CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

emulators/virtualbox-ose-727.2.20_1

General-purpose full virtualizer for x86 hardware

0
unaddressed
0
VuXML only, still affected
0
fixed
Maintainer
vbox@FreeBSD.org
Packages
virtualbox-ose-72 7.2.20_1, virtualbox-ose-nox11-72 7.2.20_1
Upstream
up to date
CPE
oracle:vm_virtualbox from the port
WWW
https://www.virtualbox.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (33)

Vladimir Druzenko (vvd) · 7.2.22
emulators/virtualbox-ose{,-additions,-kmod}-72: Update 7.2.20 => 7.2.22

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

Security:	CVE-2026-87322
Security:	CVE-2026-87301
Security:	CVE-2026-101598
Security:	CVE-2026-101599
Security:	CVE-2026-87303
Security:	CVE-2026-87311
Sponsored by:	UNIS Labs
MFH:		2026Q4
bcea1e6e26
Vladimir Druzenko (vvd) · 7.2.20_1
emulators/virtualbox-ose-72: Fix silent grab of jpeg-turbo

Sponsored by:	UNIS Labs (vvd, commit patch)
MFH:		2026Q4
45b497e985
Vladimir Druzenko (vvd) · 7.2.20
emulators/virtualbox-ose{,-70,-71,-72}: Fix dependency from libfuse

Sponsored by:	UNIS Labs (vvd, commit patch)
MFH:		2026Q4
f9ccf60c31
Vladimir Druzenko (vvd) · 7.2.20
emulators/virtualbox-ose{,-additions,-kmod}-72: Update 7.2.18 => 7.2.20

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2#v20

Sponsored by:	UNIS Labs
MFH:		2026Q4
707c79cdca
Vladimir Druzenko (vvd) · 7.2.18
emulators/virtualbox-ose-*72: Update 7.2.16 => 7.2.18 (19 CVEs)

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2#v18

Oracle Critical Security Patch Update Advisory - September 2026:
https://www.oracle.com/security-alerts/cspusep2026.html#AppendixOVIR

Sponsored by:	UNIS Labs
Security:	CVE-2026-87273
Security:	CVE-2026-87268
Security:	CVE-2026-87269
Security:	CVE-2026-87270
Security:	CVE-2026-87271
Security:	CVE-2026-87272
Security:	CVE-2026-87276
Security:	CVE-2026-87277
Security:	CVE-2026-87278
Security:	CVE-2026-87279
Security:	CVE-2026-87282
Security:	CVE-2026-87283
Security:	CVE-2026-87285
Security:	CVE-2026-87267
Security:	CVE-2026-87275
Security:	CVE-2026-87274
Security:	CVE-2026-87280
Security:	CVE-2026-87281
Security:	CVE-2026-87284
MFH:		2026Q3
13ab7c5943
Vladimir Druzenko (vvd) · 7.2.16
emulators/virtualbox-ose{,-additions,-kmod}-72: Update 7.2.14 => 7.2.16

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

Sponsored by:	UNIS Labs
MFH:		2026Q3
10d4d014d2
Vladimir Druzenko (vvd) · 7.2.14
emulators/virtualbox-ose{,-additions,-kmod}-72: Update 7.2.12 => 7.2.14

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

Reported by:	portscout
Sponsored by:	UNIS Labs
MFH:		2026Q3
deea2dad01
Vladimir Druzenko (vvd) · 7.2.12
emulators/virtualbox-ose{,-additions,-kmod}-72: Update 7.2.10 => 7.2.12

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

Sponsored by:	UNIS Labs
a18f6ed13a
Vladimir Druzenko (vvd) · 7.2.10
emulators/virtualbox-ose{,-additions,-kmod}-72: Update 7.2.8 => 7.2.10 (10 CVEs)

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2
https://www.oracle.com/security-alerts/cspujun2026.html#AppendixOVIR

Security:	CVE-2026-46974
Security:	CVE-2026-35275
Security:	CVE-2026-46873
Security:	CVE-2026-46768
Security:	CVE-2026-46825
Security:	CVE-2026-46877
Security:	CVE-2026-46874
Security:	CVE-2026-46815
Security:	CVE-2026-46816
Security:	CVE-2026-46977
Sponsored by:	UNIS Labs
MFH:		2026Q2
bbd7ab52a8
Gleb Popov (arrowd) · 7.2.8_1
emulators/virtualbox-ose-kmod*: Fix building on recent CURRENT

Approved by:	vvd (via Telegram)
dce1fa09e2
Vladimir Druzenko (vvd) · 7.2.8_1
emulators/virtualbox-ose{,-70,-71,-72,-legacy}: Fix PKGNAMESUFFIX

While here parametrize version for unification.

