Hello, i believe it might be useful to also commit the exact same textproc/groff security patch that i committed to -current ports yesterday to 7.8 and 7.9 -stable ports as well.
The main benefit would be for users still running a traditional, non-mandoc "man.cgi" that spawns groff on a public webserver: the groff -T html vulnerability contained herein would expose such a webserver to remote users being able to run code as the webserver UID on the webserver if malicious man pages are installed on the webserver - and thoroughly vetting man pages before you install them on your webserver is *not* common practice; to the contrary, many webserver operators install and serve manual pages for all kinds of third-party systems and packages. While we don't do any of that on official infrastructure of the OpenBSD project (we don't run traditional man.cgi there, we don't run groff there, and we only serve our own base-system and Xenocara manual pages), it is reasonable to assume that *some* OpenBSD users might still be doing such things. For example, the official man.FreeBSD.org website might still be vulnerable to this vulnerability: They run the traditional man.cgi, they span groff upon HTTP requests, and they serve all kinds of non-FreeBSD manual pages that likely nobody vetted for malicious roff(7) code. If FreeBSD does that even on official servers, then certainly there might be OpenBSD users doing something similar on private servers. Of course, any users running mmroff(1) or pdfmom(1) on their local machine (without any involvement of the WWW) on untrusted files would also benefit, but input files for those utilities are less likely to be malicious and less widely used, so those are a smaller deal, relatively speaking. I never committed to -stable ports before and i don't really know how to test before commit because i don't have any old -stable machines around. Any recommendations what i should do? Thanks in advance, Ingo ----- Forwarded message from Ingo Schwarze <[email protected]> ----- From: Ingo Schwarze <[email protected]> Sender: [email protected] Date: Tue, 29 Sep 2026 11:49:54 -0600 (MDT) To: [email protected] Subject: CVS: cvs.openbsd.org: ports CVSROOT: /cvs Module name: ports Changes by: [email protected] 2026/09/29 11:49:54 Modified files: textproc/groff : Makefile Added files: textproc/groff/patches: patch-contrib_mm_mmroff_pl patch-src_devices_gropdf_pdfmom_pl patch-src_preproc_html_pre-html_cpp patch-src_roff_troff_input_cpp Log message: Backport three security fixes from the groff-1.24.2 release. OK naddy@ on a previous, minimally different version of this patch. >From the groff-1.24.2 release announcement (September 28, 2026): "This release corrects command injection security vulnerabilities (CWE-78) in the mmroff, pdfmom, and pre-grohtml programs. The last of these is a preprocessor that is run when groff or troff is run with the -T html or -T xhtml options. The vulnerabilities are variously 14-26 years old. Malicious input can escape groff's default "safer" mode, running commands embedded in that input at the user's privilege level. The groff development team recommends this release to any users who employ the named tools or GNU troff output formats with untrusted inputs. Man page rendering is not vulnerable unless rendering (X)HTML." ----- End forwarded message -----
