mgetty 1.1.22 allows local users to overwrite arbitrary files via a symlink attack in some configurations.