Sponsored by:	UNIS Labs
55cdeefc9b
Vladimir Druzenko (vvd) · 7.2.8_1
emulators/virtualbox-ose*: Flavorize

While here make non-functional changes related to indentation and
formatting, make simplification of CONFLICTS_INSTALL.

Sponsored by:	UNIS Labs
7c406bf706
Vladimir Druzenko (vvd) · 7.2.8
emulators/virtualbox-ose{,-nox11}{,-legacy,-70,-71,-72}: Fix build with custom USERS/GROUPS not in UIDs/GIDs

Sponsored by:	UNIS Labs
MFH:		2026Q2
87ffb19323
Vladimir Druzenko (vvd) · 7.2.8
emulators/virtualbox-ose{,-nox11,-additions,-additions-nox11,-kmod}-72: Update 7.2.6 => 7.2.8 (fix 9 CVEs)

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2
https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixOVIR

Security:	CVE-2026-35242
Security:	CVE-2026-35246
Security:	CVE-2026-35251
Security:	CVE-2026-35230
Security:	CVE-2026-35245
Security:	CVE-2026-35247
Security:	CVE-2026-35248
Security:	CVE-2026-35249
Security:	CVE-2026-35250
Sponsored by:	UNIS Labs
MFH:		2026Q2
bc8444a110
Älven (alven) · 7.2.6_1
emulators/virtualbox-ose-*: VirtualBox 7.X: license changed from GNU GPLv2 to GNU GPLv3

PR:		294588
Reported by:	ykla <yklaxds@gmail.com>
Approved by:	vbox@ (vvd@)
Approved by:	db@, yuri@ (Mentors, implicit)
MFH:	 	2026Q2
cb332df603
Vladimir Druzenko (vvd) · 7.2.6_1
emulators/virtualbox-ose{,-70,-71,-72,-legacy}: Improve port (non-functional)

- Replace ${PREFIX}/share/applications with ${DESKTOPDIR}.
- Replace "*" with . in COPYTREE_SHARE.
3862afae6a
Vladimir Druzenko (vvd) · 7.2.6_1
emulators/virtualbox-ose*: Add support of "Unattended Installation of Guest OS" feature

Install files required by Unattended Installation of Guest OS feature.
These files were already prepared during the ports' build, so just add
them to the installation.

Details about this feature are here:
https://www.virtualbox.org/manual/topics/create-vm.html#tk_create-vm-unattended-install

Reported by:	xin3qu via IRC (#freebsd-vbox @ Libera.Chat)
4f2ef91eed
Vladimir Druzenko (vvd) · 7.2.6
emulators/virtualbox-ose*: Exclude from extract bundled binary files of kBuild

Thes is ~430-640 files, ~30-55MB total for different platforms.
We are using devel/kBuild for build VirtualBox ports.
devel/kBuild is a newer version than the one included in the VirtualBox
tarballs.
c22c337cf0
Vladimir Druzenko (vvd) · 7.2.6
emulators/virtualbox-ose-7[012]: Fix build after update devel/gsoap 2.8.139 => 2.8.140

out/freebsd.amd64/release/obj/webservice/soapC-7.cpp:5:32: error: use of undeclared identifier 'soap_codes_vbox__PartitionType'
    5 |         const char *s = soap_code_str(soap_codes_vbox__PartitionType, (long)n);
      |                                       ^
out/freebsd.amd64/release/obj/webservice/soapC-7.cpp:23:18: error: use of undeclared identifier 'soap_codes_vbox__PartitionType'
   23 |         map = soap_code(soap_codes_vbox__PartitionType, s);
      |                         ^
2 errors generated.

