FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0969

This CVE name corresponds to:

Entered	Topic
2005-05-09	groff -- groffer uses temporary files unsafely

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-0969 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-0969
Phase	Assigned(20041019)

Description

The groffer script in the Groff package 1.18 and later versions, as used in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.

References

Source	Reference
GENTOO	GLSA-200411-15
MANDRIVA	MDKSA-2006:038
TRUSTIX	2004-0050
CONFIRM	http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136313
BID	11287
SECUNIA	18764
XF	script-temporary-file-overwrite(17583)