security/vuxml: add three CVEs for qmail PR: 245010 Submitted by: erdgeist@erdgeist.orgedb06bed14
Port details
security/vuxml 1.1_6
Vulnerability and eXposure Markup Language DTD
Port info
- Maintainer
- ports-secteam@FreeBSD.org
- Packages
- latest: 1.1_6
- Upstream
- up to date
- Last update
- to 1.1_6 · fa646dcabe
- Quarterly
- 2026Q4: 1.1_6
- WWW
- https://vuxml.freebsd.org/
- Links
- cgit · VuXML · Report wrong data
Install
- Package
# pkg install vuxmlinstalls 1.1_6 fromlatest; fromquarterly(2026Q4) 1.1_6- Port
# cd /usr/ports/security/vuxml && make install clean- Size
- 9.7 KiB download · 40 KiB installed
- License
- BSD2CLAUSE
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 1.1_6 | 1.1_6 | – |
| FreeBSD 15 | 1.1_6 | 1.1_6 | – |
| FreeBSD 14 | 1.1_6 | 1.1_6 | 1.1_6 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 1.1_6 | 1.1_6 | – |
| FreeBSD 14 | 1.1_6 | 1.1_6 | 1.1_6 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Dependencies
Depends on 5
- lang/python312 3.12.15 12 unaddressed
- textproc/libxslt 1.1.45
- textproc/xhtml-basic 1.0.20001219_2
- textproc/xhtml-modularization 1.0.20010410_1
- textproc/xmlcatmgr 2.2_4
Run and library dependencies of the package on latest. Build dependencies are not in the package index.
Required by 0
No package on latest depends on it.
Packages on latest that depend on it directly.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 1.1_6.Fixed (0)
No VuXML entries for this package.
Problem reports (5) · open in Bugzilla, most recently changed first
| PR | Summary | Status | Changed |
|---|---|---|---|
| 295797 | maintainer-feedback? security/vuxml: fix nginx ranges vulnerable to CVE-2026-9256 | In Progress | 2026-07-17 |
| 295836 | maintainer-feedback? security/vuxml: Multiple vulnerabilities in py-django | New | 2026-06-04 |
| 291717 | security/vuxml: add entry for uriparser < 1.0.0 | New | 2025-12-16 |
| 288090 | maintainer-feedback? security/vuxml: make validate warnings after update to new libxml2 | New | 2025-07-08 |
| 270795 | security maintainer-feedback? security/vuxml: taking port flavours into account in recent new entries | In Progress | 2025-07-01 |
Commits (8,349)
Document new vulnerabilities in www/chromium 83.0.4103.61. The website is somewhat crippled and does not show the full text.1ac21e9294
Add entry for piwigo PR: 245153 Sponsored by: Netzkommune GmbH46f0b44116
Add entry for tomcat PR: 246657 Sponsored by: Netzkommune GmbH9949ad3969
Document unbound multiple vulnerabilities.dfdd204645
Add entry for drual7 Sponsored by: Netzkommune GmbHdce7bae92d
security/vuxml: Document net-mgmt/zabbix3 issue Security: CVE-2020-11800eff322ffc2
Document rails vulnerability18a2f8fe48
- Document CVE-2019-18348, CVE-2020-8492 for python386148c15c0a
security/vuxml: Report multiple dovecot vulnerabilities.361f82f61c
- Document security/clamav vulnerabilities10b524a0c8
Update json-c vulnerability - While I'm here, fix format json-c 0.14 will land the ports tree along with the fix, thus I change it to 0.14. PR: 2463897b5a976e87
Document rails vulnerability17ab85f625
security/vuxml: MariaDB vulnerabilities3b17c3bb6d
Add new sysutils/py-salt vulnerabilities PR: 246061 Reported by: Christer Edwards <christer.edwards@gmail.com> Security: CVE-2020-11651 Security: CVE-2020-1165243d33dee1e
devel/json-c: CVE-2020-12762 integer overflow, out of bounds write Reported by: Daniel Engberg Security: abc3ef37-95d4-11ea-9004-25fadb81abf4 Security: CVE-2020-127623df236a10e
Document typo3 vulnerabilityb2cec66348
