What’s Vulnerable › Vulnerabilities

CVE-2009-5078

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2011-06-30 · updated 2026-06-16
• Weakness: CWE-254

Description

contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document.

Affected products

• macOS: through 10.10.4
• GNU Groff: through 1.20.1; 1.10, 1.11, 1.11a, 1.14, 1.15, 1.16 (+8)

References

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538338
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
• http://openwall.com/lists/oss-security/2009/08/09/1
• http://openwall.com/lists/oss-security/2009/08/10/2
• http://www.securityfocus.com/bid/36381
• https://support.apple.com/kb/HT205031
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538338
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
• http://openwall.com/lists/oss-security/2009/08/09/1
• http://openwall.com/lists/oss-security/2009/08/10/2

Get alerted when CVE-2009-5078 or the next vulnerability affects your stack