CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

devel/bison 3.8.2_2,1

Parser generator from FSF, (mostly) compatible with Yacc

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 3.8.2_2,1
Upstream
up to date
Last update
to 3.8.2_2,1 · c7c4c9e954
Quarterly
2026Q4: 3.8.2_2,1
Formerly
devel/bison2 until 2007-10-17, devel/bison-devel until 2005-11-18
WWW
https://www.gnu.org/software/bison/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install bison
installs 3.8.2_2,1 from latest; from quarterly (2026Q4) 3.8.2_2,1
Port
# cd /usr/ports/devel/bison && make install clean
# make -C /usr/ports/devel/bison config  # change options first
Size
729 KiB download · 3.1 MiB installed
Depends on
devel/gettext-runtime 1.0_1, devel/libtextstyle 1.0, devel/m4 1.4.21,1, print/indexinfo 0.3.1_1
License
GPLv3+
Options
3 of 3 on in the package: DOCS EXAMPLES NLS

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 163.8.2_2,13.8.2_2,1–
FreeBSD 153.8.2_2,13.8.2_2,1–
FreeBSD 143.8.2_2,13.8.2_2,13.8.2_2,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 153.8.2_2,13.8.2_2,1–
FreeBSD 143.8.2_2,13.8.2_2,13.8.2_2,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 3.8.2_2,1 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-563896.82026-07-29GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar fi…
CVE-2026-563904.62026-07-29GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restric…

VuXML only (0)

Listed in VuXML, the packaged version 3.8.2_2,1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (166)

Satoshi Asami (asami) · 1.28
Remove empty directories.

Submitted by:	bento
2ee765ba9f
Michael Haro (mharo) · 1.28
PORTNAME/PORTVERSION update
ed33fb7de0
David E. O'Brien (obrien)
Restore useless version required comments.
e05c25a8bf
David E. O'Brien (obrien)
Remove the "version required" line.
da36feaffe
David E. O'Brien (obrien)
Style nits in the ports I maintain.
b5d1cecde4
Michael Haro (mharo)
add install-info (portlint)
093664a1b5
Satoshi Asami (asami)
Comment out second MAINTAINER line.
1117c1feb8
David E. O'Brien (obrien)
Add the Bison 1.25 bug-for-bug "broken-undeftoken-init" compatiblity option taken from src/contrib/bison, as we will need this if one is buiding our older EGCS source base.
78b76c5699
David E. O'Brien (obrien)
With Bison being shown the door in 4.0-CURRENT, we need the Bison port back.
177ea6b5ae
David E. O'Brien (obrien)
The latest Bison is now in the base system (and has been for a while). This port is no longer needed.
041e34d028
David E. O'Brien (obrien)
Change Id->FreeBSD.
9a9ac6ba9d
Chris Piazza (cpiazza)
The last commit cited a bogus PR.  It was really:

PR:		12936
023a82287c
Chris Piazza (cpiazza)
Update to version 1.28

PR:		13054
Submitted by:	maintainer
fd939ffa41
Michael Haro (mharo)
Remove the test to create ${PREFIX}/share/info/dir as it is now in bsd.port.mk and this helps to unify the check and install.
5ce8e8e5c7
Tim Vanderhoek (hoek)
Add WWW: to some of the more recent imports...
eedf966f0a
Steve Price (steve)
Initial import of bison version 1.27. GNU's YACCalike parser generator.

PR:		10839
Submitted by:	Jerry Hicks <wghicks@bellsouth.net>
1cbce94c51