PatchTheCVEfonality vulnerabilities and fixes
Recent CVEs affecting fonality, with upgrade or downgrade steps. 3 tracked.
fonality has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2016-06-20. Highest priority: CVE-2016-2362 (score 60/100).
- CVE-2016-2364 HIGH 7.5 UPGRADE DOWNGRADE The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the s
- CVE-2016-2363 HIGH 7.8 DOWNGRADE Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/
- CVE-2016-2362 CRITICAL 9.8 DOWNGRADE Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP ac
FAQ
How do I fix fonality vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is fonality being exploited right now?
None of the tracked fonality CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which fonality CVE should I patch first?
CVE-2016-2362 currently ranks highest (60/100): Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP ac.