CVE-2001-1022 Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the -S option and execute arbitrary commands via format string....
HighCVSS 7.5
EPSS 11.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the -S option and execute arbitrary commands via format string specifiers in the plot command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU groff | = 1.10 | No fix listed |
| GNU groff | = 1.11 | No fix listed |
| GNU groff | = 1.11a | No fix listed |
| GNU groff | = 1.14 | No fix listed |
| GNU groff | = 1.15 | No fix listed |
| GNU groff | = 1.16.1 | No fix listed |
| jgroff | All versions | No fix listed |
References
- CLA-2001:428 vendor-advisory
- DSA-072 patch vendor-advisory
- DSA-107 vendor-advisory
- 1914 vdb-entry
- RHSA-2002:004 vendor-advisory
- 20010727 ADV/EXP:pic/lpd remote exploit - RH 7.0 mailing-list patch
- 3103 exploit patch vdb-entry
- linux-groff-format-string(6918) vdb-entry