CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

devel/ghidra12.0.4

Software reverse engineering (SRE) framework

13
unaddressed
0
VuXML only, still affected
0
fixed
Maintainer
tiga@FreeBSD.org
Packages
ghidra 12.0.4
Upstream
Higher version available: 12.2
CPE
nsa:ghidra from the port
WWW
https://ghidra-sre.org/
Links
cgit · VuXML

Unaddressed (13) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 12.1.1 would fix 9 of 13 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 12.1 8 · 12.1.1 9
CVE-2026-527588.72026-06-10Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parame…
CVE-2026-527548.72026-06-10Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to i…
CVE-2026-494988.72026-06-10Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in usernames…
CVE-2026-527518.62026-06-10Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. …
CVE-2026-1005047.32026-09-26Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when processing negative shift amounts f…
CVE-2026-494966.92026-06-10Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator invalidation when PcodeCacher::allocateInstructio…
CVE-2026-527596.72026-06-10Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker c…
CVE-2026-494956.72026-06-10Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary ex…
CVE-2026-527566.32026-06-10Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connections and passes client-supplied namespace strings di…
CVE-2026-1005054.82026-09-26Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte UTF-8, UTF-16, or UTF-32 chara…
CVE-2026-1005034.82026-09-26Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op refere…
CVE-2026-527574.62026-06-10Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function during the variable merging pass. Attackers can trigge…
CVE-2026-494974.62026-06-10Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames from ELF binary .gnu_debuglink sections before co…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (26)

Tiago Gasiba (tiga) · 12.0.4
devel/ghidra: Update to version 12.0.4

Release notes:
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.0.4_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.0.3_build

MFH:		2026Q2
fbcccc6c8a
Vladimir Druzenko (vvd) · 12.0.2_2
devel/ghidra: Fix pkg-plist error when PYTHON_VER != 3.11

PR:		294767
Approved by:	blanket (fix build)
Sponsored by:	UNIS Labs
MFH:		2026Q2
f90e9a47b9
Ronald Klop (ronald) · 12.0.2_2
*/*: bump portrevision after java_default=25 update

Included all ports that have USES=java.

PR:	293559
86813e9ccf
Ronald Klop (ronald) · 12.0.2_1
*/*: bump portrevision after java_default=21 update

PR:	272855
2baaf16375
Tiago Gasiba (tiga) · 12.0.2
devel/ghidra: Update to 12.0.2

Release notes:
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.0.2_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.0.1_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.0_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.4.3_build

Approved by:	eduardo (mentor, implicit)
MFH:		2026Q1
78551a331e
Tiago Gasiba (tiga) · 11.4.2
devel/ghidra: Update to version 11.4.2

* Pet portlint, portclippy, portfmt

Release notes:
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.4.2_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.4.1_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.4_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.3.2_build

PR:		290245
Approved by:	eduardo (mentor)
aebcd95dc5
Tiago Gasiba (tiga) · 11.3.1
*/*: update maintainer to @freebsd.org

PR:		289928
Approved by:	eduardo (mentor)
4e450f33b9
Vladimir Druzenko (vvd) · 11.3.1
devel/ghidra: Fails to build with GCC 14: error: implicit declaration of function 'gettimeofday' [-Wimplicit-function-declaration]

Define __XSI_VISIBLE.

PR:		288305
Approved by:	gatekeeper <tiago.gasiba@gmail.com>
7d2e8fe9a1
Vladimir Druzenko (vvd) · 11.3.1
devel/ghidra: Update 11.1.2 → 11.3.1

Release notes:
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.2_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.2.1_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.3_build
https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_11.3.1_build

Switch to compilation with gcc, since the Decompiler plugin, when
compiled with clang, crashes randomly. Probably this is a problem in
upstream, as there are two different results with two different
compilers (some UB...).

PR:	285071
10c8159742
Vladimir Druzenko (vvd) · 11.1.2_2
devel/ghidra: Remove unnecessary temporary build files from plist

PR:	284560
83c68691d6
Vladimir Druzenko (vvd) · 11.1.2_1
devel/ghidra: Fix plist after udpate gradle

PR:		284560
Approved by:	gatekeeper <tiago.gasiba@gmail.com> (maintainer)
defc987f94
Muhammad Moinur Rahman (bofh) · 11.1.2
Mk/**java.mk: Convert bsd.java.mk to USES

