CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

devel/capstone4 4.0.2_1

Multi-platform, multi-architecture disassembly framework

7
unaddressed
0
VuXML only
0
fixed
0
open problem reports

Port info

Maintainer
oleksii.tsai@gmail.com
Packages
latest: 4.0.2_1
Upstream
up to date
Last update
to 4.0.2_1 · 5cc34cf266
Quarterly
2026Q4: 4.0.2_1
WWW
http://capstone-engine.org/
Links
cgit · VuXML

Install

Package
# pkg install capstone4
installs 4.0.2_1 from latest; from quarterly (2026Q4) 4.0.2_1
Port
# cd /usr/ports/devel/capstone4 && make install clean
Size
1.5 MiB download · 19 MiB installed
Depends on
nothing
License
BSD3CLAUSE

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 164.0.2_14.0.2_1–
FreeBSD 154.0.2_14.0.2_1–
FreeBSD 144.0.2_14.0.2_14.0.2_1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 154.0.2_14.0.2_1–
FreeBSD 144.0.2_14.0.2_14.0.2_1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (7)

The CVE record lists the packaged version 4.0.2_1 as affected, and no VuXML entry names the CVE. What does this mean?

No fix in the 4.x branch: all 7 unaddressed CVEs are fixed in 6.0.0 (new major version).
Fixed up to each version, cumulative: 5.0.8 1 · 6.0.0.Alpha9 3 · 6.0.0.Alpha10 5 · 6.0.0 7
CVECVSSPublishedDescription
CVE-2026-558937.32026-08-20Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c SH floating-point decoders such as opFADD, opFMUL, and opFSUB call …
CVE-2026-558946.82026-08-20Capstone is a disassembly framework. In 6.0.0-Alpha9 and earlier, Capstone's arch/SH/SHDisassembler.c sh_disassemble() function computes an idx value from a raw 16-bit i…
CVE-2026-492825.12026-08-14Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selec…
CVE-2026-471435.12026-07-21Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNo…
CVE-2025-681144.82025-12-17Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf drive SStr…
CVE-2025-678734.82025-12-17Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make cs_disasm/c…
CVE-2026-492632.02026-08-14Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the pub…

VuXML only (0)

Listed in VuXML, the packaged version 4.0.2_1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (12)

Muhammad Moinur Rahman (bofh) · 4.0.2_1
devel/capstone: Fix runtime permissions

bin/cstool is installed with 0644 perissions instead of 0755 which gives
permission denied error. This patch fixes this.

PR:		273570
Approved by:	maintainer-timeout
5cc34cf266
Stefan Eßer (se) · 4.0.2
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 4.0.2
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Stefan Eßer (se) · 4.0.2
Fix CONFLICTS entries of multiple ports

There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.

This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.

Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
cannot conflict with itself (due to logic in bsd.port.mk that
supresses the pattern match result in that case).

A few ports that set the conflicts variables depending on complex
conditions (e.g. port options), have been left unmodified, despite
probably containing outdated package names.

These changes should only affect the installation of locally built
ports, not the package building with poudriere. They should give an
early indication of the install conflict in cases where currently
the pkg command aborts an installation when it detects that an
existing file would be overwritten,

Approved by:	portmgr (implicit)
bcaf25a8c8
Stefan Eßer (se) · 4.0.2
devel/capstone4: Add CPE information

Approved by:	portmgr (blanket)
d44f40291e
Li-Wen Hsu (lwhsu) · 4.0.2
devel/capstone4: Update to 4.0.2

PR:		250431
Approved by:	maintainer timeout
5fc8541556
Mathieu Arnold (mat) · 4.0.1
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 4.0.1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Mateusz Piotrowski (0mp) · 4.0.1
devel/capstone: Update to 4.0.1

Changelog:
https://github.com/aquynh/capstone/releases/tag/4.0.1

- Remove GH_TAGNAME: PORTVERSION is enough
- Get the patch for a staging bug from GitHub
- Disable broken fuzzing tests

PR:		244220
Approved by:	oleksii.tsai@gmail.com (maintainer timeout)
Differential Revision:	https://reviews.freebsd.org/D23749
98af2f2376
Antoine Brodin (antoine) · 4.0_1
Clean up unneeded patching
66437aa4bf
Kurt Jaeger (pi) · 4.0_1
devel/capstone4: fix pkg-plist, bring to latest github commit devel/radare2: 0.10.0 -> 0.10.4

PR:		206942
Changes:	http://radare.today/posts/radare-0-10-1/,
		http://radare.today/posts/radare-0-10-2/
Submitted by:	oleksii.tsai@gmail.com
Approved by:	torres.73a@gmail.com (maintainer timeout)
87e02ac0c4
Kurt Jaeger (pi) · 4.0
devel/capstone: move to capstone3, introduce capstone4

- update py-capstone to use capstone3

PR:		206941
Submitted by:	oleksii.tsai@gmail.com
Approved by:	oliver.pntr@gmail.com (maintainer timeout)
f54fee3c6c