CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

emulators/virtualbox-ose6.1.50_20

General-purpose full virtualizer for x86 hardware

Maintainer
vbox@FreeBSD.org
Packages
virtualbox-ose 6.1.50_20, virtualbox-ose-nox11 6.1.50_20
Upstream
Higher version available: 7.2.22
CPE
oracle:vm_virtualbox from the port
WWW
https://www.virtualbox.org/
Links
cgit · VuXML

Unaddressed (16) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 7.0.20 would fix 16 of 16 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 7.0.16 13 · 7.0.20 16
CVE-2024-211138.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211148.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211158.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211128.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211418.22024-07-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily exploitab…
CVE-2024-211167.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211117.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211037.82024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211107.32024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211076.72024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211216.52024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211066.52024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211095.92024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Difficult to exp…
CVE-2024-211615.52024-07-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Easily exploitab…
CVE-2024-211083.32024-04-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.16. Easily exploitab…
CVE-2024-211642.52024-07-16Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.20. Difficult to exp…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (9)

Show 9 fixed
VuXML entries whose affected range this version has left.

Commits (437)

Mathieu Arnold (mat) · 6.1.50_1
cleanup: remove occurrences of WITH_DEBUG

DEBUG like all ports features, must not ever be set in a port, they are
user facing features, that the user needs to enable in their
environment/make.conf, either by defining WITH_DEBUG globally, or by
setting WITH_DEBUG_PORTS with origin of ports they want DEBUG enabled
in.
0660187ad0
Jan Beich (jbeich) · 6.1.50_1
multimedia/libvpx: update 1.14.0

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.13.1..v1.14.0
Reported by:	portscout
589aaaeb09
Vladimir Druzenko (vvd) · 6.1.50
emulators/virtualbox-ose{,-kmod,-additions}: update to 6.1.50

Changelog: https://www.virtualbox.org/wiki/Changelog-6.1#v50

PR:			276437
Approved by:		arrowd (mentor), olce
Differential Revision:	https://reviews.freebsd.org/D43510
MFH:			2024Q1
9e318d649a
Muhammad Moinur Rahman (bofh) · 6.1.48_1
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree

- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
  ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
  Also move conditional flags for non sparc64/arm ARCH to fixed flags.

Reviewed by:	brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
bbab7f59e9
Eugene Grosbein (eugen) · 6.1.48_1
emulators/virtualbox-ose: add option to build vboximg-mount

Introduce new port option VBOXIMG that enables building and installing
"vboximg-mount" utility. It is not enabled by default as it needs
fusesfs-libs as another dependency.

The utility gives access to insides of VM images like .vdi files etc.
Use "vboximg-mount -g" to get access to files on internal file systems
not supported by native FreeBSD mount command. Refer to utility's
internal online help for syntax details and to original documentation:

https://docs.oracle.com/en/virtualization/virtualbox/6.0/user/vboximg-mount.html

PR:		274817
Tested by:	vvd
Approved by:	vbox (maintainer timeout over 2 weeks)
6c5da516ce
Vladimir Druzenko (vvd) · 6.1.48
emulators/virtualbox-ose{,-kmod,-additions}: update to 6.1.48

Based on patch from Sergey V. Dyatko <sergey.dyatko@gmail.com>.
Changelog: https://www.virtualbox.org/wiki/Changelog-6.1#v48

PR:			274555
Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D42322
MFH:			2023Q4
ae6b467526
Corvin Köhne (corvink) · 6.1.46_1
emulators/virtualbox-ose: fix build errors on CURRENT

PR:			272991
Reviewed by:		corvink, manu
Approved by:		manu, vbox (maintainer timeout)
de862b33d4
Gleb Popov (arrowd) · 6.1.46_1
audio/pulseaudio: Update to 16.1

Bump PORTREVISION on consumers.

Sponsored by:	Serenity Cybersecurity, LLC

PR:		262713
b1ecad53b0
Rene Ladan (rene) · 6.1.46
all: remove support for expired FreeBSD 13.1

Approved by:	portmgr (implicit), salvadore (gcc ports)
Reviewed by:	jbeich

Differential Revision: https://reviews.freebsd.org/D40845
5981a24740
Vladimir Druzenko (vvd) · 6.1.46
emulators/virtualbox-ose{,-nox11,-kmod,-additions,-additions-nox11}: update to 6.1.46

Changelog: https://www.virtualbox.org/wiki/Changelog-6.1#v46
Also fixed PORTREVISION in master/slave ports.

