Update of bug #68689 (group groff):
Status: In Progress => Fixed
Privacy: Private => Public
Open/Closed: Open => Closed
_______________________________________________________
Follow-up Comment #22:
commit 3d1bcd53e5581b200ba2ae3e89acd6e4fc585570
Author: G. Branden Robinson <[email protected]>
Date: Tue Sep 22 22:30:59 2026 -0500
[mm]: Regression-test Savannah #68689.
* contrib/mm/tests/mmroff-does-not-defeat-safer-mode.sh: Do it.
* contrib/mm/mm.am (mm_TESTS): Run test.
Test fails at this commit.
commit 08a0aa4a05ef55d3a8f008c7ce09d7eb76eff7cf
Author: G. Branden Robinson <[email protected]>
Date: Tue Sep 22 22:33:02 2026 -0500
[mm]: Fix Savannah #68689.
* contrib/mm/mmroff.pl: In main loop, drop use of `eval` in favor of a
simpler hash assignment, preventing a shell command injection
vulnerability in mmroff(1) when a malicious input file inserts a
specially crafted comment line into the standard output or error
streams of the first groff(1) pass this command performs.
Problem appears to date back to commit e092fba451, 2000-02-06, the
initial check-in of the "mmroff.pl" script, which first shipped in groff
1.16. Thanks to Pavol Sloboda for the report and a reproducer, and to
Ingo Schwarze for help preparing a fix.
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68689>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
