An update that fixes 5 vulnerabilities is now available.
This update for mgetty fixes the following issues:
- CVE-2018-16741: Fixed a command injection in fax/faxq-helper.c (boo#1108752) - CVE-2018-16742: Stack-based buffer overflow in contrib/scrts.c triggered via command line parameter (boo#1108762) - CVE-2018-16743: Stack-based buffer overflow with long username in contrib/next-login/login.c (boo#1108761) - CVE-2018-16744: Command injection in faxrec.c (boo#1108757) - CVE-2018-16745: Stack-based buffer overflow in fax_notify_mail() in faxrec.c (boo#1108756)
- sets maximum length of a string to prevent buffer overflow and thus possible command injection - The obsolete contrib/scrts.c tool was deleted, which contained a buffer overflow.
To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product: