CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

archivers/gtar1.35_1

GNU version of the traditional tape archiver

Maintainer
naddy@FreeBSD.org
Packages
gtar 1.35_1
Upstream
up to date
CPE
gnu:tar from the port
WWW
https://www.gnu.org/software/tar/
Links
cgit · VuXML

Unaddressed (2) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-184774.4published 2026-08-03

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or ov…

CVE-2026-185084.4published 2026-08-03

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the w…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (5)

VuXML entries whose affected range this version has left.

Commits (127)

Christian Weisgerber (naddy) · 1.35_1
*/*: Remove GNU_CONFIGURE_MANPREFIX

After 9fd7ee1cdf6c remove GNU_CONFIGURE_MANPREFIX from my ports.
5d55ec5b18
Gleb Popov (arrowd) · 1.35_1
*/*: Move manpages to share/man

Approved by:	portmgr (blanket)
533d7de9eb
Christian Weisgerber (naddy) · 1.35
archivers/gtar: fix build on i386

Override a hidden safety check that stops the build on platforms
that are not Y2038 safe.  FreeBSD/i386 still has a 32-bit time_t.

PR:		272622
Reported by:	cy
6aae9fcd85
Christian Weisgerber (naddy) · 1.35
archivers/gtar: update to bugfix release 1.35
62d33c7a1b
Christian Weisgerber (naddy) · 1.34_1
archivers/gtar: switch the default archive to stdin/stdout

The gtar port tries to use the same default archive location as the
base system tar.  Starting with libarchive 3.6.0, bsdtar defaults
to reading/writing the archive from stdin/to stdout in the common
case where the /dev/sa0 device does not exist on a system.

Using "-" as the default archive file is also the GNU upstream
default.

PR:		271260
Reported by:	Michael Stone <mstone2001@msn.com>
5ea94b852f
Stefan Eßer (se) · 1.34
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.34
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Tobias C. Berner (tcberner) · 1.34
archivers: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Akinori MUSHA aka knu <knu@idaemons.org>
  *  Albert Vernon <f3cun3c02@sneakemail.com>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Samorukov <samm@freebsd.org>
  *  Alexander Kuehn <freebsd@nagilum.org>
  *  Alexander Logvinov <ports@logvinov.com>
  *  Alexander Zhuravlev <zaa@zaa.pp.ru>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Alexey Dokuchaev <danfe@regency.nsu.ru>
  *  Anders Nordby <anders@FreeBSD.org>
  *  Andreas Klemm <andreas@klemm.gtn.com>
  *  Andreev Maxim
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrey Chernov <ache@FreeBSD.org>
  *  Andrey Kostenko <andrey@kostenko.name>
  *  Anes Mukhametov <anes@anes.su>
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Ayumi M <ayu@commun.jp>
  *  Carsten Larsen <cs@innolan.dk>
  *  Chin-San Huang <chinsan.tw@gmail.com>
  *  Chris D. Faulhaber <jedgar@FreeBSD.org>
  *  Chris Larsen <darth@vader.dk>
  *  Christopher Key <cjk32@cam.ac.uk>
  *  Cyrille Lefevre <cyrille.lefevre@laposte.net>
  *  Dmitry Sivachenko <demon@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Felix Palmen <felix@palmen-it.de>
  *  Gabor Kovesdan <gabor@FreeBSD.org>
  *  Gea-Suan Lin (gslin@ccca.nctu.edu.tw)
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Greg Lewis <glewis@FreeBSD.org>
  *  Hsin-Han You <hhyou@cs.nctu.edu.tw>
  *  Hye-Shik Chang
  *  Hye-Shik Chang <perky@FreeBSD.org>
  *  Igor Pokrovsky <tiamat@telegraph.spb.ru>
  *  Jaap Boender <jaapb@kerguelen.org>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Jeff Burchell <toxic@doobie.com>
  *  Jeffrey H. Johnson <CPE1704TKS@bellsouth.net>
  *  Jerry Hicks
  *  Joao Carlos Mendes Luis <jonny@jonny.eng.br>
  *  John Marino <marino@FreeBSD.org>
  *  José García Juanino <jjuanino@gmail.com>
  *  Juergen Lock <nox@jelal.kn-bremen.de>
  *  Kevin Golding <ports@caomhin.org>
  *  Konstantin Reznichenko <kot@premierbank.dp.ua>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Kubilay Kocak <koobs@FreeBSD.org>
  *  Lars Thegler <lth@FreeBSD.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Mark Kane <mark@mkproductions.org>
  *  Mark Pulford <mark@kyne.com.au>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Matteo Cypriani <mcy@lm7.fr>
  *  Max Khon <fjoe@FreeBSD.org>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Melvyn Sopacua <melvyn@magemana.nl>
  *  Miguel Mendez <flynn@energyhq.homeip.net>
  *  Nathan Ahlstrom <nra@FreeBSD.org>
  *  Nicola Vitale <nivit@FreeBSD.org>
  *  Patrick Seal <patseal@hyperhost.net>
  *  Pav Lucistnik <pav@FreeBSD.org>
  *  Per Wigren
  *  Philippe Casidy <pcasidy@casidy.com>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Poul-Henning Kamp <phk@FreeBSD.org>
  *  Radim Kolar
  *  Radim Kolar <hsn@filez.com>
  *  Radim Kolar <hsn@netmag.cz>
  *  Rainer Hurling <rhurlin@gwdg.de>
  *  Richard Gallamore <ultima@FreeBSD.org>
  *  Roman Shterenzon <roman@xpert.com>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sam Lawrance <boris@brooknet.com.au>
  *  Sergey A. Osokin <osa@FreeBSD.org>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Sir l33tname <sirl33tname@gmail.com>
  *  Stanislav Sedov <ssedov@mbsd.msk.ru>
  *  Stefan Esser <se@FreeBSD.org>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steven Kreuzer <skreuzer@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net>
  *  Sylvio Cesar <sylvio@FreeBSD.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas Abthorpe <thomas@goodking.ca>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Vanilla I. Shu <vanilla@FreeBSD.org>
  *  Wen Heping <wenheping@gmail.com>
  *  Will Andrews <andrews@technologist.com>
  *  Yarodin <yarodin@gmail.com>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  Yuri Victorovich <yuri@rawbw.com>
  *  ache
  *  adamw
  *  antoine@FreeBSD.org
  *  bf <bf2006a@yahoo.com>
  *  chinsan <chinsan.tw@gmail.com>
  *  giffunip@asme.org
  *  gurkan@phys.ethz.ch
  *  iblis <iblis.dif01@nctu.edu.tw>
  *  ijliao
  *  jmz
  *  kwm@FreeBSD.org
  *  lbartoletti <lbartoletti@FreeBSD.org>
  *  mm
  *  ports@c0decafe.net <ports@c0decafe.net>
  *  samm@freebsd.org
  *  swhetzel@gmail.com
  *  will

