TI-2009-04834 Aliases CVE-2009-5082 GHSA-6ww7-mx3f-8cq3

The (1) configure and (2) config.guess scripts in GNU troff (aka groff) 1.20.1 on…

LOW 16CWE-59Published 2011-06-30 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: None · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The (1) configure and (2) config.guess scripts in GNU troff (aka groff) 1.20.1 on Openwall GNU/*/Linux (aka Owl) improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file.

Why it matters now

EPSS 0.0032 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:gnu:groff:1.20.1:::::::*	1.20.1	Vulnerable	GNU
cpe:2.3:o:openwall:owl::::::::	all versions	Running on	Openwall

cpe:2.3:a:gnu:groff:1.20.1:*:*:*:*:*:*:* Versions 1.20.1 Vulnerable ·GNU
cpe:2.3:o:openwall:owl:*:*:*:*:*:*:*:* Versions all versions Running on ·Openwall

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2009-5082
2026-10-03 Alias added: GHSA-6ww7-mx3f-8cq3

References

Patch 3

Other 1

http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h

TI-2000-00800 GNU Groff uses the current working directory to find a device description file, which… CVSS 2.0HIGH 10.0
TI-2001-00977 Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff… CVSS 2.0HIGH 7.5
TI-2002-00003 Buffer overflow in the preprocessor in groff 1.16 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5
TI-2009-04830 contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript… CVSS 3.0MEDIUM 6.5
TI-2009-04833 The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3)… CVSS 2.0LOW 3.3
TI-2009-04832 The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3)… CVSS 2.0LOW 3.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences