CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

archivers/gzip1.14

Compression utility designed to be a replacement for compress

Maintainer
nc@FreeBSD.org
Packages
gzip 1.14
Upstream
Higher version available: 1.15
CPE
gnu:gzip from the port
WWW
https://www.gnu.org/software/gzip/
Links
cgit · VuXML

Unaddressed (2) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-419926.9published 2026-06-29

GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in th…

CVE-2026-419912.0published 2026-06-29

GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can p…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (3)

VuXML entries whose affected range this version has left.

Commits (57)

Neel Chauhan (nc) · 1.14
archivers/gzip: Update to 1.14
1be8340d0f
Muhammad Moinur Rahman (bofh) · 1.13_1
archivers/gzip: Moved man to share/man

Approved by:    portmgr (blanket)
7ebe959422
Neel Chauhan (nc) · 1.13
archivers/gzip: Update to 1.13
cabd5daca6
Stefan Eßer (se) · 1.12
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.12
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Tobias C. Berner (tcberner) · 1.12
archivers: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Akinori MUSHA aka knu <knu@idaemons.org>
  *  Albert Vernon <f3cun3c02@sneakemail.com>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Samorukov <samm@freebsd.org>
  *  Alexander Kuehn <freebsd@nagilum.org>
  *  Alexander Logvinov <ports@logvinov.com>
  *  Alexander Zhuravlev <zaa@zaa.pp.ru>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Alexey Dokuchaev <danfe@regency.nsu.ru>
  *  Anders Nordby <anders@FreeBSD.org>
  *  Andreas Klemm <andreas@klemm.gtn.com>
  *  Andreev Maxim
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrey Chernov <ache@FreeBSD.org>
  *  Andrey Kostenko <andrey@kostenko.name>
  *  Anes Mukhametov <anes@anes.su>
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Ayumi M <ayu@commun.jp>
  *  Carsten Larsen <cs@innolan.dk>
  *  Chin-San Huang <chinsan.tw@gmail.com>
  *  Chris D. Faulhaber <jedgar@FreeBSD.org>
  *  Chris Larsen <darth@vader.dk>
  *  Christopher Key <cjk32@cam.ac.uk>
  *  Cyrille Lefevre <cyrille.lefevre@laposte.net>
  *  Dmitry Sivachenko <demon@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Felix Palmen <felix@palmen-it.de>
  *  Gabor Kovesdan <gabor@FreeBSD.org>
  *  Gea-Suan Lin (gslin@ccca.nctu.edu.tw)
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Greg Lewis <glewis@FreeBSD.org>
  *  Hsin-Han You <hhyou@cs.nctu.edu.tw>
  *  Hye-Shik Chang
  *  Hye-Shik Chang <perky@FreeBSD.org>
  *  Igor Pokrovsky <tiamat@telegraph.spb.ru>
  *  Jaap Boender <jaapb@kerguelen.org>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Jeff Burchell <toxic@doobie.com>
  *  Jeffrey H. Johnson <CPE1704TKS@bellsouth.net>
  *  Jerry Hicks
  *  Joao Carlos Mendes Luis <jonny@jonny.eng.br>
  *  John Marino <marino@FreeBSD.org>
  *  José García Juanino <jjuanino@gmail.com>
  *  Juergen Lock <nox@jelal.kn-bremen.de>
  *  Kevin Golding <ports@caomhin.org>
  *  Konstantin Reznichenko <kot@premierbank.dp.ua>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Kubilay Kocak <koobs@FreeBSD.org>
  *  Lars Thegler <lth@FreeBSD.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Mark Kane <mark@mkproductions.org>
  *  Mark Pulford <mark@kyne.com.au>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Matteo Cypriani <mcy@lm7.fr>
  *  Max Khon <fjoe@FreeBSD.org>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Melvyn Sopacua <melvyn@magemana.nl>
  *  Miguel Mendez <flynn@energyhq.homeip.net>
  *  Nathan Ahlstrom <nra@FreeBSD.org>
  *  Nicola Vitale <nivit@FreeBSD.org>
  *  Patrick Seal <patseal@hyperhost.net>
  *  Pav Lucistnik <pav@FreeBSD.org>
  *  Per Wigren
  *  Philippe Casidy <pcasidy@casidy.com>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Poul-Henning Kamp <phk@FreeBSD.org>
  *  Radim Kolar
  *  Radim Kolar <hsn@filez.com>
  *  Radim Kolar <hsn@netmag.cz>
  *  Rainer Hurling <rhurlin@gwdg.de>
  *  Richard Gallamore <ultima@FreeBSD.org>
  *  Roman Shterenzon <roman@xpert.com>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sam Lawrance <boris@brooknet.com.au>
  *  Sergey A. Osokin <osa@FreeBSD.org>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Sir l33tname <sirl33tname@gmail.com>
  *  Stanislav Sedov <ssedov@mbsd.msk.ru>
  *  Stefan Esser <se@FreeBSD.org>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steven Kreuzer <skreuzer@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net>
  *  Sylvio Cesar <sylvio@FreeBSD.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas Abthorpe <thomas@goodking.ca>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Vanilla I. Shu <vanilla@FreeBSD.org>
  *  Wen Heping <wenheping@gmail.com>
  *  Will Andrews <andrews@technologist.com>
  *  Yarodin <yarodin@gmail.com>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  Yuri Victorovich <yuri@rawbw.com>
  *  ache
  *  adamw
  *  antoine@FreeBSD.org
  *  bf <bf2006a@yahoo.com>
  *  chinsan <chinsan.tw@gmail.com>
  *  giffunip@asme.org
  *  gurkan@phys.ethz.ch
  *  iblis <iblis.dif01@nctu.edu.tw>
  *  ijliao
  *  jmz
  *  kwm@FreeBSD.org
  *  lbartoletti <lbartoletti@FreeBSD.org>
  *  mm
  *  ports@c0decafe.net <ports@c0decafe.net>
  *  samm@freebsd.org
  *  swhetzel@gmail.com
  *  will

