CVE-2020-15396: Fedoraproject Fedora

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root.

Affected products

• Fedoraproject Fedora: version 31 only; version 32 only
• Hylafax+ Project Hylafax+: up to and including 7.0.2
• Ifax Hylafax Enterprise: affected versions not specified
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2020-06-30. Last modified 2026-06-17.