gbranden pushed a commit to branch master
in repository groff.
commit f3572a806be347701531abd9f008054ff058d4ee
Author: G. Branden Robinson <[email protected]>
AuthorDate: Mon Sep 28 12:43:17 2026 -0500
Cherry-pick groff 1.24.2 release information.
---
ChangeLog.124 | 5 +++++
NEWS | 21 +++++++++++++++++++++
doc/webpage.ms | 2 +-
3 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/ChangeLog.124 b/ChangeLog.124
index d3c4fddd6..0c05d0fe0 100644
--- a/ChangeLog.124
+++ b/ChangeLog.124
@@ -1,3 +1,8 @@
+Version 1.24.2 released 2026-09-28
+==================================
+
+[bug fixes for Savannah #68687, #68688, #68689 not yet merged on master]
+
Version 1.24.1 released 2026-03-14
==================================
diff --git a/NEWS b/NEWS
index 3e710f349..9f34511a2 100644
--- a/NEWS
+++ b/NEWS
@@ -219,6 +219,27 @@ Miscellaneous
`--enable-maintainer-mode` option to its 'configure' script.
+VERSION 1.24.2
+==============
+
+This release corrects command injection security vulnerabilities
+(CWE-78) in the mmroff, pdfmom, and pre-grohtml programs. The last of
+these is a preprocessor that is run when groff or troff is run with the
+`-T html` or `-T xhtml` options. The vulnerabilities are variously
+14-26 years old. Malicious input can escape groff's default "safer"
+mode, running commands embedded in that input at the user's privilege
+level. The groff development team recommends this release to any users
+who employ the named tools or GNU troff output formats with untrusted
+inputs.
+
+Man page rendering is not vulnerable unless rendering (X)HTML.
+
+This release also resolves a command-line argument processing defect in
+the gxditview program. It is not known to have any security impact.
+
+There are no new features.
+
+
VERSION 1.24.1
==============
diff --git a/doc/webpage.ms b/doc/webpage.ms
index 72893c693..30f21dcd0 100644
--- a/doc/webpage.ms
+++ b/doc/webpage.ms
@@ -95,7 +95,7 @@ and its mirrors;
the current development version is available from a
.URL "https://\:savannah.gnu.org/\:git/\:?group=groff"; "git repository" .
.
-The current version is 1.24.1 (March 2026).
+The current version is 1.24.2 (September 2026).
To view the git repository in your browser, use
.URL "http://\:git.savannah.gnu.org/\:cgit/\:groff.git"; \
_______________________________________________
groff-commit mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/groff-commit
