CVE-2018-16745

An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Make sure the notify option in /etc/mgetty+sendfax/mgetty.config does not contain more than 150 characters and that the file is readable and writable only by root.