CVE-2018-16741

An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function doactivate does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or characters within a file created by the "faxq-helper activate " command...

CVE-2018-16744

An issue was discovered in mgetty before 1.2.1. In faxnotifymail in faxrec.c, the mailto parameter is not sanitized. It could allow for command injection if untrusted input can reach it, because popen is used...

CVE-2018-16745

An issue was discovered in mgetty before 1.2.1. In faxnotifymail in faxrec.c, the mailto parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it...

CVE-2018-16743

An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy, which can cause a stack-based buffer overflow...

CVE-2018-16743

CVE-2018-16743 affects mgetty prior to 1.2.1. In contrib/next-login/login.c, the username command-line parameter is passed unsanitized to strcpy(), causing a stack-based buffer overflow. This is a local vulnerability with potential partial confidentiality/integrity/availability impact. Mitigation...

PT-2018-1575 · Mgetty +2 · Mgetty +2

Name of the Vulnerable Software and Affected Versions: mgetty versions prior to 1.2.1 Description: An issue in the fax notify mail function in faxrec.c allows for a buffer overflow due to the mail to parameter not being sanitized. This could potentially lead to a denial of service if long untrust...

PT-2018-13716 · Mgetty +2 · Mgetty +2

Name of the Vulnerable Software and Affected Versions: mgetty versions prior to 1.2.1 Description: A stack-based buffer overflow issue can be triggered via a command-line parameter in the contrib/scrts.c file. Recommendations: For versions prior to 1.2.1, update to version 1.2.1 or later to resol...

PT-2018-13718 · Mgetty +2 · Mgetty +2

Name of the Vulnerable Software and Affected Versions: mgetty versions prior to 1.2.1 Description: An issue was discovered where the mail to parameter in the fax notify mail function is not sanitized, potentially allowing for command injection if untrusted input can reach it due to the use of...

PT-2018-13717 · Mgetty +2 · Mgetty +2

Name of the Vulnerable Software and Affected Versions: mgetty versions prior to 1.2.1 Description: An issue was discovered in the contrib/next-login/login.c file, where the command-line parameter username is passed unsanitized to the strcpy function, which can cause a stack-based buffer overflow...

[SECURITY] [DLA 1502-1] mgetty security update

Package : mgetty Version : 1.1.36-2.1+deb8u1 CVE ID : CVE-2018-16741 Two input sanitization failures have been found in the faxrunq and faxq binaries in mgetty. An attacker could leverage them to insert commands via shell metacharacters in jobs id and have them executed with the privilege of the...

DLA-1502-1 mgetty - security update

Bulletin has no description...

Debian DSA-4291-1 : mgetty - security update

Two input sanitization failures have been found in the faxrunq and faxq binaries in mgetty, a smart modem getty replacement. An attacker could leverage them to insert commands via shell metacharacters in jobs id and have them executed with the privilege of the faxrunq/faxq user. C Tenable Network...

Debian DLA-1502-1 : mgetty security update

Two input sanitization failures have been found in the faxrunq and faxq binaries in mgetty. An attacker could leverage them to insert commands via shell metacharacters in jobs id and have them executed with the privilege of the faxrunq/faxq user. For Debian 8 'Jessie', this problem has been fixed...

[SECURITY] [DSA 4291-1] mgetty security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4291-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez September 11, 2018 https://www.debian.org/security/faq -...

PT-2018-3773 · Mgetty +2 · Mgetty +2

Name of the Vulnerable Software and Affected Versions: mgetty versions prior to 1.2.1 Description: The issue is related to the function do activate in mgetty, which does not properly sanitize shell metacharacters, allowing command injection. This can be exploited using characters such as ||, &&, ...

Debian: Security Advisory (DLA-1502-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DSA-4291-1 mgetty - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4291-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2008-4936

faxspool in mgetty 1.1.36 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/faxsp. temporary file...

Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The mgetty-viewfax-1.1.30 package for the Red Hat Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...