PT-2011-1197 · Gnu+1 · Groff+1

Nico Golde · Published 2011-06-30 · Updated 2016-03-30 · CVE-2009-5078

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions groff versions prior to 1.22.2 groff versions prior to 1.21

Description The issue allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document. Multiple vulnerabilities in the groff package can lead to a violation of the integrity and availability of protected information. Exploitation of these vulnerabilities can be carried out remotely.

Recommendations For versions prior to 1.21, update to version 1.21 or later. For versions prior to 1.22.2, update to version 1.22.2 or later. As a temporary workaround, consider disabling the pdfroff.sh script in contrib/pdfmark/ until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-254

Related Identifiers

ALT-PU-2016-1079

BDU:2015-09687

CVE-2009-5078

Affected Products

Alt Linux

Groff

References · 20

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5044 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-1079 · Vendor Advisory
• ftp://ftp.gnu.org/gnu/groff/groff-1.20.1-1.21.diff.gz · Patch
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-5078 · Security Note
• https://support.apple.com/kb/HT205031 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-5078 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5080 · Security Note
• https://osv.dev/vulnerability/CVE-2009-5078 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5079 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-5078 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09687 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5078 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5081 · Security Note
• http://openwall.com/lists/oss-security/2009/08/09/1 · Note