CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

devel/bison 3.8.2_2,1

Parser generator from FSF, (mostly) compatible with Yacc

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 3.8.2_2,1
Upstream
up to date
Last update
to 3.8.2_2,1 · c7c4c9e954
Quarterly
2026Q4: 3.8.2_2,1
Formerly
devel/bison2 until 2007-10-17, devel/bison-devel until 2005-11-18
WWW
https://www.gnu.org/software/bison/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install bison
installs 3.8.2_2,1 from latest; from quarterly (2026Q4) 3.8.2_2,1
Port
# cd /usr/ports/devel/bison && make install clean
# make -C /usr/ports/devel/bison config  # change options first
Size
729 KiB download · 3.1 MiB installed
Depends on
devel/gettext-runtime 1.0_1, devel/libtextstyle 1.0, devel/m4 1.4.21,1, print/indexinfo 0.3.1_1
License
GPLv3+
Options
3 of 3 on in the package: DOCS EXAMPLES NLS

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 163.8.2_2,13.8.2_2,1–
FreeBSD 153.8.2_2,13.8.2_2,1–
FreeBSD 143.8.2_2,13.8.2_2,13.8.2_2,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 153.8.2_2,13.8.2_2,1–
FreeBSD 143.8.2_2,13.8.2_2,13.8.2_2,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 3.8.2_2,1 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-563896.82026-07-29GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar fi…
CVE-2026-563904.62026-07-29GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restric…

VuXML only (0)

Listed in VuXML, the packaged version 3.8.2_2,1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (166)

Dmitry Marakasov (amdmi3) · 2.7.1,1
- Convert USE_XZ to USES

Approved by:	portmgr blanket
32e625e74f
Baptiste Daroussin (bapt) · 2.7.1,1
Support stage Use options helpers
a241cbcc33
Tijl Coosemans (tijl) · 2.7.1,1
Add EXAMPLES and NLS option.
05724638b0
Baptiste Daroussin (bapt) · 2.7.1,1
Add NO_STAGE all over the place in preparation for the staging support (cat: devel part 1)
857aec5d6b
Andrej Zverev (az) · 2.7.1,1
- convert to the new perl5 framework - convert USE_GMAKE to Uses

Approved by:	portmgr (bapt@, blanket)
4321effd49
Johan van Selst (johans) · 2.7.1,1
Explicitly list minimal version of GNU M4 to use (1.4.16); may avoid issues for people who haven't updated m4 in over 2 years
3fda560dd6
Johan van Selst (johans) · 2.7.1,1
Update bison to 2.7.1 (bugfix release) http://lists.gnu.org/archive/html/help-bison/2013-04/msg00013.html
87fe6dfeff
Baptiste Daroussin (bapt) · 2.7,1
Remove latest references to USE_BISON
dddd7142fb
Alex Kozlov (ak) · 2.7,1
- Convert USE_GETTEXT to USES (part 4)

Approved by:	portmgr (bapt)
83f02b963c
Baptiste Daroussin (bapt) · 2.7,1
Fix a long standing bug of lib/charset.alias being overwritten, modified, and badly tracked by ports.

Make lib/charset.alias a file only provided by converters/libiconv
Create a new USES: charsetfix, that will modify in post patch the Makefile.in to prevent a port from modifying/overwritting the charset.alias file during make install.
Prevent devel/gettext from installing that files.
Fix a couple of ports that actually touch charset.alias during the build phase.

Based on a patch by ale (http://lists.freebsd.org/pipermail/freebsd-gnome/2012-October/027747.html)

Approved by:	kwm (gnome)
Exp-run by:	miwi
e7b0f97788
Johan van Selst (johans) · 2.7,1
Update bison to 2.7 http://lists.gnu.org/archive/html/help-bison/2012-12/msg00008.html

PR:             ports/173606
Exp-run by:     miwi
b8743ec220
Johan van Selst (johans) · 2.5.1,1
- Check for EXAMPLES rather than DOCS options to determine examples installation - Fix plist in case examples are not installed

Submitted by:	flo
d9577c15b6
Johan van Selst (johans) · 2.5.1,1
Add distinfo and pkg-plist files for the bison update that got lost with the previous commit.

