Gentoo: GLSA 200411-15 Normal: OpenSSL Groff Symlink Threat

Gentoo Linux Security Advisory GLSA 200411-15 https://security.gentoo.org/ Severity: Normal Title: OpenSSL, Groff: Insecure tempfile handling Date: November 08, 2004 Bugs: #68404, #68407 ID: 200411-15

Synopsis ======= groffer, included in the Groff package, and the der_chop script, included in the OpenSSL package, are both vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.
Background ========= OpenSSL is a toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols as well as a general-purpose cryptography library. It includes the der_chop script, which is used to convert DER-encoded certificates to PEM format. Groff (GNU Troff) is a typesetting package which reads plain text mixed with formatting commands and produces formatted output. It includes groffer, a command used ...