{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-08-14T00:00:00", "descriptions": [{"lang": "en", "value": "The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-12-11T13:57:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20090814 Re: CVE id request: groff (pdfroff)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2009/08/14/4"}, {"name": "[oss-security] 20090814 Re: CVE id request: groff (pdfroff)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2009/08/14/5"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h"}, {"name": "MDVSA-2013:085", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:085"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff"}, {"name": "MDVSA-2013:086", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:086"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-5080", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20090814 Re: CVE id request: groff (pdfroff)", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2009/08/14/4"}, {"name": "[oss-security] 20090814 Re: CVE id request: groff (pdfroff)", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2009/08/14/5"}, {"name": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1;r2=1.2;f=h", "refsource": "CONFIRM", "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1;r2=1.2;f=h"}, {"name": "MDVSA-2013:085", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:085"}, {"name": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff", "refsource": "CONFIRM", "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff"}, {"name": "MDVSA-2013:086", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:086"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T07:24:54.070Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20090814 Re: CVE id request: groff (pdfroff)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2009/08/14/4"}, {"name": "[oss-security] 20090814 Re: CVE id request: groff (pdfroff)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2009/08/14/5"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h"}, {"name": "MDVSA-2013:085", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:085"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff"}, {"name": "MDVSA-2013:086", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:086"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-5080", "datePublished": "2011-06-30T15:26:00", "dateReserved": "2011-06-30T00:00:00", "dateUpdated": "2024-08-07T07:24:54.070Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:groff:*:*:*:*:*:*:*:*", "matchCriteriaId": "66EE516B-88DB-47BC-AC1D-66B7C8E39AB1", "versionEndIncluding": "1.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.10:*:*:*:*:*:*:*", "matchCriteriaId": "35017C15-4CCD-4B44-9108-F5650319A009", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.11:*:*:*:*:*:*:*", "matchCriteriaId": "B8AC4613-F1BE-4EEE-84C3-A13D2AC048B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.11a:*:*:*:*:*:*:*", "matchCriteriaId": "2D6BD17C-0DE9-405D-BC02-E996FBC4F97A", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.14:*:*:*:*:*:*:*", "matchCriteriaId": "5493392A-B8E1-4F71-A1ED-6889FD1CC217", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.15:*:*:*:*:*:*:*", "matchCriteriaId": "BDF86410-1841-4549-A0FE-3D16C6CCE383", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.16:*:*:*:*:*:*:*", "matchCriteriaId": "C91EE2C2-DE96-494D-BEEE-D07ED74EDEAC", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.16.1:*:*:*:*:*:*:*", "matchCriteriaId": "EDB1389A-0F7D-4616-8553-AF1E40B05256", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.17.1:*:*:*:*:*:*:*", "matchCriteriaId": "6D4A1AC6-2820-4992-B652-EF6FD308D643", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.17.2:*:*:*:*:*:*:*", "matchCriteriaId": "59A32AD0-B019-4FAF-BC8A-01FE6F90628E", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.18.1:*:*:*:*:*:*:*", "matchCriteriaId": "A81CEA14-F694-431F-BAC9-BBB8CC09BBCB", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.19:*:*:*:*:*:*:*", "matchCriteriaId": "3C3A17D1-F3A9-45FC-A943-C47B8121599C", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.19.1:*:*:*:*:*:*:*", "matchCriteriaId": "0D64601D-0EA0-40AD-9E25-74360051CC2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.19.2:*:*:*:*:*:*:*", "matchCriteriaId": "1D944298-B544-4D38-96A3-5CA22C9C3C7B", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.20:*:*:*:*:*:*:*", "matchCriteriaId": "6F737E42-B8F1-4C9C-B3E9-382BCE43859D", "vulnerable": true}, {"criteria": "cpe:2.3:a:gnu:groff:1.20.1:*:*:*:*:*:*:*", "matchCriteriaId": "9ECE4B65-2CE6-44B6-B29E-97ECA0014C1D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296."}, {"lang": "es", "value": "Los scripts (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, y (3) contrib/pic2graph/pic2graph.sh en GNU troff (tambi\u00e9n conocido como groff) v1.21 y anteriores no maneja adecuadamente ciertos intentos fallidos para crear directorios temporales, lo que permite a usuarios locales sobreescribir ficheros de su elecci\u00f3n a trav\u00e9s de un ataque de enlace simb\u00f3lico sobre un fichero en un directorio temporal, una vulnerabilidad diferente que CVE-2004-1296"}], "id": "CVE-2009-5080", "lastModified": "2024-11-21T01:11:08.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-06-30T15:55:01.723", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff"}, {"source": "cve@mitre.org", "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2009/08/14/4"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2009/08/14/5"}, {"source": "cve@mitre.org", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:085"}, {"source": "cve@mitre.org", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:086"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2009/08/14/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://openwall.com/lists/oss-security/2009/08/14/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:085"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:086"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "groff: improper handling of failed attempts to create temporary directories in eqn2graph/pic2graph/grap2graph", "id": "720058", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=720058"}, "csaw": false, "cvss": {"cvss_base_score": "1.9", "cvss_scoring_vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "status": "draft"}, "details": ["The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296."], "name": "CVE-2009-5080", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:4", "fix_state": "Will not fix", "package_name": "groff", "product_name": "Red Hat Enterprise Linux 4"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "groff", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Will not fix", "package_name": "groff", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2009-08-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-5080\nhttps://nvd.nist.gov/vuln/detail/CVE-2009-5080"], "statement": "Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "threat_severity": "Low"}