Reported by:	Herbert J. Skuhra <h.skuhra@gmail.com>
68a7dadaef
Johan van Selst (johans) · 2.5.1,1
- Update bison to 2.5.1    http://lists.gnu.org/archive/html/info-gnu/2012-06/msg00004.html    Thanks to pav for testing it on an exp-run

PR:		ports/169156
e80ea7dc58
Johan van Selst (johans) · 2.5,1
Convert to new options framework
06576dbdac
Johan van Selst (johans) · 2.5,1
Update bison to 2.5 release Thanks to miwi for testing it on an exp-run

PR:	ports/157769
7cdfadbd71
Martin Wilke (miwi) · 2.4.3,1
- Get rid FreeBSD 6.x support
9b44799b8a
Dmitry Marakasov (amdmi3) · 2.4.3,1
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead

PR:		157936
Submitted by:	myself
Exp-runs by:	pav
Approved by:	pav
6f6fbe4bdf
Olli Hauer (ohauer) · 2.4.3,1
-remove MD5
d6db46aade
Johan van Selst (johans) · 2.4.3,1
Update bison to 2.4.3

PR:		ports/144916
Tested by:	exp-run by pav
3a5fc0a813
Ade Lovett (ade) · 2.4.1_1,1
Bounce PORTREVISION for gettext-related ports.  Have fun, ya'll.
8d837132c7
Johan van Selst (johans) · 2.4.1,1
Update my mail address to @FreeBSD.org

Feature safe:	yes
532e84e129
Johan van Selst (johans) · 2.4.1,1
Don't update charset.alias if WITHOUT_NLS is set

Reported by:	pgollucci
de0dddb837
Johan van Selst (johans) · 2.4.1,1
- Update bison to 2.4.1, see announcements for important changes:   http://lists.gnu.org/archive/html/bug-bison/2008-11/msg00000.html   http://lists.gnu.org/archive/html/bug-bison/2008-12/msg00000.html - Take over bison maintainership - as approved by portmgr (marcus) - Add patches for ports to compile with new bison:   Replace %{ .. %} with %code { .. } where required   and accommodate stricter t

PR:		ports/131640
Approved by:	portmgr (pav)
ec2d095bd0
Rong-En Fan (rafan) · 2.3_4,1
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script. Specifically, newer autoconf (> 2.13) has different semantic of the configure target. In short, one should use --build=CONFIGURE_TARGET instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk
 - Remove CONFIGURE_TARGET hack in various bsd.*.mk
 - USE_GNOME=gnometarget is now an no-op

Changes to individual ports, other than removing the CONFIGURE_TARGET hack:

= pkg-plist changed (due to the ugly CONFIGURE_TARGET prefix in * executables)
  - comms/gnuradio
  - science/abinit
  - science/elmer-fem
  - science/elmer-matc
  - science/elmer-meshgen2d
  - science/elmerfront
  - science/elmerpost

= use x86_64 as ARCH
  - devel/g-wrap

= other changes
  - print/magicfilter
    GNU_CONFIGURE -> HAS_CONFIGURE since it's not generated by autoconf

Total # of ports modified:  1,027
Total # of ports affected: ~7,000 (set GNU_CONFIGURE to yes)

PR:		126524 (obsoletes 52917)
Submitted by:	rafan
Tested on:	two pointyhat 7-amd64 exp runs (by pav)
Approved by:	portmgr (pav)
741aa71483
Edwin Groothuis (edwin) · 2.3_4,1
Bump portrevision due to upgrade of devel/gettext.

The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).

PR:             ports/124340
Submitted by:   edwin@
Approved by:    portmgr (pav)
090059a210
Ade Lovett (ade) · 2.3_3,1
Restore PORTEPOCH.  My feelings on this particular knob are rated *at least* NC-17.

