Arbitrary Code Execution via JPEG Bit in HylaFAX

CVE-2018-17141 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.

Learn more about our Code Quality Review.