CVE-2005-3539 in the critical feed json
Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notif…
published 2005-12-31 20 y ago modified 2026-06-16 4 mo ago also EUVD-2005-3538
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 12.7%
- EPSS 12.7% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.
Patch / fix
- hylafax Debian 14, Debian 13, Debian 12 2:4.2.4-2
debian advisories DEBIAN-CVE-2005-3539
- securityfocus.com/bid/16151 patch
- gentoo.org/security/en/glsa/glsa-200601-03.xml advisory
- secunia.com/advisories/18314 advisory
- secunia.com/advisories/18337 advisory
Timeline
- Published
- First public exploit (EDB-27032)
Exploit prediction
12.65% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-27032 Hylafax 4.1/4.2 (Multiple Scripts) - Remote Command Execution remote, 2006-01-05
- securityfocus.com http://www.securityfocus.com/bid/16151 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
gentoo.org
/security/en/glsa/glsa-200601-03.xml
vendor-advisory, patch
-
secunia.com
/advisories/18314
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/16151
vdb-entry, exploit, patch
-
secunia.com
/advisories/18337
third-party-advisory, patch, vendor-advisory
-
debian.org
/security/2005/dsa-933
vendor-advisory
-
mandriva.com
/security/advisories?name=MDKSA-2006:015
vendor-advisory
-
secunia.com
/advisories/18366
third-party-advisory
- hylafax.org /content/HylaFAX_4.2.4_release
-
secunia.com
/advisories/18489
third-party-advisory
-
securityfocus.com
/archive/1/420974/100/0/threaded
mailing-list
- bugs.hylafax.org /bugzilla/show_bug.cgi?id=719
-
vupen.com
/english/advisories/2006/0072
vdb-entry
Sources
- CVE List CVE-2005-3539
- NVD CVE-2005-3539
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.