Arbitrary command execution via metamail package using message headers, when user processes attacker's message using metamail.
redhat linux
freebsd freebsd 6.2