{"id":"CVE-2020-8024","aliases":["EUVD-2020-28936","GHSA-rv88-x9wr-52g7","UBUNTU-CVE-2020-8024","openSUSE-SU-2020:0958-1","openSUSE-SU-2024:10852-1"],"status":"published","title":"Problematic permissions in hylafax+ packaging allow escalation from uucp to other users","description":"A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.00543,"percentile":0.45853,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2020-06-29T07:45:17Z","modified":"2026-10-17T12:56:57Z","fixes":[{"ecosystem":"openSUSE:Leap 15.1","package":"hylafax+","fixed_in":["7.0.2-lp151.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.6-6","3:6.0.6-6+deb8u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.6-8","3:6.0.6-8.1~ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.6-8.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.7-3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.7-5build1","3:6.0.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.7-11.1","3:6.0.7-13"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.7-13build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"hylafax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3:6.0.7-13","3:6.0.7-13build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"hylafax+","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2-lp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hylafax+","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.3-5.1"}]}],"bundled":4}],"products":[{"vendor":"opensuse","product":"hylafax\\+"},{"vendor":"opensuse","product":"opensuse factory"},{"vendor":"opensuse","product":"opensuse leap 15.1"},{"vendor":"opensuse","product":"opensuse leap 15.2"},{"vendor":"suse","product":"opensuse factory"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1172731","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00022.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8024"},{"url":"https://github.com/advisories/GHSA-rv88-x9wr-52g7"},{"url":"https://ubuntu.com/security/CVE-2020-8024","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8024","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XHWPHMKS35ISNF5JZ56E5H5RJWYOEWF5/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172731","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8024","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15397","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-8024","title":"Problematic permissions in hylafax+ packaging allow escalation from uucp to other users","description":"A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.","status":"published","published":"2020-06-29T07:45:17.539Z","modified":"2024-09-17T01:21:22.13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-28936","description":"A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.","status":"published","published":"2020-06-29T07:45:17Z","modified":"2024-09-17T01:21:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:28:50.234993Z"}],"ghsa":[{"id":"GHSA-rv88-x9wr-52g7","title":"A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2,...","description":"A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.","status":"published","published":"2022-05-24T17:22:04Z","modified":"2023-01-29T05:03:04Z","updated_at":"2026-11-02T14:45:14.198561Z"}],"nvd":[{"id":"CVE-2020-8024","description":"A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.","status":"published","published":"2020-06-29T08:15:10.05Z","modified":"2026-06-17T03:25:48.62Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"UBUNTU-CVE-2020-8024","description":"A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.","status":"published","published":"2020-06-29T08:15:00Z","modified":"2026-10-17T12:56:57.012148463Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"openSUSE-SU-2020:0958-1","title":"Security update for hylafax+","description":"This update for hylafax+ fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2020-8024 boo#1172731 \n\nhylafax+ was updated to version 7.0.2:\n\n* change FIXEDWIDTH default to better accommodate auto-rotation (13 Dec 2019)\n* prevent SSL_accept() from blocking (5 Dec 2019)\n* support libtiff v4.1 (5 Dec 2019)\n* fix ignoremodembusy feature broken by ModemGroup limits feature (16 Nov 2019)\n\nVersion 7.0.1:\n\n* create a client timeout setting and change the default from 60 to\n  3600 seconds (26 Sep 2019)\n* extend timeout for receiving ECM frames (21 Aug 2019)\n* fix timeout in Class 1 frame reception (5 Aug 2019)\n* improve Class 1 protocol handling when MaxRecvPages exceeded (31 Jul 2019)\n* fix ModemGroup limit default (11 Jul 2019)\n* fix recovery for SSL Fax write failures (6 Jun 2019)\n\nVersion 7.0.0:\n\n* add LDAP features for compatibility with ActiveDirectory (25 Mar-1 Apr 2019)\n* fix recovery after SSL Fax 'accept failure' (18 Mar 2019)\n* add TextFormat overstrike option and disable by default (6 Feb 2019)\n* fix the page size of cover sheets returned via notify (8 Jan 2019)\n* fix or silence numerous compiler warnings (19, 22, 28 Dec 2018)\n* fix pagehandling updating after a proxy has been used (7-8 Dec 2018)\n* add faxmail stderr output of RFC2047 decoding results (5 Dec 2018)\n* fix faxmail handling of headers encoded with UTF-8 (4 Dec 2018)\n* fix faxmail handling of base64-encoded text parts (4 Dec 2018)\n* add SSL Fax support (9-26, 29 Nov; 11, 18, 25 Dec 2018; 2, 7, 23 Jan 2019)\n","status":"published","published":"2020-07-14T04:27:24Z","modified":"2026-02-04T04:21:17.117935Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10852-1","title":"hylafax+-7.0.3-5.1 on GA media","description":"These are all security issues fixed in the hylafax+-7.0.3-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:30.248616Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}