[3.6] hylafax: JPEG support code execution (CVE-2018-17141)
HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute
arbitrary code via a dial-in session that provides a FAX page
with the JPEG bit enabled, which is mishandled in
FaxModem::writeECMData() in the faxd/CopyQuality.c file.
References:
https://www.openwall.com/lists/oss-security/2018/09/20/1
https://nvd.nist.gov/vuln/detail/CVE-2018-17141
Patch:
http://git.hylafax.org/HylaFAX?a=commit;h=82fa7bdbffc253de4d3e80a87d47fdbf68eabe36
(from redmine: issue id 9459, created on 2018-09-24, closed on 2018-10-09)
- Relations:
- parent #9455 (closed)
- Changesets:
- Revision c9d2e4b4 on 2018-10-09T06:40:36Z:
main/hylafax: security fix (CVE-2018-17141)
Fixes #9459