PR:		292890
Reported by:	pkg-fallout
ceb61fac0c
Vladimir Druzenko (vvd) · 7.2.6
emulators/virtualbox-ose*-72: Update 7.2.4 => 7.2.6

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2#v6

emulators/virtualbox-ose{,-nox11}-72:
Remove the OGG, VORBIS, and VPX options - without libogg and libvorbis
in the system, the ports attempts to use the bundled versions, but
without libvpx, the build fails. Even when using libvpx, building the
bundled libvorbis library also fails.
These 3 libraries are not heavy dependencies, so we simply make them
mandatory even for emulators/virtualbox-ose-nox11-72.

PR:		292801
Tested by:	jwb
Security:	CVE-2026-21955
Security:	CVE-2026-21956
Security:	CVE-2026-21987
Security:	CVE-2026-21988
Security:	CVE-2026-21990
Security:	CVE-2026-21989
Security:	CVE-2026-21957
Security:	CVE-2026-21983
Security:	CVE-2026-21984
Security:	CVE-2026-21982
Security:	CVE-2026-21986
Security:	CVE-2026-21963
Security:	CVE-2026-21985
Security:	CVE-2026-21981
MFH:		2026Q1
2d96a54833
Jan Beich (jbeich) · 7.2.4_1
multimedia/libvpx: update 1.16.0

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.15.2..v1.16.0
Reported by:	Repology
939d8775e7
Vladimir Druzenko (vvd) · 7.2.4
emulators/virtualbox-ose-{,-nox11}-7{0,1,2}: Make Qt optional for building

Remove build dependency for Qt when NLS and graphical frontend is not
required.

PR:		291023
Co-authored-by:	takahiro.kurosawa@gmail.com
MFH:		2025Q4
4f1b651ebc
Vladimir Druzenko (vvd) · 7.2.4
emulators/virtualbox-ose-additions*: Fix "vboxmanage guestproperty" on host does not show interface name for FreeBSD guest

Upstream issue:
https://github.com/VirtualBox/virtualbox/issues/403
Upstream commit:
https://github.com/VirtualBox/virtualbox/commit/3cf64726847e2483c9539ca51c88862a0f1c7414

PR:	291128
MFH:	2025Q4
89de71b8c7
Vladimir Druzenko (vvd) · 7.2.4
emulators/virtualbox-ose-additions{,-nox11}-72: Add new ports VirtualBox Guest Additions 7.2.4

Ports need more thorough testing at runtime.

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

PR:		289019
Relnotes:	yes
5193a9f50d
Vladimir Druzenko (vvd) · 7.2.4
emulators/virtualbox-ose{,-71,-72,-legacy}: Fix description in rc script

Fix description for option vboxinit_start_delay.

MFH:	2025Q4
0dad99d889
Vladimir Druzenko (vvd) · 7.2.4
emulators/virtualbox-ose{,-kmod,-nox11}-72: Update 7.2.2 => 7.2.4 (fixed 9 CVEs)

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

Fixed 9 CVEs:
https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixOVIR

Security:	CVE-2025-62587
Security:	CVE-2025-62588
Security:	CVE-2025-62589
Security:	CVE-2025-62641
Security:	CVE-2025-62590
Security:	CVE-2025-61760
Security:	CVE-2025-61759
Security:	CVE-2025-62591
Security:	CVE-2025-62592
MFH:		2025Q4
afec9b5ee3
Max Brazhnikov (makc) · 7.2.2_1
*/*: Fix Qt and LXQt spelling
64fb50b01e
Vladimir Druzenko (vvd) · 7.2.2_1
emulators/virtualbox-ose*: Fix vboxvfs build on 16-CURRENT

/wrkdirs/usr/ports/emulators/virtualbox-ose-additions/work/VirtualBox-6.1.50/src/VBox/Additions/freebsd/vboxvfs/vboxvfs_vnops.c:1271:9: error: use of undeclared identifier 'NULLVP'
 1271 |         *vpp = NULLVP;
      |                ^
/wrkdirs/usr/ports/emulators/virtualbox-ose-additions/work/VirtualBox-6.1.50/src/VBox/Additions/freebsd/vboxvfs/vboxvfs_vnops.c:1281:3: error: call to undeclared function 'VREF'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration]
 1281 |                 VREF(dvp);
      |                 ^