With hat:	portmgr
1ced9d288a
Neel Chauhan (nc) · 1.12
archivers/gzip: Update to 1.12
016ca218d6
Stefan Eßer (se) · 1.11
Fix CONFLICTS entries in archivers, astro, audio

Fix conflicts entries based on a script that searches for duplicate
files installed by several ports.

Some patters seem to make ports conflict with themselves, but this is
actually not the case due to the check-*-conflicts logic implemented
in bsd.port.mk, which excludes self-conflicts.

PHP based ports have been ignored in this commit as requested by the
committers currently working on the php-8.1 import.

Approved by:	portmgr (implicit)
98f7d7db7e
Neel Chauhan (nc) · 1.11
archivers/gzip: Adopt port
1eb5fb4d9c
Neel Chauhan (nc) · 1.11
archivers/gzip: Update to 1.11
b24eca6505
Mathieu Arnold (mat) · 1.10
Remove # $FreeBSD$ from Makefiles.
305f148f48
Rene Ladan (rene) · 1.10
Returns johans's ports to the pool after safekeeping his commit bit.
2f557a4678
Alexey Dokuchaev (danfe) · 1.10
- Update `archivers/gzip' to version 1.10 - Switch to smaller .tar.xz distfile - Drop custom DOC_FILES variable in favor of PORTDOCS - Use option-helper target for installing docfiles
0c6f1a1b47
Baptiste Daroussin (bapt) · 1.9_1
Install texinfo files (GNU info) into ${PREFIX}/share/info

After a discussion on the mailing list on moving manpages to
${PREFIX}/share/man for consistency with base where it is
installed in usr/share/man, it appeared the same should happen
to GNU info files which were installed under share in base and
not in ports.

Now texinfo is not in base on any of the supported version of FreeBSD
it is possible to proceed to this move and it is easier to do than
the manpage change.

