Red Hat Bugzilla – Bug 168142
CAN-2004-1296 groff temporary file vulnerabilities in pic2graph and eqn2graph
Last modified: 2007-04-18 13:31:25 EDT
+++ This bug was initially created as a clone of Bug #152840 +++
The (1) eqn2graph and (2) pic2graph scripts in groff 1.18.1 allow local users
to overwrite arbitrary files via a symlink attack on temporary files.
Created attachment 118741 [details]
Patch for CAN-2004-1296
Red Hat 7.3 not vulnerable; does not contain the eqn2graph nor pic2graph
Red Hat Linux and Fedora Core releases <=4 are now completely unmaintained.
These bugs can't be fixed in these versions. If the issue still persists in
current Fedora Core releases, please reopen. Thank you, and sorry about this.