With hat:	portmgr
1ced9d288a
Mathieu Arnold (mat) · 1.34
Remove # $FreeBSD$ from Makefiles.
305f148f48
Christian Weisgerber (naddy) · 1.34
archivers/gtar: update to bugfix release 1.34
fec756427e
Rene Ladan (rene) · 1.33
Remove support for FreeBSD 12.1 from various ports.

FreeBSD 12.1 reached end-of-life today. Adjust the message
for the wine ports while here, since stable/13 has branched.

Submitted by:	rene
Reviewed by:	jbeich, mandree, mat, osa
Approved by:	portmgr (mat)
Differential Revision:	https://reviews.freebsd.org/D28406
a7d2ae454e
Christian Weisgerber (naddy) · 1.33
archivers/gtar: update to 1.33

Noteworthy changes:
* POSIX extended format headers do not include PID by default
* --delay-directory-restore works for archives with reversed member ordering
* Fix extraction of a symbolic link hardlinked to another symbolic link
* Wildcards in exclude-vcs-ignore mode don't match slash
* Fix the --no-overwrite-dir option
* Fix handling of chained renames in incremental backups
* Link counting works for file names supplied with -T
* Accept only position-sensitive (file-selection) options in file list files
2f7d19d082
Christian Weisgerber (naddy) · 1.32
Update to 1.32 for some bug and testsuite fixes.
b6a4dec374
Christian Weisgerber (naddy) · 1.31
Update to 1.31.  Noteworthy changes: * Support for zstd compression (if zstd is installed). * The -K option interacts properly with member names given on the command line. * Fix handling of file shrinkage during read access when --sparse is used.
bf9d0f3e39
Baptiste Daroussin (bapt) · 1.30_1
Install texinfo files (GNU info) into ${PREFIX}/share/info

After a discussion on the mailing list on moving manpages to
${PREFIX}/share/man for consistency with base where it is
installed in usr/share/man, it appeared the same should happen
to GNU info files which were installed under share in base and
not in ports.

