HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root). Upstream Reference: https://sourceforge.net/p/hylafax/HylaFAX+/2534/
Created hylafax+ tracking bugs for this issue: Affects: epel-all [bug 1852805] Affects: fedora-all [bug 1852804]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.