Other benefit than consistency are less patching: all build tools but
cmake are expecting info files to be under share/info and cmake (patched here)
was having an exception for BSD so the patch makes FreeBSD case less
specific for them

Bump revision of all impacted ports

PR:		232907
exp-run by:	antoine
Differential Revision:	https://reviews.freebsd.org/D17816
7990f81066
Yuri Victorovich (yuri) · 1.9
archivers/gzip: Update WWW in pkg-descr

PR:		225026
Submitted by:	i.bakirov@gmail.com
Approved by:	timeout expired, tcberner (mentor, implicit)
1fed7ffa70
Johan van Selst (johans) · 1.9
Upddate to GNU gzip 1.9 (bugfix release)
784d2a623e
Johan van Selst (johans) · 1.8
Update to gzip 1.8 (bugfix release) http://lists.gnu.org/archive/html/info-gnu/2016-04/msg00012.html
a454ddcb70
Johan van Selst (johans) · 1.7
Update to gzip 1.7 http://lists.gnu.org/archive/html/info-gnu/2016-03/msg00014.html Remove local patch for --rsyncable, which is now included upstream
17aefcd4a9
Johan van Selst (johans) · 1.6
adding CPE information to Makefile

archivers/gzip has had vulnerabilities with a CPE identifier assigned
(e.g. CVE-2009-2624). This patch adds CPE information as suggested in
the FreeBSD wiki

PR:		198641
Submitted by:	shun.fbsd.pr@dropcut.net
742dae6da0
Baptiste Daroussin (bapt) · 1.6
Clean up plist
161b92dff7
Adam Weinberger (adamw) · 1.6
Reduce unnecessary bsd.port.options.mk inclusions by using OPTIONS helpers.

For liborange, reverse the logic, as I'm pretty sure the OPTIONS were being
used to disable the selected options.

Approved by:	portmgr (blanket)
41fcfb64f9
Baptiste Daroussin (bapt) · 1.6
Allow to build with texinfo from ports
669c094ac0
Baptiste Daroussin (bapt) · 1.6
Fix properties on pkg-plist
75d1dff36d
Johan van Selst (johans) · 1.6
Enable stage support
66f7d235e1
Baptiste Daroussin (bapt) · 1.6
Add NO_STAGE all over the place in preparation for the staging support (cat: archivers)
b80ec3e204
Johan van Selst (johans) · 1.6
- Update GNU gzip to 1.6 - Remove patch for -k (finally included upstream) - Adopt port

Approved by:    gabor (old maintainer)
fd007a3a5b
Baptiste Daroussin (bapt) · 1.4_2
Fix leftovers by using USES=charsetfix Remove now useless pre-configure target While here convert NOPORTDOCS to DOCS option

Reported by:	pointyhat via miwi
Approved by:	portmgr (implicit)
bc7369ffcd
Gabor Kovesdan (gabor) · 1.4_2
- Turn on the RSYNCABLE option by default since it is required for a   dependent port [1] - Bump PORTREVISION

Requested by:	jgh [1]
943a056b1e
Alexey Dokuchaev (danfe) · 1.4_1
For a number of ports in archives category, trim the header and drop leading indefinite article from COMMENT line; also fix few noticed styles bugs while I am here.
142171e3f3
Eitan Adler (eadler) · 1.4_1
Convert to OptionsNG

Approved by:	gabor (maintainer)
8f8574a088
Martin Wilke (miwi) · 1.4_1
- Get Rid MD5 support

With hat:	portmgr (myself)
65e190c0f0
Gabor Kovesdan (gabor) · 1.4_1
- Add support for --rsyncable option - Bump PORTREVISION - Pet portlint(1)

PR:		ports/151721
Submitted by:	jpaetzel
3c9128b1de
Gabor Kovesdan (gabor) · 1.4
- Update to 1.4
589af33998
Rong-En Fan (rafan) · 1.3.12_1
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script. Specifically, newer autoconf (> 2.13) has different semantic of the configure target. In short, one should use --build=CONFIGURE_TARGET instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk
 - Remove CONFIGURE_TARGET hack in various bsd.*.mk
 - USE_GNOME=gnometarget is now an no-op

Changes to individual ports, other than removing the CONFIGURE_TARGET hack:

= pkg-plist changed (due to the ugly CONFIGURE_TARGET prefix in * executables)
  - comms/gnuradio
  - science/abinit
  - science/elmer-fem
  - science/elmer-matc
  - science/elmer-meshgen2d
  - science/elmerfront
  - science/elmerpost

= use x86_64 as ARCH
  - devel/g-wrap

= other changes
  - print/magicfilter
    GNU_CONFIGURE -> HAS_CONFIGURE since it's not generated by autoconf

