CVE-2020-15396: fedoraproject fedora Race Condition
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2020-15396UBUNTU-CVE-2020-15396DEBIAN-CVE-2020-15396
Published 30-06-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-15396 is a high (CVSS 7.8) Race Condition vulnerability in fedoraproject fedora. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 30-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 7.2Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 19-09-2026
19-09-202619-10-2026
EPSS score0.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.suse.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Opensuse2 products
- backports_sle15.0:sp1 | 15.0:sp2
- leapEOL15.1 | 15.2
Alpine1 product
- hylafaxplus< 7.0.0-r4 | < 7.0.1-r2 | < 7.0.2-r2 | < 7.0.0-r1
Debian1 product
- hylafax< 3:6.0.7-3.1
Fedoraproject1 product
- fedoraEOL31 | 32
Hylafax\+_project1 product
- hylafax\+≤ 7.0.2
Ifax1 product
Ubuntu1 product
- hylafaxAll versions (No fix recorded)
7 vendors · 8 products
References
13 links- lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00040.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00046.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00054.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
