{"action":"Upgrade groff to 1.20.1-5 or later.","affected":[{"fixed":"1.20.1-5","introduced":"0"}],"component":"groff","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["1.20.1-5"],"id":"tcs_01M5N9F9SAQRNZKHCX04TR8MA2","modified_at":"2026-10-23T18:00:40.648078712Z","published_at":"2011-06-30T15:55:01.583Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2009-5078","https://security-tracker.debian.org/tracker/CVE-2009-5078"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2009-5078","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2009-5078"}],"summary":"contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbit"}