Submitted by:	many
9cb29fd0ff
Ade Lovett (ade) · 2.3_3
Migration from bison 1.x to 2.x

PR:		117086
Tested by:	-exp runs
dbd39ca660
Florent Thoumie (flz) · 2.3_1 · as devel/bison2
- Welcome X.org 7.2 \o/. - Set X11BASE to ${LOCALBASE} for recent ${OSVERSION}. - Bump PORTREVISION for ports intalling files in ${X11BASE}.
d4f0d0048a
Ade Lovett (ade) · 2.3 · as devel/bison2
Update to 2.3

PR:		101718
Submitted by:	Stanislav Sedov <ssedov@mbsd.msk.ru>
5c261d66af
Ade Lovett (ade) · 2.1_2 · as devel/bison2
Don't install the "helpful" yacc-esque version of bison2, it causes lots of fun and entertaining problems.

Submitted by:	nork
5671344c11
Ade Lovett (ade) · 2.1_1 · as devel/bison2
Don't (try to) remove share/aclocal - it's in the mtree now

Submitted by:	pointyhat
685dcade26
Edwin Groothuis (edwin) · 2.1_1 · as devel/bison2
eplace ugly "@unexec rmdir %D... 2>/dev/null || true" with @dirrmtry

Approved by:    krion@
PR:             ports/88711 (related)
d568611c3e
Edwin Groothuis (edwin) · 2.1_1 · as devel/bison2
Replace ugly "@unexec rmdir %D... 2>/dev/null || true" with @dirrmtry

Approved by:    krion@
PR:             ports/88711 (related)
e33233f948
Ade Lovett (ade) · 2.1_1 · as devel/bison2
Remove the 'rw' locale directory by hand until such time as the BSD.local.mtree file catches up with reality.

Submitted by:	pointyhat via kris
84fd75e1bc
Ade Lovett (ade) · as devel/bison-devel
Remove bison-devel now that the only consumer (openoffice-2.0) has be converted over to using the newly imported bison2

Many thanks to:	maho
30aef00929
Ade Lovett (ade) · 1.875d · as devel/bison-devel
Mark deprecated with a short lifespan.  The only consumers of this port are editors/openoffice.org-2.0{,-devel}
f86bf1a417
Ade Lovett (ade) · 1.75_2,1
Add SHA256
ef677b8e52
Ade Lovett (ade) · 1.75_2,1
A few more cleanups after recent events with bison

* lose the bison175 port, it's not needed for now and will
  only confuse matters
* clean up devel/Makefile, modules, and MOVED appropriately
* take maintainership of the bison* ports

Approved by:	portmgr
1c6166bcd9
Pav Lucistnik (pav) · 1.75_2,1
- Back out update to 2.0

Requested by:	ade
ec3881eb40
Pav Lucistnik (pav) · 2.0
- Update to 2.0

PR:		ports/84709
Submitted by:	Frerich Raabe <frerich@athame.co.uk>
471f5244fc
David E. O'Brien (obrien) · 1.75_2
At Kris's request, back out the MACHINE_ARCH spelling correction until after 5.4-RELEASE.
c3d8037aeb
David E. O'Brien (obrien) · 1.75_2
Assist getting more ports working on AMD64 by obeying the Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.
f2fc2d60ae
Kris Kennaway (kris) · 1.875d · as devel/bison-devel
Don't remove system locale directories.  Silently try to remove the remaining non-system directories in case they're still in use.
ed6ef4505b
Kris Kennaway (kris) · 1.75_2
Clean up handling of locale directories at deinstall-time:

* Don't remove "system directories" (which were created by BSD.*.dist)
* Silently try to remove locale directories which we might have created
be3e1f7794
Sergey Matveychuk (sem) · 1.875d · as devel/bison-devel
Alpha version of bison

PR:		ports/74189
Submitted by:	maho
af2523b261
Sean Chittenden (seanc) · 1.875_4 · as devel/bison-devel
Bison 1.875 was generating broken C++ code.  This patch will be submitted to GNU for inclusion in the main tree.

PR:		ports/74436
Submitted by:	Uranus  uranus - a t - it dot muds dot net
f2aadbe823