Now texinfo is not in base on any of the supported version of FreeBSD
it is possible to proceed to this move and it is easier to do than
the manpage change.

Other benefit than consistency are less patching: all build tools but
cmake are expecting info files to be under share/info and cmake (patched here)
was having an exception for BSD so the patch makes FreeBSD case less
specific for them

Bump revision of all impacted ports

PR:		232907
exp-run by:	antoine
Differential Revision:	https://reviews.freebsd.org/D17816
7990f81066
Christian Weisgerber (naddy) · 1.30
Update to 1.30.  Noteworthy changes: * Member names containing '..' components are now skipped when extracting. * Report erroneous use of position-sensitive options. * --numeric-owner now affects private headers too. * Fixed the --delay-directory-restore option * The --warnings=failed-read option * The --warnings=none option now suppresses all warnings * Fix reporting of hardlink mismatches during
6782202db5
Dmitry Marakasov (amdmi3) · 1.29
Most commonly used build systems support silent builds, when they hide actual commands executed and only show short summary line (like "CC foo.c"). CMake and ninja enable this by default, some autotools using ports do as well. This is unacceptable because we need complete build logs at any time, so we now switch to verbose build logs unconditionally. Note that this change deliberately affects ALL 

Change summary:

- Always do verbose builds for cmake, ninja and GNU configure (the
  latter includes check if --disable-silent-rules is actually supported
  by the configure script; there are isolated cases when it's not true)
- Remove CMAKE_VERBOSE, NINJA_VERBOSE and
  CONFIGURE_ARGS=--disable-silent-rules from all ports which set them
  for this is no longer needed
- Revert hacks for --disable-silent-rules support priorly committed
  to biology/ncbi-blast+ and net-p2p/mldonkey - no longer needed as well

Submitted by:	amdmi3
Reviewed by:	mat
Exp-run by:	antoine
Approved by:	portmgr (mat, antoine)
Differential Revision:	D7534
30a00f2227
Dmitry Marakasov (amdmi3) · 1.29
- Fix license - Switch to USES=localbase - Switch to ${TOUCH}

PR:		210637
Approved by:	naddy@FreeBSD.org (maintainer)
168bf1844b
Christian Weisgerber (naddy) · 1.29
Work around a bug in FreeBSD 9 make(1). http://docs.freebsd.org/cgi/mid.cgi?slrnmvro62.94q.naddy

PR:		210100
Reported by:	vas@mpeks.tomsk.su
ad198c077a
Christian Weisgerber (naddy) · 1.29
Do not attempt to rebuild tar.info after patching configure. I can't reproduce this on 10.3, but have a report from 9.3. Differences in make(1)?

Reported by:	Rob Levandowski <robl@macwhiz.com>
f71ba0c502
Christian Weisgerber (naddy) · 1.29
Update to 1.29.  User-visible changes: * New options: --verbatim-files-from, --no-verbatim-files-from * --null option reads file names verbatim * New options: --owner-map=FILE and --group-map=FILE * New option --clamp-mtime * Deprecated --preserve option removed
dca513e402
Christian Weisgerber (naddy) · 1.28_2
Use the new test framework in my ports, if applicable. While here, also strip more libraries.
0b0cf9fc3e
Dmitry Marakasov (amdmi3) · 1.28_2
- Switch to options helpers

Approved by:	portmgr blanket
4a43f16221
Mathieu Arnold (mat) · 1.28_2
Remove $FreeBSD$ from patches files in categories a-j.

With hat:	portmgr
Sponsored by:	Absolight
8dab11a002
Christian Weisgerber (naddy) · 1.28_2
Add CPE information.
2f5d45a25d
Tijl Coosemans (tijl) · 1.28_1
Split devel/gettext in devel/gettext-runtime and devel/gettext-tools.  The first contains runtime libraries such as libintl and the latter contains developer tools such as msgfmt.  Ports that use gettext will usually need a LIB_DEPENDS on gettext-runtime and a BUILD_DEPENDS on gettext-tools.

USES=gettext-runtime can be used to set a LIB/BUILD/RUN_DEPENDS on
devel/gettext-runtime and USES=gettext-tools can be used to set a
BUILD/RUN_DEPENDS on devel/gettext-tools.  USES=gettext is now the same
as "USES=gettext-runtime gettext-tools" meaning a LIB_DEPENDS on
devel/gettext-runtime and a BUILD_DEPENDS on devel/gettext-tools.

Update gettext to 0.19.3.