The following features have been added or changed:
- Instead of USE_JAVA use USES=java. This defaults to
  USES=java:build,run if NO_BUILD is undefined. Else it defaults to
  USES=java:run
- Instead of USE_ANT=yes use USES=java:ant which also implies
  USES=java:build
- Instead of JAVA_BUILD=yes use USES=java:build. Does not imply run or
  extract
- Instead of JAVA_EXTRACT=yes use USES=java:extract does not imply
  build or run
- Instead of JAVA_RUN=yes use USES=java:run does not imply extract or
  build
- Instead of USE_JAVA=<version> use USES=java and JAVA_VERSION=<version>

Approved by: mat (portmgr), glewis
Differential Revision:  https://reviews.freebsd.org/D48201
0835676e36
Vladimir Druzenko (vvd) · 11.1.2
devel/ghidra: fix permissions be able to run ghidra from the command line

Also:
 - remove from SHEBANG_FILES those that are related with debugging
 - add a desktop file + icon from:
   https://github.com/NationalSecurityAgency/ghidra/discussions/3709
 - add a pkg-message
 - configure JAVA_HOME using the default installed java version

PR:	280494
Fixes:	e2b8d2a61766 (update 9.1 → 11.1.2, take maintainership)
MFH:	2024Q3
2bf3f54aaf
Vladimir Druzenko (vvd) · 11.1.2
devel/ghidra: update 9.1 → 11.1.2, take maintainership

Port was FORBIDDEN, updated last time in 2019, maintainer is innactive.
Tamas Szakaly <sghctoma@gmail.com>, thanks for you work, hope you come
back to FreeBSD porters team!

Install share/ghidra/support/launch.properties as a @sample file.

Changelogs:
https://htmlpreview.github.io/?https://raw.githubusercontent.com/NationalSecurityAgency/ghidra/Ghidra_11.1.2_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html

PR:	280378 275383 244345
MFH:	2024Q3
e2b8d2a617
Tilman Keskinoz (arved) · 9.1
devel/ghidra: Mark FORBIDDEN contains a RCE

PR:		260854
Submitted by:	Cameron Katri
Security:	https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-j3xg-fc2p-4jc4
2ea61fba9e
Stefan Eßer (se) · 9.1
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 9.1
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Tobias Kortkamp (tobik) · 9.1
*: apply refactor.remove-consecutive-empty-lines

Submitted by:	portedit
ce1af7fdc2
Stefan Eßer (se) · 9.1
devel/ghidra: Add CPE information

Approved by:	portmgr (blanket)
2a446c8e91
Mathieu Arnold (mat) · 9.1
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 9.1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Mateusz Piotrowski (0mp) · 9.1
Clean up port's makefile

Approved by:	portmgr blanket
2ba6f63ff9
Tobias Kortkamp (tobik) · 9.1
devel/ghidra: Update to 9.1

- Now that openjdk11+ are registered in bsd.java.mk, drop the JDK11
  and JDK12 options

Changes:	https://ghidra-sre.org/releaseNotes_9.1_final.html#9_1
PR:		239902
Submitted by:	Tamas Szakaly <sghctoma@gmail.com> (maintainer)
35cab9ee7f
Tobias Kortkamp (tobik) · 9.0.4
Create devel/gradle5 in preparation of devel/gradle update

Many consumers fail to build with newer Gradle versions.

PR:		239875, 239900, 239901, 239902
456263afc3
Tobias Kortkamp (tobik) · 9.0.4
devel/ghidra: Fix build error caused by cache cleanup

The issue seems to be caused by Gradle caches being cleaned up
between build sessions [1].  It did not come up before because the
cached files were not old enough to be deleted.

Cleanup happens after a build session, so running the two build
targets (yajswDevUnpack and buildGhidra) in the same session fixes
the issue.

[1] https://docs.gradle.org/current/userguide/directory_layout.html#dir:gradle_user_home:cache_cleanup)

PR:		239472
Submitted by:	Tamas Szakaly <sghctoma@gmail.com> (maintainer)
782d7bccdc
Kurt Jaeger (pi) · 9.0.4
New port: devel/ghidra

Ghidra is a software reverse engineering (SRE) framework created
and maintained by the National Security Agency Research Directorate
of the United States of America.

This framework includes a suite of full-featured, high-end software
analysis tools that enable users to analyze compiled code on a
variety of platforms including Windows, macOS, and Linux. Capabilities
include disassembly, assembly, decompilation, graphing, and scripting,
along with hundreds of other features. Ghidra supports a wide variety
of processor instruction sets and executable formats and can be run
in both user-interactive and automated modes. Users may also develop
their own Ghidra plug-in components and/or scripts using Java or
Python.

WWW: https://ghidra-sre.org/

PR:		237211
Submitted by:	Tamas Szakaly <sghctoma@gmail.com>
Reviewed by:	koobs, yuri, rgrimes
d77700ddec