Vulnerability in Gnu Groff
CVE-2009-5079
The (1) gendef.sh, (2) doc/fixinfo.sh, and (3) contrib/gdiffmk/tests/runtests.in scripts in GNU troff (aka groff) 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro#####.tmp or /tmp/##### temporary file.
EPSS: 0.003 (22.4th percentile) — read the EPSS interpretation.
Affected products
- Gnu Groff — versions 1.10, 1.11, 1.11a
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Patch)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)