Total # of ports modified:  1,027
Total # of ports affected: ~7,000 (set GNU_CONFIGURE to yes)

PR:		126524 (obsoletes 52917)
Submitted by:	rafan
Tested on:	two pointyhat 7-amd64 exp runs (by pav)
Approved by:	portmgr (pav)
741aa71483
Rong-En Fan (rafan) · 1.3.12_1
- Set --mandir and --infodir in CONFIGURE_ARGS if the configure script   supports them.  This is determined by running ``configure --help'' in   do-configure target and set the shell variable _LATE_CONFIGURE_ARGS   which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable   Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - 

PR:		ports/111470
Approved by:	portmgr
Discussed with:	stas (Mk/*), gerald (info related stuffs)
Tested by:	pointyhat exp run
f935a609c5
Gabor Kovesdan (gabor) · 1.3.12_1
- Add support for -k command line option as there is in bzip2(1) - Bump PORTREVISION

PR:		ports/113397
Submitted by:	Ighighi <ighighi@gmail.com>
e868096dc2
Gabor Kovesdan (gabor) · 1.3.12
- Update to 1.3.12 - Fix security issues [1]

Obtained from:	SA-06:21.gzip [1]
Security:	11a84092-8f9f-11db-ab33-000e0c2e438a,
		SA-06:21.gzip
1f7fbee7d8
Gabor Kovesdan (gabor) · 1.3.9
- Update to 1.3.9 - Change MASTER_SITES to MASTER_SITE_GNU - Add proper CONFIGURE_ARGS - Remove old patches - Possibly fix security issues (it will need more investigation, this version   is still marked as vulnerable in VuXML, I'll check later)

PR:		ports/108458
Submitted by:	Jason Harris <jharris@widomaker.com>
Approved by:	erwin (mentor)
686fe0d87e
Gabor Kovesdan (gabor) · 1.3.5_2
Change my e-mail address.

Approved by:	erwin (mentor)
7dc52a691f
Edwin Groothuis (edwin) · 1.3.5_2
Remove USE_REINPLACE from ports in categories starting with A.
179697185d
Emanuel Haupt (ehaupt) · 1.3.5_2
- Update SHA256 - Pass maintainership to submitter

PR:		89839
Submitted by:	Gabor Kovesdan <gkovesdan@t-hosting.hu>
Discussed with:	mnag
d96d3d449f
Mark Linimon (linimon) · 1.3.5_2
Reset maintainer per his request.  We hope to see him back soon.
7359600566
Florent Thoumie (flz) · 1.3.5_2
- Remove master site.

PR:		ports/87292
Submitted by:	Jean Milanez Melo <jmelo@freebsdbrasil.com.br>
Approved by:	maintainer
a606d5bc35
Simon L. B. Nielsen (simon) · 1.3.5_2
Fix directory traversal and permission race security vulnerabilities in gzip, and zgrep improper argument sanitation.

Security:	CAN-2005-0758, CAN-2005-0988, CAN-2005-1228
Security:	FreeBSD-SA-05:11.gzip
Obtained from:	RedHat, Steve Grubb via RedHat, Debian
Approved by:	maintainer timeout (4 days; security)
df948e0eb1
David E. O'Brien (obrien) · 1.3.5_1
At Kris's request, back out the MACHINE_ARCH spelling correction until after 5.4-RELEASE.
c3d8037aeb
David E. O'Brien (obrien) · 1.3.5_1
Assist getting more ports working on AMD64 by obeying the Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.
f2fc2d60ae
Pav Lucistnik (pav) · 1.3.5_1
- Add three more MASTER_SITES

Recovered from:	pending/67038
36480fd9fd
Pav Lucistnik (pav) · 1.3.5_1
- Remove dead MASTER_SITES

PR:		ports/67026
Submitted by:	Roman Neuhauser <neuhauser@chello.cz>
cb1f5c67f0
Kirill Ponomarev (krion) · 1.3.5_1
- Fix configure warning

PR:		65668 65669 65670 65671 65672 65673
Submitted by:	Roman Neuhauser <neuhauser at chello dot cz>
c83a0c91ce
Trevor Johnson (trevor) · 1.3.5_1
Add size data.

Approved by:	maintainers
4a38811bfa