PR:			272572
Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D41110
MFH:			2023Q3
5dd9c30f7d
Vladimir Druzenko (vvd) · 6.1.44_3
emulators/virtualbox-ose{,-legacy}: sort out options

Sort out options: order (portlint), convert to OPTION_*.
Add entry in "Troubleshooting" about "VERR_NO_MEMORY".
Force devel/llvm15 for emulators/virtualbox-ose-legacy on recent 14 with
llvm16 in base.

PR:			200764 252227
Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D40751
23eed6a753
Vladimir Druzenko (vvd) · 6.1.44_2
emulators/virtualbox-ose: Remove unnecessary dependency on 32-bit compat for amd64

32-bit in-kernel support and lib32 libs are not necessary for VirtualBox 6.x,
so just remove this requirement.
Also the port support amd64 only - remove I386 from PLIST_SUB.

PR:			266382
Tested by:		Olivier Certner <olivier.freebsd@free.fr>
Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D40487
fd06fe3d7c
Vladimir Druzenko (vvd) · 6.1.44_2
emulators/virtualbox-ose: added replace %%VBOX_ETC%% in files/pkg-message.in

Approved by:	arrowd (mentor)
2b4fcd4f70
Vladimir Druzenko (vvd) · 6.1.44_2
emulators/virtualbox-ose: on 14 "Failed to construct device 'VMMDev' instance #0 (VERR_INTERNAL_ERROR_3)"

Force llvm from ports from 11 to 14 - by default it'll pick 14.
Use VBOX_LLVM_VER in make.conf to define different llvm.

PR:			270189
Reviewed by:		cy, grahamperrin
Tested by:		cy, grahamperrin, groenveld@acm.org, rkoberman@gmail.com
Approved by:		arrowd
Differential Revision:	https://reviews.freebsd.org/D40254
e6b21a9e3f
Vladimir Druzenko (vvd) · 6.1.44_1
emulators/virtualbox-ose: error: use of undeclared identifier 'mempcpy'

1. There are no mempcpy on 12, on 13 before 1300513 and on 14 before 1400026.
Log with error is here:
https://lists.freebsd.org/archives/freebsd-pkg-fallout/2023-May/402233.html
2. 12 have llvm11 in base after 1203502 (llvm12 after 1203503 and llvm13
after 1203505), so not need to force build with llvm11 from ports.

Reported by:		https://portsfallout.com/fallout?port=emulators%2Fvirtualbox-ose%24
Reviewed by:		rene
Approved by:		arrowd (mentor), fuz
Differential Revision:	https://reviews.freebsd.org/D40163
a39a00bddf
Vladimir Druzenko (vvd) · 6.1.44_1
emulators/virtualbox-ose[-legacy]: rename option MANUAL to DOCS and make it enabled by default

PR:			266992
Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D40118
a0ef5898be
Colin Percival (cperciva) · 6.1.44
emulators/virtualbox-ose: Fix whitespace

Tab, not spaces.
b49c45cf3b
Vladimir Druzenko (vvd) · 6.1.44
emulators/virtualbox-ose[-legacy]: VM VirtualBox Manager: Help menu: unable to open external browser

While here sort out LOCALBASE, PREFIX, VBOX_DIR, VBOX_ETC

PR:			266778
Approved by:		arrowd (mentor)
Differential Revision:	https://reviews.freebsd.org/D40119
8b9f42573e
Vladimir Druzenko (vvd) · 6.1.44
emulators/virtualbox-ose{-*}: Update to 6.1.44

Changes:		https://www.virtualbox.org/wiki/Changelog-6.1#v44
Author:			lwhsu@FreeBSD.org
Note:			BROKEN on 14

PR:			266907
Reported by:		Ian Dickens <ian@south-border.com>
Approved by:		arrowd (mentor), joneum (ports-secteam)
Differential Revision:	https://reviews.freebsd.org/D40088
1d37fcd831
Gerald Pfeifer (gerald) · 6.1.36_2
*: Bump PORTREVISIONs for math/mpc update to 1.3.1
8d3e020ed0
Jung-uk Kim (jkim) · 6.1.36_1
emulators/virtualbox-ose: Fix build with LLVM 15

The previous commit (f4a869a6424a) was in complete.
7270b89922
Joseph Mingrone (jrm) · 6.1.36_1
emulators/virtualbox-ose-kmod: Fix build with LLVM 15

Starting with clang 15, the -Wint-conversion warning diagnostic for
implicit int <-> pointer conversions defaults to an error. Use a cast to
fix such an error here.

