CVE-2018-16741: Debian Linux

High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days.

An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Mgetty Project Mgetty: before 1.2.1 (fixed in 1.2.1)

Published 2018-09-13. Last modified 2026-06-17.