CVE-2018-16741

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-13 · updated 2026-06-17
Weakness: CWE-78

Description

An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.

Affected products

Debian Linux: 8.0, 9.0
mgetty: before 1.2.1 — fixed in 1.2.1

How to fix

Upgrade to a fixed version: mgetty 1.2.1. Check the vendor advisory for mitigations.

References

https://lists.debian.org/debian-lts-announce/2018/09/msg00012.html
https://www.debian.org/security/2018/dsa-4291
https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty
https://lists.debian.org/debian-lts-announce/2018/09/msg00012.html
https://www.debian.org/security/2018/dsa-4291
https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty

Get alerted when CVE-2018-16741 or the next vulnerability affects your stack