See also:       https://lists.freebsd.org/archives/freebsd-emulation/2023-February/000431.html
                https://lists.freebsd.org/archives/freebsd-emulation/2023-February/000460.html
PR:		269721
Reported by:	fbl@aoek.com, ohartmann@walstatt.org, rkoberman@gmail.com
Differential Revision: https://reviews.freebsd.org/D38906
Sponsored by:	The FreeBSD Foundation
f4a869a642
Jan Beich (jbeich) · 6.1.36_1
multimedia/libvpx: update 1.13.0

Changes:	https://chromium.googlesource.com/webm/libvpx/+log/v1.12.0..v1.13.0
Reported by:	portscout
17f6d799d7
Li-Wen Hsu (lwhsu) · 6.1.36
emulators/virtualbox-ose-additions*: Fix patch and build (for non-legacy)

PR:		268603
Fixes:		c35a71080172 emulators/virtualbox-ose: fix builds on CURRENT
e3a7ac3248
Graham Perrin (grahamperrin) · 6.1.36
emulators/virtualbox-ose: fix builds on CURRENT

SAVENAME was retired by D36542 https://reviews.freebsd.org/D36542

Bug 267079 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267079
involves failures to build four ports, for VirtualBox guest additions,
on FreeBSD-CURRENT:

    emulators/virtualbox-ose-additions
    emulators/virtualbox-ose-additions-legacy
    emulators/virtualbox-ose-additions-nox11
    emulators/virtualbox-ose-additions-nox11-legacy

Fix bug 267079 for CURRENT 1400068 and greater by hiding the use of
SAVENAME in patch-src_VBox_Additions_freebsd_vboxvfs_vboxvfs__vnops.c
for:

    emulators/virtualbox-ose
    emulators/virtualbox-ose-legacy

PR:                  : 267079
Author:              : mjg
Approved by:         : ports-committers (lwhsu), khng
Differential revision: https://reviews.freebsd.org/D37074
c35a710801
Muhammad Moinur Rahman (bofh) · 6.1.36
Mk/**tex.mk: Convert bsd.tex.mk to USES=tex

- Update all the consumers to use USES=tex
- USE_TEX=yes is the old way of writing USES=tex which has been removed
  and replaced in all ports
- Almost all of the USE_TEX features remains unchanged
- Some consumers had the same variables defined both in the mk
  infrastructure and also in the ports which have been removed from the
  ports as those are redundant.

In case any of the consumers are failing to build please make sure that
the nexessary USES=tex is there. Unlike previous USE_TEX=yes will no
longer load the required VARS for tex and related dependencies.

Reviewed by:	portmgr
Approved by:	portmgr (blanket)
721e5776c9
Felix Palmen (zirias) · 6.1.36
Mk/Uses: always use colon for build/run suffix

Most USES use a colon for build/run(/test) suffixes. Change kde.mk,
qt.mk and pyqt.mk to do the same, and update all ports using that.

Document in CHANGES.

PR:			266034
Exp-run by:		antoine
Approved by:		tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D36349
ddae4e92d8
Stefan Eßer (se) · 6.1.36
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 6.1.36
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
John Baldwin (jhb) · 6.1.36
emulators/virtualbox-ose-additions: Remove devclass from DRIVER_MODULE on recent main.

Reviewed by:	madpilot
Differential Revision:	https://reviews.freebsd.org/D35954
8b07c8afd6
Guido Falsi (madpilot) · 6.1.36
emulators/virtualbox-ose: Update to 6.1.36

Changelog: https://www.virtualbox.org/wiki/Changelog

PR:		265351
99d29ee89f
Guido Falsi (madpilot) · 6.1.34_1
emulators/virtualbox-ose: Add VBoxSharedClipboard.so to non X11 builds

This library is built when X11 is disabled too, since the functionality
can also be used by remote protocols.

PR:		261729
MFH:		2022Q3
5f02996b2b
Bernhard Froehlich (decke) · 6.1.34
*/*: Release my babies from my "created by" comments
27d033713d
Bryan Drewery (bdrewery) · 6.1.34
emulators/virtualbox-ose: Fix build with new setuptools
266d2cf881
John Baldwin (jhb) · 6.1.34
emulators/virtualbox-ose-kmod*: Tie to a specific release branch.

Use a more restricted range of supported __FreeBSD_version values for
the virtualbox kernel module since it uses internal KPIs for which KBI
stability is not guaranteed.  DECLARE_MODULE_TIED would tie the module
to a specific __FreeBSD_version which would cause the module to stop
loading when an SA or EN is pushed on a release branch.  Instead, use
DECLARE_MODULE_MAXVER with an upper bound that is limited to the range
of a releng branch so that a module built on X.Y will load on X.Y with
SAs or ENs applied but will fail to load on X.Y-1 or X.Y+1.

