CVE-2018-17141

HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.

• CWE-787
• CWE-824

• http://git.hylafax.org/HylaFAX?a=commit%3Bh=c6cac8d8cd0dbe313689ba77023e12bc5b3027be
• http://www.openwall.com/lists/oss-security/2018/09/20/1Exploit, Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00026.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2018/Sep/49Exploit, Mailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4298Third Party Advisory
• https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax/Exploit, Third Party Advisory
• http://git.hylafax.org/HylaFAX?a=commit%3Bh=c6cac8d8cd0dbe313689ba77023e12bc5b3027be
• http://www.openwall.com/lists/oss-security/2018/09/20/1Exploit, Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00026.htmlMailing List, Third Party Advisory
• https://seclists.org/bugtraq/2018/Sep/49Exploit, Mailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4298Third Party Advisory
• https://www.x41-dsec.de/lab/advisories/x41-2018-008-hylafax/Exploit, Third Party Advisory

Published

Sep 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-17134admin/web_config.php in PHPMyWind 5.5 allows Admin users to …
• CVE-2018-17136zzcms 8.3 contains a SQL Injection vulnerability in /user/ch…
• CVE-2018-17137Prezi Next 1.3.101.11 has a documented purpose of creating H…
• CVE-2018-17138The Jibu Pro plugin through 1.7 for WordPress is prone to St…
• CVE-2018-17139UltimatePOS 2.5 allows users to upload arbitrary files, whic…
• CVE-2018-17140The Quizlord plugin through 2.0 for WordPress is prone to St…
• CVE-2018-17142The html package (aka x/net/html) through 2018-09-17 in Go m…7.5
• CVE-2018-17143The html package (aka x/net/html) through 2018-09-17 in Go m…7.5
• CVE-2018-17144Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and…7.5
• CVE-2018-17145Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x b…7.5
• CVE-2018-17146A cross-site scripting vulnerability exists in Nagios XI bef…
• CVE-2018-17147Nagios XI before 5.5.4 has XSS in the auto login admin manag…