USN-43-1: groff utility vulnerabilities

Javier Fernández-Sanguino Peña discovered that the auxiliary scripts "eqn2graph" and "pic2graph" created temporary files in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program...

groff -- pic2graph and eqn2graph are vulnerable to symlink attack through temporary files

The eqn2graph and pic2graph scripts in groff 1.18.1 allow local users to overwrite arbitrary files via a symlink attack on temporary files...

OpenSSL, Groff: Insecure tempfile handling

Background OpenSSL is a toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols as well as a general-purpose cryptography library. It includes the derchop script, which is used to convert DER-encoded certificates to PEM format. Groff GNU Troff is a typesetting package...

GLSA-200411-15 : OpenSSL, Groff: Insecure tempfile handling

The remote host is affected by the vulnerability described in GLSA-200411-15 OpenSSL, Groff: Insecure tempfile handling groffer and the derchop script create temporary files in world-writeable directories with predictable names. Impact : A local attacker could create symbolic links in the tempora...

USN-13-1: groff utility vulnerability

Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program...

CVE-2004-0969

Technical details for CVE-2004-0969 are not publicly provided in the supplied connected documents. The materials reference the vulnerability generally (symlink attack in groff), but do not contain product/version/impact/fix specifics. Monitor for updates.

CVE-2004-0969

The groffer script in the Groff package 1.18 and later versions, as used in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files...

groff -- groffer uses temporary files unsafely

The groffer script in the groff package 1.18 and later versions allows local users to overwrite files via a symlink attack on temporary files...

Debian DSA-072-1 : groff - printf format attack

Zenith Parse found a security problem in groff the GNU version oftroff. The pic command was vulnerable to a printf format attack which made it possible to circumvent the -S' option and execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : groff (MDKSA-2002:012)

zen-parse discovered an exploitable buffer overflow in groff's preprocessor. If groff is invoked using the LPRng printing system, an attacker can gain rights as the 'lp' user. Likewise, this may be remotely exploitable if lpd is running and remotely accessible and the attacker knows the name of t...

Linux groff utility pic contains format string vulnerability

Overview The pic component of the image processing package groff contains a format string vulnerability that could allow a remote attacker to execute arbitrary code. Description groff is an image processing package on Linux systems. A component of groff called pic contains a format-string...

CVE-2001-1022

CVE-2001-1022 relates to a format-string vulnerability in the groff family: the pic component of groff (and jgroff before 1.15) could bypass the -S option and execute arbitrary commands via format-string specifiers in the plot command. Affected: groff 1.16.1 and other versions; jgroff before 1.15...

CVE-2002-0003

CVE-2002-0003 describes a buffer overflow in the groff preprocessor (groff 1.16 and earlier) that can allow remote attackers to gain privileges via the LPRng printing system when groff is invoked through lpd. The vulnerability affects the preprocessor and can enable privilege escalation to the lp...

CVE-2001-1022

Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command...

CVE-2002-0003

Buffer overflow in the preprocessor in groff 1.16 and earlier allows remote attackers to gain privileges via lpd in the LPRng printing system...

Important: Red Hat Security Advisory: : : : New groff packages available to fix security problems

New groff packages have been made available that fix an overflow in groff. If the printing system running this is a security issue, it is recommended to update to the new, fixed packages. Update Jan 22 2003 Added description of CVE-2001-1022 which was also fixed by these erratum packages Groff is...

[SECURITY] [DSA-072-1] groff printf format problem

Package : groff Problem type : printf format attack Debian-specific: no Zenith Parse found a security problem in groff the GNU version of troff. The pic command was vulnerable to a printf format attack which made it possible to circumvent the -S option and execute arbitrary code. This has been...

Ошибка форматной строки в groff (format string)

Ошибка форматной строки в /usr/bin/pic используемой LPD...

CVE-2001-1022

Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command...

GNU groff 1.1x - xploitation Via LPD

GNU groff 1.1x - xploitation Via LPD // source: https://www.securityfocus.com/bid/3103/info lpd is the print spooling daemon. It is used to support network printing on a variety of unix platforms. The version of lpd that ships with linux systems invokes groff to process documents that are to be...