faxspool in mgetty before 1.1.29 uses a world-writable spool directory for outgoing faxes, which allows local users to modify fax transmission privileges.
https://exchange.xforce.ibmcloud.com/vulnerabilities/11070
http://www.securityfocus.com/bid/7302
http://www.redhat.com/support/errata/RHSA-2003-036.html