CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2026/09/29 11:49:54
Modified files:
textproc/groff : Makefile
Added files:
textproc/groff/patches: patch-contrib_mm_mmroff_pl
patch-src_devices_gropdf_pdfmom_pl
patch-src_preproc_html_pre-html_cpp
patch-src_roff_troff_input_cpp
Log message:
Backport three security fixes from the groff-1.24.2 release.
OK naddy@ on a previous, minimally different version of this patch.
>From the groff-1.24.2 release announcement (September 28, 2026):
"This release corrects command injection security vulnerabilities
(CWE-78) in the mmroff, pdfmom, and pre-grohtml programs. The last of
these is a preprocessor that is run when groff or troff is run with the
-T html or -T xhtml options. The vulnerabilities are variously
14-26 years old. Malicious input can escape groff's default "safer"
mode, running commands embedded in that input at the user's privilege
level. The groff development team recommends this release to any users
who employ the named tools or GNU troff output formats with untrusted
inputs.
Man page rendering is not vulnerable unless rendering (X)HTML."