Commits that broke the build:
https://cgit.freebsd.org/src/commit/sys/sys/vnode.h?id=7e4c451c12aeb26cc1179221b8230c491b17cf00
https://cgit.freebsd.org/src/commit/sys/sys/vnode.h?id=01c8e2e33df81b242d73a23de49a6b61f33c24c1

PR:		289992
Reported by:	pkg-fallout
MFH:		2025Q4
bf21746ce0
Vladimir Druzenko (vvd) · 7.2.2_1
emulators/virtualbox-ose{,-nox11}-72: Add support of TPM device emulation using sysutils/libtpms (default on)

Fix: "Failed to attach to TPM driver. rc=VERR_PDM_DRIVER_NOT_FOUND"

PR:	289922
MFH:	2025Q4
c3c421e837
Vladimir Druzenko (vvd) · 7.2.2
emulators/virtualbox-ose{,-kmod,-nox11}-72: Update 7.2.0 => 7.2.2

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

PR:		289019
Tested by:	Mario Lobo <lobo@bsd.com.br>
Tested by:	Vladimir Druzenko <vvd@FreeBSD.org>
MFH:		2025Q3
fba8e2bddc
Vladimir Druzenko (vvd) · 7.2.0
emulators/virtualbox-ose{,-nox11}{,-70,-71,-72,-legacy}: Fix build with ftp/curl 8.16.0

kBuild: Compiling VBoxRT - /wrkdirs/usr/ports/emulators/virtualbox-ose-72/work/VirtualBox-7.2.0/src/VBox/Runtime/generic/http-curl.cpp
/wrkdirs/usr/ports/emulators/virtualbox-ose-72/work/VirtualBox-7.2.0/src/VBox/Runtime/generic/http-curl.cpp:702:27: error: assigning to 'curl_proxytype' from incompatible type 'long'
  702 |     pThis->enmProxyType = CURLPROXY_HTTP;
      |                           ^~~~~~~~~~~~~~
/usr/local/include/curl/curl.h:791:35: note: expanded from macro 'CURLPROXY_HTTP'
  791 | #define CURLPROXY_HTTP            0L /* added in 7.10, new in 7.19.4 default is
      |                                   ^~

Upstream bug report:
https://github.com/curl/curl/issues/18054#issuecomment-3354156324

PR:	289924
40fa372043
Vladimir Druzenko (vvd) · 7.2.0
emulators/virtualbox-ose{,-kmod,-nox11}-72: Add new ports VirtualBox 7.2.0

Port based on patch from Stas Timokhin <devel@stasyan.com>.
The main work on porting was done by the author of the original patch.
The rest is a several various improvements and bug fixes that have been
made over the past few months in older versions and one upstream
regression: https://github.com/VirtualBox/virtualbox/issues/135

The requirements for 7.2.x are the same as for 7.1.x, but for now we'll
leave both versions: 7.2.x in experimental/test mode and 7.1.x - stable.

Upstream ported on aarch64, but for now we keep ONLY_FOR_ARCHS=amd64.
If you interested in porting it on aarch64 - create PR with patch.

The following ports also need to be created (they are not available for
versions 7.0.x and 7.1.x either):
 - emulators/virtualbox-ose-additions-72;
 - emulators/virtualbox-ose-additions-nox11-72.

www/phpvirtualbox-72 already in ports.

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2

While here refresh patches.

PR:		289019
Relnotes:	Add VirtualBox 7.2.0
Co-authored-by:	Stas Timokhin <devel@stasyan.com>
Co-authored-by:	Mario Lobo <lobo@bsd.com.br>
3fd0f81ce5
Vladimir Druzenko (vvd) · 7.1.12
emulators/virtualbox-ose{,-kmod,-nox11}-72: Repocopy from emulators/virtualbox-ose{,-kmod,-nox11}-71

PR:	289019
54a5827bb6