From the CHANGES:
> Changelog for HylaFAX 4.2.5
>
> * change notify to not rely on echo -e (BUG 724) (11 Jan 2005)
> * add prototype config catch for Digicom Leonardo modems (11 Jan 2005)
> * make sure probemodem removes lock files (BUG 691) (9 Jan 2005)
> * portability cleanup to MemoryDecoder.c++ (BUG 224) (9 Jan 2005)
> * include crypt.h where necessary (BUG 722) (9 Jan 2005)
> * fix eval sed in faxrcvd script (BUG 719) (9 Jan 2006)
> * fix shell comments in nofity AWK script (BUG 719) (9 Jan 2006)
>
> Changelog for HylaFAX 4.2.4
>
> * CVE-2005-3539: Fix for faxrcvd/notify script vulnerabilites
> (4 Jan 2004)
> * don't lock-down pagingProtocol by default (15 Dec 2005)
> * CVE-2005-3538: fix possible hfaxd login vulnerability due
> to PAM library absence during build (15 Dec 2005)
> * fix a Solaris compile error due to PAM_CONV_AGAIN (15 Dec 2005)
> * fix Solaris 9 compile error due to PAM (15 Dec 2005)
> * all Mainpine boards no longer identified as the DUO+
> 2-port model (5 Dec 2005)
> * update hfaxd 'site adduser' functionality (29 Nov 2005)
> * prevent some faxgetty hangs in Phase C EOL sync (29 Nov 2005)
> * fix for clients specifying TZONE LOCAL/GMT and using %Y for
> JobFmt and RcvFmt (22 Nov 2005)
770f810183