Hello wheat MAX, At 2026-11-09T03:20:44-0800, [email protected] wrote: > I would like to report two independent security defects in GNU groff, > both verified against the 1.24.0 sources. They are unrelated to each > other; I am sending them in one message for convenience and am happy > to split them into separate Savannah entries if you prefer. No > publication date is set and I am glad to coordinate timing.
Please respect the charter of the bug-groff list: "About bug-groff GNU roff is a typesetting document formatter. This list is a reflector for ticket traffic originating in groff's Savannah project. Please direct discussion to the groff list." https://lists.gnu.org/mailman/listinfo/bug-groff > ================================================================================ > (1) eqn: stack buffer overflow in interpolate_macro_with_args via > macro arguments > ================================================================================ > CWE-121 (Stack-based Buffer Overflow) > Component: interpolate_macro_with_args (src/preproc/eqn/lex.cpp) > Affected: groff 1.24.0 and earlier releases carrying the same eqn > lexer (1.23.0 included) > Vector: local / file-borne - a macro call in an .eqn or roff input > document (reachable via groff -e) > Impact: out-of-bounds stack write (of pointers) -> denial of service / > memory corruption Please review the following resources: https://savannah.gnu.org/bugs/?68468 https://lists.gnu.org/archive/html/info-gnu/2026-11/msg00001.html > ================================================================================ > (2) pre-grohtml: OS command injection via the image_generator value in > devhtml/DESC > ================================================================================ > CWE-78 (OS Command Injection) > Component: the HTML image-generation pipeline in pre-grohtml > Affected: groff 1.24.0 (studied at commit > 967814d0057ba2bd7802c81dae2bc0e7a4f2616e) and earlier > releases carrying the same code > Vector: local - a device description file (devhtml/DESC) supplied through -F > Impact: arbitrary OS command execution with the privileges of the invoking > user Please review the following resources: https://savannah.gnu.org/bugs/?68688 https://lists.gnu.org/archive/html/info-gnu/2026-09/msg00009.html > Discoverer / Reporter: wheat MAX <[email protected]> You lack priority in both of these discoveries. Regards, Branden
signature.asc
Description: PGP signature
