The mgetty-sendfax package contains a vulnerability which allows any
user with access to the /var/tmp directory to destroy any file on any
mounted filesystem.
The advisory is at LWN.net