CVE and update status of the FreeBSD ports tree3,611 unaddressed CVEs in 710 portsAll times are CET
Port details

security/vuxml 1.1_6

Vulnerability and eXposure Markup Language DTD

0
unaddressed
0
VuXML only
0
fixed
5
open problem reports

Port info

Maintainer
ports-secteam@FreeBSD.org
Packages
latest: 1.1_6
Upstream
up to date
Last update
to 1.1_6 · 99e0fd1e6e
Quarterly
2026Q4: 1.1_6
WWW
https://vuxml.freebsd.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install vuxml
installs 1.1_6 from latest; from quarterly (2026Q4) 1.1_6
Port
# cd /usr/ports/security/vuxml && make install clean
Size
9.7 KiB download · 40 KiB installed
Depends on
lang/python312 3.12.15, textproc/libxslt 1.1.45, textproc/xhtml-basic 1.0.20001219_2, textproc/xhtml-modularization 1.0.20010410_1, textproc/xmlcatmgr 2.2_4
License
BSD2CLAUSE

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.1_61.1_6–
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.1_61.1_6–
FreeBSD 141.1_61.1_61.1_6

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.1_6.

Fixed (0)

No VuXML entries for this package.

Problem reports (5) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
295797maintainer-feedback? security/vuxml: fix nginx ranges vulnerable to CVE-2026-9256In Progress2026-07-17
295836maintainer-feedback? security/vuxml: Multiple vulnerabilities in py-djangoNew2026-06-04
291717security/vuxml: add entry for uriparser < 1.0.0New2025-12-16
288090maintainer-feedback? security/vuxml: make validate warnings after update to new libxml2New2025-07-08
270795security maintainer-feedback? security/vuxml: taking port flavours into account in recent new entriesIn Progress2025-07-01

Commits (8,341)

Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document TinyMCE vulnerability

* Note that www/tinymce is not affected
 * Document supply-chain vuln in Roundcube
6580c2aea5
Craig Leres (leres) · 1.1_6
security/vuxml: Mark zeek < 6.0.3 as vulnerable as per:

https://github.com/zeek/zeek/releases/tag/v6.0.3

This release fixes the following potential DoS vulnerability:

 - A specially-crafted series of packets containing nested MIME
   entities can cause Zeek to spend large amounts of time parsing
   the entities.

Reported by:	Tim Wojtulewicz
0922b4e467
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron26 uut of bounds memory access in V8

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.7
63d40e7069
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: mark electron26 < 26.6.6, electron27 < 27.2.4 as vulnerable

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.6,
		https://github.com/electron/electron/releases/tag/v27.2.4
8c25030c14
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron27 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.2.3
e32cceef0b
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 120.0.6099.224

Obtained from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html

(cherry picked from commit 105eebecb78a6fcd68b0477fb8ec502a9df29ef2)
133e043913
Jan Beich (jbeich) · 1.1_6
security/vuxml: add xwayland-devel to 62bb32d7090f list
ce5247469a
Emmanuel Vadot (manu) · 1.1_6
security/vuxml: Document xorg-server and xwayland recent vulnerabilities

Sponsored by:	Beckhoff Automation GmbH & Co. KG
62bb32d709
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron{26,27} multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.5,
		https://github.com/electron/electron/releases/tag/v27.2.2
38706004d1
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document gitlab vulnerabilities
dcc5fdc172
Bernard Spil (brnrd) · 1.1_6
security/vuxml: Document OpenSSL ppc vulnerability
a15fd2712c
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 120.0.6099.216

Obtained from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_9.html
6bddc6bb2c
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Fix copypasta typo
7e5e345195
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Document QtNetwork buffer overflow

An issue was discovered in the HTTP2 implementation in Qt before 5.15.17,
6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before
6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer
overflow check.

Base Score:	9.8 CRITICAL
Vector:		CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
06b20337d2
Dan Langille (dvl) · 1.1_6
security/vuxml: add databases/mantis-php* < 2.25.8

Obtained from https://mantisbt.org/bugs/changelog_page.php?version_id=370

PR:		276146
facd1dc023
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 120.0.6099.199

Obtained from:	https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html
ec95be650a
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron27 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v27.2.1
a348236886
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron26 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.4
fb1198c68e
Philip Paeps (philip) · 1.1_6
security/vuxml: add FreeBSD SA released on 2023-12-19

FreeBSD-SA-23:19.openssl affects all supported releases of FreeBSD.

FreeBSD 12.4 reached its end of life at the end of December 2023.  Users
are encouraged to either implement the documented workaround or leverage
an up to date version of OpenSSH from the ports/pkg collection.
389df91bd8
Philip Paeps (philip) · 1.1_6
security/vuxml: add 2024 entity
4c4ab6b76e
Matthias Andree (mandree) · 1.1_6
security/vuxml: unexpand spaces for gitea 482bb980-99a3-11ee-b5f7-6bd56600d90c
eeff9fa94b
Matthias Andree (mandree) · 1.1_6
security/vuxml: extend openvpn vuln entry to openvpn-devel < g20231109,1

Security:	2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security:	CVE-2023-46849
Security:	CVE-2023-46850
2502b341e2
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Add www/qt5-webengine

qt5-webengine < 5.15.16.p5_2 is also affected by the following VuXML
IDs:

- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6
9d4c814719
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Add www/qt6-webengine

qt6-webengine < 6.6.1_1 is also affected by the following VuXML IDs:

