gfax 0.4.2 and probably other versions creates temporary files insecurely, which allows local users to execute arbitrary commands via unknown vectors.
http://secunia.com/advisories/25937/ They say to update to 0.7.6, which is the version we ship and it's not vulnerable (I checked the code to be sure), so we can close this one.