{"id":"CVE-2005-3539","aliases":["DEBIAN-CVE-2005-3539","DSA-933-1","EUVD-2005-3538","GHSA-cmp6-2c27-3682"],"status":"published","title":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to...","description":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.1265,"percentile":0.96276,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2005-12-31T05:00:00Z","modified":"2026-10-23T03:47:25Z","exploits":[{"source":"exploitdb","id":"EDB-27032","title":"Hylafax 4.1/4.2 (Multiple Scripts) - Remote Command Execution","type":"remote","platform":"linux","date":"2006-01-05","verified":true,"url":"https://www.exploit-db.com/exploits/27032"}],"fixes":[{"ecosystem":"Debian:12","package":"hylafax","fixed_in":["2:4.2.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"hylafax","fixed_in":["2:4.2.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"hylafax","fixed_in":["2:4.2.4-2"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"hylafax","fixed_in":["4.1.1-4woody1"],"sources":["osv"]},{"ecosystem":"Debian:3.1","package":"hylafax","fixed_in":["1:4.2.1-5sarge3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.4-2"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-4woody1"}]}]},{"source":"osv","ecosystem":"Debian:3.1","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.1-5sarge3"}]}],"versions":["1:4.2.1-5","1:4.2.1-5sarge1"]}],"products":[{"vendor":"hylafax","product":"hylafax"}],"references":[{"url":"http://secunia.com/advisories/18314","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/bid/16151","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://secunia.com/advisories/18366","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/18337","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.hylafax.org/content/HylaFAX_4.2.4_release","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200601-03.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://secunia.com/advisories/18489","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2005/dsa-933","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/archive/1/420974/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://www.vupen.com/english/advisories/2006/0072","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:015","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3539"},{"url":"https://github.com/advisories/GHSA-cmp6-2c27-3682"},{"url":"https://security-tracker.debian.org/tracker/CVE-2005-3539","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2005-3539","description":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.","status":"published","published":"2006-01-06T11:00:00Z","modified":"2024-08-07T23:17:23.34Z","updated_at":"2026-11-02T14:33:38.187792Z"}],"euvd":[{"id":"EUVD-2005-3538","description":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.","status":"published","published":"2006-01-06T11:00:00Z","modified":"2024-08-07T23:17:23Z","updated_at":"2026-11-03T01:15:26.279574Z"}],"ghsa":[{"id":"GHSA-cmp6-2c27-3682","title":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to...","description":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.","status":"published","published":"2022-05-01T02:19:00Z","modified":"2023-01-30T05:07:27Z","updated_at":"2026-11-02T14:47:41.731727Z"}],"nvd":[{"id":"CVE-2005-3539","description":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.","status":"published","published":"2005-12-31T05:00:00Z","modified":"2026-06-16T22:17:09.44Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:00:58.826417Z"}],"osv":[{"id":"CVE-2005-3539","description":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.","status":"published","published":"2005-12-31T05:00:00Z","modified":"2026-04-10T03:38:14.861485Z","updated_at":"2026-11-02T15:43:56.581247Z"},{"id":"DEBIAN-CVE-2005-3539","description":"Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.","status":"published","published":"2005-12-31T05:00:00Z","modified":"2026-10-23T03:47:25.673253246Z","updated_at":"2026-11-02T15:45:22.831407Z"},{"id":"DSA-933-1","title":"hylafax - arbitrary command execution","status":"published","published":"2006-01-09T00:00:00Z","modified":"2026-03-09T02:09:55.335295Z","updated_at":"2026-11-02T15:46:18.716547Z"}]}}