PT-2011-1197 · Gnu+1 · Groff+1

Nico Golde · Publicado 2011-06-30 · Atualizado 2016-03-30 · CVE-2009-5078

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions groff versions prior to 1.22.2 groff versions prior to 1.21

Description The issue allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document. Multiple vulnerabilities in the groff package can lead to a violation of the integrity and availability of protected information. Exploitation of these vulnerabilities can be carried out remotely.

Recommendations For versions prior to 1.21, update to version 1.21 or later. For versions prior to 1.22.2, update to version 1.22.2 or later. As a temporary workaround, consider disabling the pdfroff.sh script in contrib/pdfmark/ until a patch is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

CWE-254

Identificadores relacionados

ALT-PU-2016-1079

BDU:2015-09687

CVE-2009-5078

Produtos afetados

Alt Linux

Groff

Referências · 20

• http://openwall.com/lists/oss-security/2009/08/09/1 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5044 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2016-1079 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201310-14.xml · Nota
• ftp://ftp.gnu.org/gnu/groff/groff-1.20.1-1.21.diff.gz · Correção
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-5078 · Nota de Segurança
• https://support.apple.com/kb/HT205031 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-5078 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5080 · Nota de Segurança
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538338 · Nota
• http://openwall.com/lists/oss-security/2009/08/10/2 · Nota
• https://osv.dev/vulnerability/CVE-2009-5078 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5079 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-5078 · Aviso do Fabricante