CVE-2009-5081 describes a local privilege escalation vulnerability affecting GNU troff (groff) versions 1.21 and earlier. Specifically, the config.guess, groffer.pl, and roff2.pl scripts use an insufficient number of X characters in temporary file creation, enabling a symlink attack to overwrite arbitrary files. This vulnerability has a CVSS score of 3.3, indicating low severity. It requires local access and medium attack complexity, with potential impacts limited to partial integrity and availability. There is no evidence of active exploitation, nor are there any publicly available exploit modules in Metasploit or ExploitDB. Community discussion and media coverage for this CVE are virtually nonexistent.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.21CPE matchmatch criteria | cpe:2.3:a:gnu:groff:*:*:*:*:*:*:*:* | ||
1.10CPE matchmatch criteria | cpe:2.3:a:gnu:groff:1.10:*:*:*:*:*:*:* | ||
1.11CPE matchmatch criteria | cpe:2.3:a:gnu:groff:1.11:*:*:*:*:*:*:* | ||
1.11aCPE matchmatch criteria | cpe:2.3:a:gnu:groff:1.11a:*:*:*:*:*:*:* | ||
1.14CPE matchmatch criteria | cpe:2.3:a:gnu:groff:1.14:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:M/Au:N/C:N/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.