Remove :oldver from converters/libiconv and devel/gettext-runtime.  Leave
symlinks with the old library versions to avoid the need to bump
PORTREVISION on a large number of dependent ports.  When most of the
dependent ports have had normal version updates, PORTREVISION can be
bumped on the remaining ones (low number) and the links can be removed.

Fix some ports that installed files in lib/locale instead of share/locale.

PR:		194038
Reviewed by:	bapt
Exp-run:	antoine
Approved by:	portmgr (antoine)
edb7229dd4
Baptiste Daroussin (bapt) · 1.28
Clean up plist
161b92dff7
Christian Weisgerber (naddy) · 1.28
Update to 1.28.  Noteworthy changes in this release: * New checkpoint action: totals * Extended checkpoint format specification. * New option --one-top-level * New option --sort * New exclusion options * Manpages
bf55779e24
Baptiste Daroussin (bapt) · 1.27.1
Allow to build with texinfo from ports
aa57dea8a7
Baptiste Daroussin (bapt) · 1.27.1
Add USES=charsetfix
c85a36b065
Christian Weisgerber (naddy) · 1.27.1
Update to 1.27.1.  Bug fixes: * Fix unquoting of file names obtained via the -T option. * Fix GNU long link header timestamp (backward compatibility). * Fix extracting sparse members from star archives.

PR:		189675
Submitted by:	Jason Harris <jharris@widomaker.com>
c51f3f1605
Christian Weisgerber (naddy) · 1.27
USE_BZIP2 -> USES+=tar:bzip2 USE_XZ    -> USES+=tar:xz
62ef31db61
Baptiste Daroussin (bapt) · 1.27
Fix properties on pkg-plist
75d1dff36d
Christian Weisgerber (naddy) · 1.27
Use MAKE_CMD to run regression tests.
487b0e5355
Christian Weisgerber (naddy) · 1.27
* Regenerate patch to fix harmless but confusing warning. * Add license information.

PR:		183987
Submitted by:	Rodrigo Osorio <rodrigo@bebik.net>
3c0c4937c8
Christian Weisgerber (naddy) · 1.27
Update to 1.27.

Fix dependencies for STATIC option.
3626747843
Christian Weisgerber (naddy) · 1.26
Convert to stage and option helpers. Fix combination of NLS and STATIC options.
9ef88fa4a0
Baptiste Daroussin (bapt) · 1.26
Add NO_STAGE all over the place in preparation for the staging support (cat: archivers)
b80ec3e204
Christian Weisgerber (naddy) · 1.26
Simplify by dropping workarounds for unsupported FreeBSD versions.
d4984511f5
Christian Weisgerber (naddy) · 1.26
For all my ports * remove MAKE_JOBS_SAFE (default now) * change USE_GMAKE=yes to USES=gmake
9c7a77ab1e
Marcus von Appen (mva) · 1.26
- Convert USE_ICONV=yes to USES=iconv - Change USE_GNOME=pkgconfig|gnomehack to USES=pathfix|pkgconfig while here

Reviewed by:	bapt, kwm
821843ca06
Alex Kozlov (ak) · 1.26
- Convert USE_GETTEXT to USES (part 3)

Approved by:	portmgr (bapt)
e159824929
Christian Weisgerber (naddy) · 1.26
Convert to OptionsNG and trim Makefile headers.
6f90146232
Dmitry Marakasov (amdmi3) · 1.26
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:		157936
Submitted by:	myself
Exp-runs by:	pav
Approved by:	pav
6f6fbe4bdf
Christian Weisgerber (naddy) · 1.26
Update to bugfix release 1.26.
b6557b7e1d
Christian Weisgerber (naddy) · 1.25_1
Allow building as root.

PR:		155553
9eb21dc2e7
Christian Weisgerber (naddy) · 1.25_1
Fix bug with --one-file-system and --listed-incremental. This is important for at least misc/amanda-client.

Submitted by:	John Hein <jhein@symmetricom.com>
Obtained from:	upstream
2132f91195
Christian Weisgerber (naddy) · 1.25
Update to 1.25, which mostly brings miscellaneous bug fixes.
1cb39c944d
Ade Lovett (ade) · 1.23_3
Punt autoconf267->autoconf268
6abd00a86b
Ade Lovett (ade) · 1.23_3
Autotools update.   Read ports/UPDATING 20100915 for details.

Approved by:	portmgr (for Mk/bsd.port.mk part)
Tested by:	Multiple -exp runs
8262a7b51d