gbranden pushed a commit to branch 1.24.x
in repository groff.
commit b9f6467623834b143ed097629f73aab7360ffea0
Author: G. Branden Robinson <[email protected]>
AuthorDate: Mon Sep 28 12:43:17 2026 -0500
Update for groff 1.24.2 release.
---
ChangeLog | 3 +++
NEWS | 21 +++++++++++++++++++++
arch/mingw/grap2graph.cmd | 2 +-
doc/webpage.ms | 2 +-
4 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 97adaba6f..8c279b7de 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+Version 1.24.2 released 2026-09-28
+==================================
+
2026-09-23 G. Branden Robinson <[email protected]>
* src/preproc/html/pre-html.cpp (imageList::createImage): Fix
diff --git a/NEWS b/NEWS
index 15a2af1f9..45f06baaf 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,27 @@
This file describes recent user-visible changes in groff. Bug fixes are
not described. There are more details in the man and info pages.
+VERSION 1.24.2
+==============
+
+This release corrects command injection security vulnerabilities
+(CWE-78) in the mmroff, pdfmom, and pre-grohtml programs. The last of
+these is a preprocessor that is run when groff or troff is run with the
+`-T html` or `-T xhtml` options. The vulnerabilities are variously
+14-26 years old. Malicious input can escape groff's default "safer"
+mode, running commands embedded in that input at the user's privilege
+level. The groff development team recommends this release to any users
+who employ the named tools or GNU troff output formats with untrusted
+inputs.
+
+Man page rendering is not vulnerable unless rendering (X)HTML.
+
+This release also resolves a command-line argument processing defect in
+the gxditview program. It is not known to have any security impact.
+
+There are no new features.
+
+
VERSION 1.24.1
==============
diff --git a/arch/mingw/grap2graph.cmd b/arch/mingw/grap2graph.cmd
index 7fe7445f1..737d90abd 100644
--- a/arch/mingw/grap2graph.cmd
+++ b/arch/mingw/grap2graph.cmd
@@ -75,7 +75,7 @@ rm -rf %tdir%
goto end
:version
-echo grap2graph (groff) version 1.24.1
+echo grap2graph (groff) version 1.24.2
goto end
:usage
diff --git a/doc/webpage.ms b/doc/webpage.ms
index 72893c693..30f21dcd0 100644
--- a/doc/webpage.ms
+++ b/doc/webpage.ms
@@ -95,7 +95,7 @@ and its mirrors;
the current development version is available from a
.URL "https://\:savannah.gnu.org/\:git/\:?group=groff"; "git repository" .
.
-The current version is 1.24.1 (March 2026).
+The current version is 1.24.2 (September 2026).
To view the git repository in your browser, use
.URL "http://\:git.savannah.gnu.org/\:cgit/\:groff.git"; \
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
