1 · amd64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

    • 3:6.0.7-11.1 · arm64 · trixie

      Fixed · Fixed: 3:6.0.6-8.1

      dsa · hylafax · debian · 13

[openSUSE Tumbleweed]

  • [hylafax+]Unknown

    Source package: [hylafax+]

    Details (1)

    • 7.0.11-2.4 · x86_64 · tumbleweed

      Fixed · Fixed: 7.0.3-5.1

      dsa · hylafax+ · opensuse · tumbleweed

  • [hylafax+-client]Unknown

    Source package: [hylafax+]

    Details (1)

    • 7.0.11-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 7.0.3-5.1

      Version impact unknown

      dsa · hylafax+ · opensuse · tumbleweed

  • [libfaxutil7_0_11]Unknown

    Source package: [hylafax+]

    Details (1)

    • 7.0.11-2.4 · x86_64 · tumbleweed

      Unknown · Fixed: 7.0.3-5.1

      Version impact unknown

      dsa · hylafax+ · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]