CVE and update status of the FreeBSD ports tree3,317 unaddressed CVEs in 678 portsAll times are CET
Port details

security/vuxml 1.1_6

Vulnerability and eXposure Markup Language DTD

0
unaddressed
0
VuXML only
0
fixed
5
open problem reports

Port info

Maintainer
ports-secteam@FreeBSD.org
Packages
latest: 1.1_6
Upstream
up to date
Last update
to 1.1_6 · fd3f63f3f6
Quarterly
2026Q4: 1.1_6
WWW
https://vuxml.freebsd.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install vuxml
installs 1.1_6 from latest; from quarterly (2026Q4) 1.1_6
Port
# cd /usr/ports/security/vuxml && make install clean
Size
9.7 KiB download · 40 KiB installed
Depends on
lang/python312 3.12.15, textproc/libxslt 1.1.45, textproc/xhtml-basic 1.0.20001219_2, textproc/xhtml-modularization 1.0.20010410_1, textproc/xmlcatmgr 2.2_4
License
BSD2CLAUSE

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.1_61.1_6–
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.1_6.

Fixed (0)

No VuXML entries for this package.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
295797maintainer-feedback? security/vuxml: fix nginx ranges vulnerable to CVE-2026-9256In Progress2026-07-17
295836maintainer-feedback? security/vuxml: Multiple vulnerabilities in py-djangoNew2026-06-04
291717security/vuxml: add entry for uriparser < 1.0.0New2025-12-16
288090maintainer-feedback? security/vuxml: make validate warnings after update to new libxml2New2025-07-08
270795security maintainer-feedback? security/vuxml: taking port flavours into account in recent new entriesIn Progress2025-07-01

Commits (8,340)

Sergey A. Osokin (osa) · 1.1_6
security/vuxml: document gdk-pixbuf2 vulnerability
a3ec65f531
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: add dns/powerdns-recursor entry for CVE-2025-30192

PR:		288384
Reported by:	Ralf van der Enden <tremere@cainites.net>
Obtained from:	https://blog.powerdns.com/powerdns-security-advisory-2025-04
ee336d3065
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document gitlab vulnerabilities
33e4ed62ad
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add sqlite3 vulnerability

CVE-2025-6965
723a9561ff
Max Brazhnikov (makc) · 1.1_6
security/vuxml: Document 7-zip vulnerability

Prompted by:	asomers@
9cbd5217b0
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Adjust affected versions for openh264 (CVE-2025-27091)

Adjust range to since port uses PORTEPOCH

Fixes:		13dd451
6599ca7e49
Sergey A. Osokin (osa) · 1.1_6
security/vuxml: document libwasmtime vulnerability
b71de8a92c
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document unbound cache poisoning via the ECS-enabled rebirthday attack

PR:		288276
Reported by:	Jaap Akkerhuis <jaap@NLnetLabs.nl>
3fc96e7182
Michael Osipov (michaelo) · 1.1_6
security/vuxml: Fix ranges for Tomcat vulnerabilities

Approved by:	otis (mentor), jbeich, vvd (maintainer)
Differential Revision:	https://reviews.freebsd.org/D51323
8cc2e449b7
Matthias Andree (mandree) · 1.1_6
security/vuxml: libxml2 fixed version is 2.14.5.

Security:	abbc8912-5efa-11f0-ae84-99047d0a6bcc
3483eb3689
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document liboqs vulnerability
6835014812
Tijl Coosemans (tijl) · 1.1_6
security/vuxml: Document GnuTLS SA 2025-07-08
0fd8c06347
Matthias Andree (mandree) · 1.1_6
security/vuxml: extend libxml2/libxslt vuln to linux-* ports
fa129ae393
Matthias Andree (mandree) · 1.1_6
textproc/libxml2, textproc/libxslt: vulnerable

Note that libxslt is vulnerable, unfixed, and without maintainer.
Two of four vulnerabilities have been fixed.

Note that libxml2 in our ports is vulnerable and there is no upstream
release fixing these bugs, they need cherry-picks.

Deprecate textproc/xmlto and textproc/minixmlto,
which both depend on the unmaintained and vulnerable libxslt.
I have filed https://pagure.io/xmlto/issue/15 to ask the xmlto
upstream to switch to different XML/XSLT libraries.

Two issues are undisclosed and do not seem to have a CVE assigned yet.

Security:	CVE-2025-6021
Security:	CVE-2025-6170
Security:	CVE-2025-7424
Security:	CVE-2025-7425
Security:	CVE-2025-49794
Security:	CVE-2025-49795
Security:	CVE-2025-49795
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/913
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/926
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/931
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/932
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/933
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/935
Security:	https://gitlab.gnome.org/GNOME/libxml2/-/issues/941
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
Security:	https://gitlab.gnome.org/GNOME/libxslt/-/issues/148
Security:	https://gitlab.gnome.org/Teams/Releng/security/-/wikis/2025#libxml2-and-libxslt
Security:	https://www.openwall.com/lists/oss-security/2025/06/16/6
dceb46fc8a
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document mod_http2 vulnerabilities
88df7e7efe
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document Apache httpd vulnerabilities
f29f9d6723
Sergey A. Osokin (osa) · 1.1_6
security/vuxml: document tomcat vulnerabilities
e021f7c2c5
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document gitlab vulnerabilities
15e5b4c727
Renato Botelho (garga) · 1.1_6
security/vuxml: Add multiple git vulnerabilities

* CVE-2025-27613
* CVE-2025-27614
* CVE-2025-46835
* CVE-2025-48384
* CVE-2025-48385
* CVE-2025-48386

Sponsored by:	Rubicon Communications, LLC ("Netgate")
1bd91518d5
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Fix mongodb entry

Remove mongodb80 entry since it is not affected.

