CVE-2018-16741

NameCVE-2018-16741
DescriptionAn issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1502-1, DSA-4291-1
Debian Bugs910448

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mgetty (PTS)buster1.2.1-1fixed
bullseye1.2.1-1.1fixed
sid, trixie, bookworm1.2.1-1.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mgettysourcejessie1.1.36-2.1+deb8u1DLA-1502-1
mgettysourcestretch1.1.36-3+deb9u1DSA-4291-1
mgettysource(unstable)1.2.1-1910448

Notes

https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty/
Upstream commit: 1a7b3a30f79bae4cfbc6404fe4648689cd0ade62 (1.2.1)
Search for package or bug name: Reporting problems