HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15397
Reference (s):
- FEDORA:FEDORA-2020-01eb48bcce
- URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/J52QFVREJWJ35YSEEDDRMZQ2LM2H2WE6/
- FEDORA:FEDORA-2020-8aa8793d25
- URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/Y46FOVJUS5SO44A2VEKR7DXEHTI4WK5L/
- GENTOO:GLSA-202007-06