Reported by:	ronald-lists@klop.ws
Fixes:		fbefcec73997
22962d7e27
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add mongodb* vulnerabilities

* CVE-2025-6711
 * CVE-2025-6712
 * CVE-2025-6713
 * CVE-2025-6714
 * CVE-2025-7259
fbefcec739
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add ModSecurity vulnerability

* CVE-2025-52891
661a3ac7ab
Yasuhiro Kimura (yasu) · 1.1_6
security/vuxml: Document multiple vlunerabilities in redis and valky
c3574ad8eb
Philip Paeps (philip) · 1.1_6
security/vuxml: add FreeBSD SA issued on 2025-07-02

FreeBSD-SA-25:06.xz affects FreeBSD 13.5 and FreeBSD 14.2
cef2c7afb0
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Document multimedia/gstreamer1-plugins-bad < 1.26.3
992f07a292
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add Mozilla vulnerabilities

* CVE-2025-6425
 * CVE-2025-6427
 * CVE-2025-6429
 * CVE-2025-6430
 * CVE-2025-6432
 * CVE-2025-6433
 * CVE-2025-6434
 * CVE-2025-6435
 * CVE-2025-6436
bd589649ee
Muhammad Moinur Rahman (bofh) · 1.1_6
security/vuxml: Add CVE for php8*
1436209d3f
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add Mozilla vulnerability
54b6bc71d6
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 138.0.7204.96

Obtained from:	https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html
Obtained from:	https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html
69acfe4b62
Matthias Andree (mandree) · 1.1_6
security/vuxml: sudo<1.9.17p1 privilege escalation

PR:		287938
Security:	24f4b495-56a1-11f0-9621-93abbef07693
Security:	CVE-2025-32462
Security:	CVE-2025-32463
04e87de39e
Emmanuel Vadot (manu) · 1.1_6
security/vuxml: Add entries for xorg/xwayland latest vulnerabilities
9e7bed5caa
Sergey A. Osokin (osa) · 1.1_6
security/vuxml: document sysutils/podman vulnerability
918bf3196e
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add mongodb vulnerabilities

* CVE-2025-6706
 * CVE-2025-6707
 * CVE-2025-6709
 * CVE-2025-6710
86e2b9b62c
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add kanboard vulnerability

* CVE-2025-52560
 * CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
120ea66801
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document gitlab vulnerabilities
f32d513cd8
Koichiro Iwao (meta) · 1.1_6
security/vuxml: fix spelling mistakes

Fixes: 986be61969

Pull Request:	https://github.com/freebsd/freebsd-ports/pull/396
641e1a6e77
Daniel Engberg (diizzy) · 1.1_6
security/vuxml: Add openh264 vulnerability

Document CVE-2025-27091
13dd4512a5
Charlie Li (vishwin) · 1.1_6
security/vuxml: adjust affected textproc/libxml2 versions

Account for all branches' minor versions with fixes and local
backports to 2.11.

PR: 287391
516ddee744
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add clamav vulnerabilities

* CVE-2025-20234
 * CVE-2025-20260

PR:		287672
Reported by:	Christos Chatzaras <chris@cretaforce.gr>
879b284c39
Don Lewis (truckman) · 1.1_6
x11/yelp: update to 42.3

Update to 42.3 and fix CVE-2025-3155 vulnerability

PR:		287543
MFH:		2025Q2
Security:	0e200a73-289a-489e-b405-40b997911036
13e2a05565
Don Lewis (truckman) · 1.1_6
textproc/yelp-xsl: Upgrade to 42.4

Upgrade yelp-xsl to 42.4 and fix CVE-2025-3155 vulnerability.

PR:		287542
MFH:		2025Q2
Security:	9449f018-84a3-490d-959f-38c05fbc77a7
10c9aa0a58
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 137.0.7151.119

Obtained from:	https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html
3158494c2f
Kevin Bowling (kbowling) · 1.1_6
security/vuxml: Add multimedia/navidrome CVE-2025-48949
732f58a223
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add grafana vulnerability

While here, correct versions for a previous grafana entry.

PR:		287634
Reported by:	Boris Korzun <drtr0jan@yandex.ru>
49fd60e6a2
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add firefox vulnerabilities

* CVE-2025-49709
 * CVE-2025-49710
e7cc140856
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 137.0.7151.103

Obtained from:	https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html
Obtained from:	https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html
1c919c5a34
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Fix file validation

Reformat a couple of entries
763127b6b6
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Add Mozilla vulnerabilities

* CVE-2025-2817
fa2ada4b85
Jimmy Olgeni (olgeni) · 1.1_6
security/vuxml: Document CVE-2024-12828 (CGI Command Injection RCE in webmin)
a3a5f02d91
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Fix make validate

After a clean.

PR:		287479
Reported by:	dvl@ lwhsu@
Fixes:		3c9a11c9111b
825f582e76
« newest← newerpage 14 of 167older →oldest »