CVE-2005-3070: HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow loc

Q: How do I fix CVE-2005-3070?

hylafax: upgrade to newer than 4.2.1. Exact commands for each OS are on this page.

Q: Is CVE-2005-3070 being exploited?

CVE-2005-3070 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2005-3070 affect?

CVE-2005-3070 affects hylafax. Severity is low (CVSS 3.6). HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file.

Q: How urgent is CVE-2005-3070?

Priority 20/100. No elevated risk signals yet.

Routine

LOW 3.6UPGRADE

CVE-2005-3070 is a low-severity flaw (CVSS 3.6) affecting hylafax. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	3.6 (Low)
EPSS exploit chance	0.4% (top 70%)
CISA exploited list	No
Published	2005-09-27
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: hylafax

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2005-09-27 19:03 UTCPublished CVE record published
2026-06-16 22:16 UTCUpdated Record last modified

hylafax hylafax UPGRADE

Affected: <= 4.2.1

Fixed in: newer than 4.2.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy hylafax || rpm -q hylafax || hylafax --version

2. UPGRADE to newer than 4.2.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade hylafax

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade hylafax

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2005-3070?

hylafax: upgrade to newer than 4.2.1. Exact commands for each OS are on this page.

Is CVE-2005-3070 being exploited?

CVE-2005-3070 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2005-3070 affect?

CVE-2005-3070 affects hylafax. Severity is low (CVSS 3.6). HylaFax 4.2.1 and earlier does not create or verify ownership of the UNIX domain socket, which might allow local users to read faxes and cause a denial of service by creating the socket using the hyla.unix temporary file.

How urgent is CVE-2005-3070?

Priority 20/100. No elevated risk signals yet.

Related CVEs

CVE-2025-1782 CRITICAL 9.9 UPGRADE UPGRADE In HylaFAX Enterprise Web Interface and AvantFAX, the language form element is not properly sanitized before
CVE-2020-11766 HIGH 8.8 UPGRADE UPGRADE sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticat
CVE-2018-17141 CRITICAL 9.8 MITIGATE DOWNGRADE HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that p
CVE-2005-3539 HIGH 7.5 DOWNGRADE Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitra
CVE-2005-3538 HIGH 7.5 DOWNGRADE hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attacke

References

← Back to latest CVEs