CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

devel/bison 3.8.2_2,1

Parser generator from FSF, (mostly) compatible with Yacc

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 3.8.2_2,1
Upstream
up to date
Last update
to 3.8.2_2,1 · c7c4c9e954
Quarterly
2026Q4: 3.8.2_2,1
Formerly
devel/bison2 until 2007-10-17, devel/bison-devel until 2005-11-18
WWW
https://www.gnu.org/software/bison/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install bison
installs 3.8.2_2,1 from latest; from quarterly (2026Q4) 3.8.2_2,1
Port
# cd /usr/ports/devel/bison && make install clean
# make -C /usr/ports/devel/bison config  # change options first
Size
729 KiB download · 3.1 MiB installed
Depends on
devel/gettext-runtime 1.0_1, devel/libtextstyle 1.0, devel/m4 1.4.21,1, print/indexinfo 0.3.1_1
License
GPLv3+
Options
3 of 3 on in the package: DOCS EXAMPLES NLS

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 163.8.2_2,13.8.2_2,1–
FreeBSD 153.8.2_2,13.8.2_2,1–
FreeBSD 143.8.2_2,13.8.2_2,13.8.2_2,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 153.8.2_2,13.8.2_2,1–
FreeBSD 143.8.2_2,13.8.2_2,13.8.2_2,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 3.8.2_2,1 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-563896.82026-07-29GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar fi…
CVE-2026-563904.62026-07-29GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restric…

VuXML only (0)

Listed in VuXML, the packaged version 3.8.2_2,1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (166)

Kris Kennaway (kris) · 1.75_2
Clean up locale directory after ourselves
3ec6c50c18
Yen-Ming Lee (leeym) · 1.875_3 · as devel/bison-devel
- relocate CONFLICTS - add WITHOUT_NLS for USE_GETTEXT - utilize INFO - replace LOCALBASE with PREFIX

PR:		72646
Submitted by:	leeym
Approved by:	maintainer timeout
56e042e18e
Yen-Ming Lee (leeym) · 1.75_2
- add version in CONFLICTS, otherwise it will conflict with itself.

Pointy hat to:	leeym
52d411f714
Yen-Ming Lee (leeym) · 1.75_2
- use shell meta-characters for pattern matching
515450b4d5
Kirill Ponomarev (krion) · 1.75_2
- Support INFO - Support DATADIR

PR:		ports/64853
Submitted by:	Ports Fury
6d5018c2da
Joe Marcus Clarke (marcus) · 1.75_2
Switch to USE_GETTEXT.

PR:		62351
Submitted by:	TAKAHASHI Kaoru <kaoru@kaisei.org>
200b97ea0d
Joe Marcus Clarke (marcus) · 1.75_2
Add USE_GETTEXT and bump PORTREVISION.

Submitted by:	trevor
Tested by:	bento
186b8ba82f
Trevor Johnson (trevor) · 1.75_1
SIZEify.
0c881ba59c
Trevor Johnson (trevor) · 1.75_1
Now gettext 0.12.1 is gettext-old.
78da40aa98
Sean Chittenden (seanc) · 1.875_2 · as devel/bison-devel
When installing bison, create a symlink from bin/bison to bin/bison1875 that way ports that require bison1875 (ie: PostgreSQL 7.4+) can properly detect this dependency.  Given both bison's have the appropriate CONFLICTS sections, this should be a big enough hint to users to move from bison < 1.875 to something more recent.  Bump port revision.

Pointy hat to:	bison(1) authors for grammar incompatibilities
321ff106fa
Sean Chittenden (seanc) · 1.75_1
Add CONFLICTS for bison/bison1875.

PR:		ports/56242
Submitted by:	Thierry Thomas <thierry@pompo.net>
40594a5fca
Joe Marcus Clarke (marcus) · 1.75_1
Bump the PORTREVISION for the ports directly affected by the gettext upgrade.

Prodded by:	kris
a3108b1e51
Joe Marcus Clarke (marcus) · 1.75
Chase the libintl.so shared lib version.
adccc29aad
Daichi GOTO (daichi) · 1.75
update devel/bison: add WITHOUT_NLS support   The patch allows bison to be compiled without gettext support,   for use when space is tight or the gettext dependency is not desired.

PR:		48824
Submitted by:	Matthias Andree <matthias.andree@web.de>
f84ed2e942
Sean Chittenden (seanc) · 1.875 · as devel/bison-devel
Add bison 1.875.  Some grammars require the new version of Bison (such as PostgreSQL), however the new bison also breaks many many ports.  Compromise with a new port.  Installs as bison and _not_ bison1875 and should be mutually exclusive to the main bison port.  Hopefully the bison authors will clean up their product and this port can disappear when the base bison port is updated in the future or

Repo copied by: fjoe
Approved by:	kris
ea4177f061
Akinori MUSHA (knu) · 1.75
De-pkg-comment.
7cc1393a93
Joe Marcus Clarke (marcus) · 1.75
Add a RUN_DEPENDS on gm4 to prevent bison from failing with many ports.