- 8cdd38c7-8ebb-11ee-86bb-a8a1599412c6
- 4405e9ad-97fe-11ee-86bb-a8a1599412c6
888831cdaf
Muhammad Moinur Rahman (bofh) · 1.1_6
devel/zookeeper: Update version 3.8.1=>3.8.3

- Fixes critical security vulnerability
- Return to pool
- Add entry in vuxml

PR:		275999
Approved by:	submitter is maintainer
0257d72435
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v26.6.3,
		https://github.com/electron/electron/releases/tag/v27.2.0
ee17b11179
Muhammad Moinur Rahman (bofh) · 1.1_6
www/gitea: Update version 1.21.0=>1.21.3

- Add relevant vuxml entry
- Move pkg-message to SUB_FILES as we are using PREFIX

Changelog: https://blog.gitea.com/release-of-1.21.3/

PR:		275742
Approved by:	submitter is maintainer
478a7fab1a
Ashish SHUKLA (ashish) · 1.1_6
security/vuxml: document nebula vulnerability
7e2a8f34d2
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 120.0.6099.129

Obtained from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_20.html
aef8b57b10
Matthias Andree (mandree) · 1.1_6
security/vuxml: add security/putty[-nogtk] < 0.80 'Terrapin' vulnerability

Security:	91955195-9ebb-11ee-bc14-a703705db3a6
Security:	CVE-2023-48795
09132c0a59
Thierry Thomas (thierry) · 1.1_6
security/vuxml: add an entry for slurm-wlm
28c7ef249c
Dave Cottlehuber (dch) · 1.1_6
security/vuxml: add CouchDB CVE details

Security:	CVE-2023-26268
Sponsored by:	SkunkWerks, GmbH
7d1842192d
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document gitlab vulnerabilities
de63c2ea47
Philip Paeps (philip) · 1.1_6
security/vuxml: adjust 12.4 range of FreeBSD SA-23:17.pf

Similar to what I did in 4826396e5d1555b9eebf58cac290490b24bf1243,
adjust the 12.4 releases affected by FreeBSD SA-23:17.pf.

There is no 100% correct way to encode this issue in vuxml.  Since the
issue only affects pf.ko, freebsd-update does not rebuild the kernel.

PR:		275743
Reported by:	martin@lispworks.com
6c7887d34c
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 120.0.6099.109

Obtained from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop_12.html
091b60b659
Philip Paeps (philip) · 1.1_6
security/vuxml: add FreeBSD SA released on 2023-12-12

FreeBSD-SA-23:18.nfsclient affects FreeBSD 14.0 and 13.2.
8175693fe6
Jan Beich (jbeich) · 1.1_6
security/vuxml: mark xorg-server < 21.1.10,1 as vulnerable
98a038ac18
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 120.0.6099.62

Obtained from:	https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html
5f9cf6817f
Fernando Apesteguía (fernape) · 1.1_6
secuirty/vuxml: Remove duplicate entry

A previous entry for CVE-2023-41913 was added in
8c6ee1a1c2df0d7a769c1fd50f0366ded3798e86

PR:		275620
Reported by:	eugen@
Fixes:		eea55ca7b5c621fd4f032b1f256b8472fbae2b15
3af42e8b0f
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Record kafka vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Apache
ZooKeeper.

Note that this only affects SASL Quorum Peer authentication which is
not enabled by default.

 Base Score:	9.1 CRITICAL
 Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

PR:	275611
a991db5e17
Fernando Apesteguía (fernape) · 1.1_6
security/vuxml: Record strongswan buffer overflow

strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated
remote code execution via a DH public value that exceeds the internal buffer in
charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can
occur via a crafted IKE_SA_INIT message.

NVD score not yet provided.

PR:	275620
eea55ca7b5
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron25 multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.8
48aec35754
Philip Paeps (philip) · 1.1_6
security/vuxml: correct last SA's affected range

FreeBSD-SA-23:17.pf only affects the kernel, not userland.  The first
patch level of the kernel without the vulnerability is 13.2_4, not
13.2_7.

Reported by:	dvl
4826396e5d
Philip Paeps (philip) · 1.1_6
security/vuxml: add FreeBSD SA released on 2023-12-05

FreeBSD-SA-23:17.pf affects all supported releases (12.4, 13.2, 14.0).
a580d36be4
Danilo G. Baio (dbaio) · 1.1_6
security/vuxml: Add Varnish Cache vulnerability
4e03e6d862
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Add www/qt6-webengine

qt6-webengine < 6.6.1 is also affected by the following VuXML IDs:
- 6d9c6aae-5eb1-11ee-8290-a8a1599412c6
- 07ee8c14-68f1-11ee-8290-a8a1599412c6
- a1e27775-7a61-11ee-8290-a8a1599412c6
- 0da4db89-84bf-11ee-8290-a8a1599412c6
895d7f8424
Matthias Fechner (mfechner) · 1.1_6
security/vuxml: document gitlab vulnerabilities
02e766d138
Hiroki Tagato (tagattie) · 1.1_6
security/vuxml: document electron multiple vulnerabilities

Obtained from:	https://github.com/electron/electron/releases/tag/v25.9.7,
		https://github.com/electron/electron/releases/tag/v26.6.2
05b3e355a7
Robert Nagy (rnagy) · 1.1_6
security/vuxml: add www/*chromium < 119.0.6045.199

Obtained from:	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html
12995b6213
Jason E. Hale (jhale) · 1.1_6
security/vuxml: Add devel/cmake-core

VuXML ID d6c19e8c-6806-11ee-9464-b42e991fc52e also affects the bundled
libcurl in devel/cmake-core < 3.27.8.
966f41c828
« newest← newerpage 25 of 167older →oldest »