CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

devel/cvsweb 2.0.6_2

WWW CGI script to browse CVS repository trees

Port info

Maintainer
noackjr@alumni.rice.edu
Packages
latest: 2.0.6_2
Upstream
up to date
Last update
to 2.0.6_2 · fb16dfecae
Quarterly
2026Q4: 2.0.6_2
WWW
https://www.FreeBSD.org/projects/cvsweb.html
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install cvsweb
installs 2.0.6_2 from latest; from quarterly (2026Q4) 2.0.6_2
Port
# cd /usr/ports/devel/cvsweb && make install clean
# make -C /usr/ports/devel/cvsweb config  # change options first
Size
49 KiB download · 151 KiB installed
Depends on
lang/perl5.42 5.42.3
Options
1 of 1 on in the package: DOCS
pkg-message
Shown after installing
Quickstart:
	cd /usr/local/etc/cvsweb
	cp cvsweb.conf.dist cvsweb.conf

and you can browse your CVS repository via web if you set up
your web server correctly.  The URL to get to the cvsweb
will be like `http://localhost/cgi-bin/cvsweb.cgi/'.

  To configure its appearance and repository entries to
browse, edit cvsweb.conf* as you like.

  For further information, please look into the directory
`/usr/local/share/doc/cvsweb'.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.0.6_22.0.6_2–
FreeBSD 152.0.6_22.0.6_2–
FreeBSD 142.0.6_22.0.6_22.0.6_2

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.0.6_22.0.6_2–
FreeBSD 142.0.6_22.0.6_22.0.6_2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 2.0.6_2 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2018-10009986.12019-02-04FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might …

VuXML only (0)

Listed in VuXML, the packaged version 2.0.6_2 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (107)

Peter Wemm (peter)
Change all www.freebsd.org/~user references to people.FreeBSD.org/~user, as the days of the former are numbered.

Reviewed by:	asami
02c5b6c7c6
Michael Haro (mharo)
FreeBSD.ORG -> FreeBSD.org

Prompted by PR:  13476, 13477
Submitted by:  KATO Tsuguru
65ab34a667
David E. O'Brien (obrien)
Change Id->FreeBSD.
9a9ac6ba9d
Andreas Klemm (andreas)
purely cosmetic... apache paths changed update port to install script to new location ${PREFIX}/share/apache/cgi-bin/
5d88362367
SADA Kenji (sada)
Misfiled a Makefile line.
5162aaf419
SADA Kenji (sada)
Move category from net to devel. Cope with package-build time problem.

Requested by: hoek
521370ce36
SADA Kenji (sada)
Move net/cvsweb's category to ports/devel.

Requested by:	hoek
07aba06f10