Approved by:	kris
Discussed on	ports
3e66ddb46c
Mario Sergio Fujikawa Ferreira (lioux) · 1.75
o Rollback PORTCOMMENT modifications while this feature's implementation   is better studied o Turn PORTCOMMENT variable in Makefile back into pkg-comment files

Approved by:	kris (portmgr hat),
		portmgr, re (silence)
f0a1969d34
Adam Weinberger (adamw) · 1.75
Use PORTCOMMENT in the Makefile, and whack the pkg-comment.

Approved by:	pat
d9611f9375
Cy Schubert (cy) · 1.75
Remove empty patch file.
9009f8a7f0
Will Andrews (will) · 1.75
Add dependency on GNU m4 for the build.  Found by portbuild.
f04923a4fb
David W. Chapman Jr. (dwcjr) · 1.75
Update to 1.75

PR:		44223
Submitted by:	tkato@prontomail.com
a1d2d400a1
Maxim Sobolev (sobomax) · 1.35_1
Due to popular demant into each port which might be inserted into dependency list by bsd.port.mk insert anti foot-shooting device, which prevents infinite fork loop when the user defines corresponding USE_XXX in global make.conf, command line or environment.

Similar devices should probably be inserted into ports that might be inserted
into dependency list by others bsd.foo.mk files (bsd.ruby.mk, bsd.python.mk
and so on.)
4fe6852b8f
Maxim Sobolev (sobomax) · 1.35_1
Don't install own copy of charset.alias - use one from libiconv instead. Bump PORTREVISION.
2e564be1e5
Dmitry Sivachenko (demon) · 1.35
Upgrade to 1.35.
38ae311f31
Dmitry Sivachenko (demon) · 1.34_2
USE_BZIP2
b4127c7ae1
Andrey A. Chernov (ache) · 1.34_2
Remove iconv->giconv hack
860ecc8e74
Akinori MUSHA (knu) · 1.34_1
Bump PORTREVISION to reflect the (lib)iconv upgrade.
21d944be5c
Maxim Sobolev (sobomax) · 1.34
Iconv cleanup, stage 1b: correct {BUILD,LIB,RUN}_DEPENDS of all ports that need libiconv.
8493a5819b
Dmitry Sivachenko (demon) · 1.34
Upgrade to 1.34.
461c92ba02
Christian Weisgerber (naddy) · 1.33_1
Limit s/iconv/giconv/ to the actually used files in order to avoid triggering an auto* build cascade.
3f324864be
Akinori MUSHA (knu) · 1.33_1
Bump PORTREVISION for the last fix.
0919c56469
Christian Weisgerber (naddy) · 1.33
This requires ngettext().

XXX Explicitly build with included libintl for now.

PR:		35653
4a69d46a9b
David E. O'Brien (obrien) · 1.33
Embellish the package list.
3ff4594f4d
David E. O'Brien (obrien) · 1.33
Update to version 1.33.
d69e3e3c8d
David E. O'Brien (obrien) · 1.33
Update to version 1.33.

This version was tested locally by a few trusted committers & friends,
and is believed to *actually* be as usable and stable as version 1.28.
(unlike *cough*, *cough* other 1.3x versions which have caused no end
of problems...)
a3454389d0
David E. O'Brien (obrien) · 1.30
This PORTEPOCH for life crap is stupid. Back out the downgrade, I would have never agreed to it if I had know... This leaves a window of downgradededness 18 hours -- people can just live with that.
fd710dff4a
Maxim Sobolev (sobomax) · 1.28,1
Bump PORTEPOCH because PORTVERSION was recently lowered.
26c34f89d7
David E. O'Brien (obrien) · 1.28
Back this down to version 1.28 until the Bison developers can acutally do some regression tests on their later releases. Versions 1.29 and 1.30 seg fault where 1.28 did not.
85da093438
Maxim Sobolev (sobomax) · 1.30
Override CONFIGURE_TARGET - this package generated with autoconf-2.52 needs a different semantics than our bsd.port.mk provides.
4b82659c78
David E. O'Brien (obrien) · 1.30
Upgrade to Bison 1.30. Version 1.29 had several problems that I believe 1.30 fixes (looking at the ChangeLog).
7b859cdd96
FUJISHIMA Satsuki (sf) · 1.29
unify info files (no revision bump needed).
0ff2207253
David E. O'Brien (obrien) · 1.29
Update to 1.29

* Added `-g' and `--graph'.
* Added `--locations' and `%locations'.
* Added `-S' and `--skeleton'.
* `%raw', `-r', `--raw' is disabled.
* Special characters are escaped when output.  This solves the problems
* New directives.
  `%yacc', `%fixed_output_files', `%defines', `%no_parser', `%verbose',
  `%debug', `%source_extension' and `%header_extension'.
* The input and the output files has automatically a similar extension.

Submitted by:	demon
74894ed54d
Dmitry Sivachenko (demon) · 1.28
Remove obsoleted entries.
563adca862
Dmitry Sivachenko (demon) · 1.28
Update for bison-1.28
92a470dfb1
Dmitry Sivachenko (demon) · 1.28
Add Russian messages.

Approved by:	obrien
5fe77d7bd4
Maxim Sobolev (sobomax) · 1.28
Explicitly add -lintl into LDFLAGS, because stupid configure script doesn't bother to do it.
0218f08c56
Maxim Sobolev (sobomax) · 1.28
Use installed libintl instead of the port's own version.
e43635a554