Reviewed by:	kevans, imp, madpilot, lwhsu (earlier version)
Differential Revision:	https://reviews.freebsd.org/D16119
bc6d5725ed
Guido Falsi (madpilot) · 6.1.34
emulators/virtualbox-ose*: Update to 6.1.34

PR:		263439
4017132e11
Charlie Li (vishwin) · 6.1.32_3
textproc/libxml2: bump all LIB_DEPENDS consumers

This is a separate commit to facilitate easier cherry-picking for
quarterly.

PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
d63665f7cd
Matthias Fechner (mfechner) · 6.1.32_2
textproc/libxml2: bump all dependencies

This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
247c7db751
Neel Chauhan (nc) · 6.1.32_1
emulators/virtualbox-ose-kmod: Fix kernel panic in DHCP bridge mode

PR:		262656
Approved by:	madpilot
b1d24b891b
Guido Falsi (madpilot) · 6.1.32_1
emulators/virtualbox-ose: Put vbox/networks.conf in the right place

Since virtualbox-ose 6.1.26 a new networks.conf file has been
introduced and the software looks for it in /etc/vbox.

This commit introduces a patch to make virtualbox look for it in
PREFIX/etc/vbox.

To help users with configurations already using this file in /etc/vbox
notes to UPDATING, pkg-message and to the main virtualbox executable
script have been added.

Also adding some comments to the Makefile to note that QA warning
due to reinplace being run but not having changed any file are
expected due to the design of this port Makefile.

PR:		261522
66635b2061
Guido Falsi (madpilot) · 6.1.32
emulators/virtualbox-ose(-legacy): Take advantage of ccache

This patch teaches the virtualbox ports to take advantage of ccache
if the ports are configured to use it.

PR:		254616
a60dcd7125
Guido Falsi (madpilot) · 6.1.32
emulators/virtualbox-ose-additions(-legacy): Fix build on recent head

On recent head, after src commit 66c5fbca7719dc, the insmntque1(9)
function arguments changed.

Adapt virtualbox code, following what has been done in base with
other filesystems migrating to insmntque(9).
2db7c87638
Guido Falsi (madpilot) · 6.1.32
emulators/virtualbox-ose*: Update to 6.1.32

Changelog: https://www.virtualbox.org/wiki/Changelog-6.1#v32
6348afa698
Stefan Eßer (se) · 6.1.30
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL

The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").

Approved by: portmgr (blanket)
5933ac0b09
Guido Falsi (madpilot) · 6.1.30
emulators/virtualbox-ose: Update to 6.1.30
28c743aa5d
Guido Falsi (madpilot) · 6.1.28_1
emulators/virtualbox-ose: Fix unintentional change

AAn unintentional change slipped in a previous commit. Revert that
part.

No change in the produced packages.

Fixes:		32c43c50524246
06f66cc221
Guido Falsi (madpilot) · 6.1.28_1
emulators/virtualbox-ose*: Fix mistake in patch

In the commit to update virtualbox-ose to 6.1.28 I made a one line
mistake when reapplying a patch which failed to apply as is.

In the patch
files/patch-src_VBox_HostDrivers_Support_freebsd_SUPDrv-freebsd.c
I did not replay a part removing the line:

rc = copyout(pHdr, pvUser, cbOut);

which was rewriting some data that it should not. The correct code
was anyway present after this leftover statement.

This error made virtualbox log a lot of warnings about Bad CPU
context like this:

vboxdrv: Bad CPU context error at line 373 in SUPDrv-freebsd.c:
ulCmd=0x2000568a: 0x282->0x287!

These seem to be unharmful, but anyway indicate a problem that this
commit fixes.

Reported by:		Kevin Oberman <rkoberman@gmail.com> (via mailing list)
Fixes:			a3db7da59f9498
32c43c5052
Guido Falsi (madpilot) · 6.1.28
emulators/virtualbox-ose: Update description and message files

- Add updated information about supported versions, installation
  commands and mitigation for a known issue.
- Removed reference to the wiki page.

Reviewed on github:

https://github.com/freebsd/freebsd-ports/pull/115

PR:             254412
352af02b38
Guido Falsi (madpilot) · 6.1.28
emulators/virtualbox-ose*: Update to 6.1.28

Changelog: https://www.virtualbox.org/wiki/Changelog
a3db7da59f
Guido Falsi (madpilot) · 6.1.26_3
emulators/virtualbox-ose-additons: Fix build on recent head

Fix build after head commit b4a58fbf640409a1 (vfs: remove cn_thread)

MFH:		2021Q4
21d79d6e16