Add proper links for the html output of vuln.xml. Add freebsdsa as a proper type. Correct link to CVEs. Reviewed by: gjb, joneum Approved by: ports-secteam (joneum) Differential Revision: https://reviews.freebsd.org/D2482439d5870ef6
Add data for today's SA batch. Approved by: sob2c9165dda
security/vuxml: log www/qutebrowser CVE-2020-11054e8227b3255
- Document python27 CVE-2019-1834820213aaeac
add entry for www/glpi PR: 244971 Sponsored by: Netzkommune GmbH43b562db3b
mail/mailman: extend content injection vuln via private archive login This led up to mailman 2.1.33 today. https://bugs.launchpad.net/mailman/+bug/1877379 https://launchpadlibrarian.net/478684932/private.diff https://mail.python.org/archives/list/mailman-developers@python.org/thread/SYBIZ3MNSQZLKN6PVKO7ZKR7QMOBMS45/ Approved by: ports-secteam@ (blanket for security fixes) Security: 88760f4d-8ef7-11ea-a66d-4b2ef158be83d452bd5214
security/vuxml: Mark zeek < 3.0.6 as vulnerable as per: https://raw.githubusercontent.com/zeek/zeek/v3.0.6/NEWS Various issues including buffer over-reads, uninitialized field access, memory leak, and stack overflows.6693a6cc6d
security/vuxml: Update discovery date for CVE-2020-1730 Update discovery date for CVE-2020-1730 based on information obtained from the libssh team. Approved by: gerald (mentor)1f3ff13568
Document wagtail vulnerabilitybef0d42cc8
Permit mail/mailman vulnerability to be fixed in 2.1.30_3 already ...not in 2.1.31 only. We can't just easily backport 2.1.31 to 2020Q2. Security: 88760f4d-8ef7-11ea-a66d-4b2ef158be83ad46e9faf2
new mailman < 2.1.31 content injection vulnerability similar to CVE-2018-13796 (not sure if they'll reuse that no. so not including in Security: tags below) https://bugs.launchpad.net/mailman/+bug/1873722 Security: 88760f4d-8ef7-11ea-a66d-4b2ef158be8391ed5be3f2
Fix version range for 97fcc60a-6ec0-11ea-a84a-4c72b94353b5: phpMyAdmin 4.9.5 is not vulnerable PR: 245096a045ce5091
security/vuxml: Document net-mgmt/cacti issue PR: 246164 Submitted by: Michael Muenz <m.muenz@gmail.com> Security: CVE-2020-7106d22251ada7
security/vuxml: add squid 4.10 CVEs PR: 245433 Submitted by: Michael Muenz <m.muenz@gmail.com>c7a41e7f21
Document audio/taglib vulnerability5683f79841
Documented gitlab vulnerabilities.d3bbfe7f89
security/vuxml: Add other flavors of py-yamlc4c3df9241
Document multimedia/vlc vulnerabilities Security: CVE-2019-19721 CVE-2020-6071 CVE-2020-6072 CVE-2020-6073 CVE-2020-6077 CVE-2020-6078 CVE-2020-60797fd5dedca8
Add an entry about CVE-2020-10700, CVE-2020-10704 in samba410 and 411. Security: CVE-2020-10700 CVE-2020-10704d67c866de0
net/ceph14: document CVE-2020-1759, CVE-2020-17602143ae2280
Document OpenLDAP CVE-2020-12243. PR: 213895 Submitted by: rob2g2 <spam123 bitbert com>786d66495b
Add entry for py-yaml vulnerabilityf1522ac876
security/vuxml: Document www/py-bleach issue PR: 245943 Security: CVE-2020-681750a60f5294
security/vuxml: MySQL Server 2020Q2 vulnerabilities7998a7390e
security/vuxml: MySQL client 2020Q2 vulnerabilities563885986e
security/vuxml: Register Nextcloud vulnerabilities6439d98302
security/vuxml: Document lang/python issue PR: 245819 Security: CVE-2020-8492209edc046d
Document wagtail vulnerabilityca9b18faeb
11.3 isn't vulenrable to the recent OpenSSL vulnerability. Approved by: so X-Pointy-Hat to: gordonba57297ee6
security/vuxml: Restore openssl port version range to the 2020-04-21 entry I tested that this passes "make validate" and correctly flags openssl-1.1.1f,1 as vulnerable. Approved by: gjbc7c77d9550
Revert r532466, adding back 'FreeBSD' to the topic. Sponsored by: Rubicon Communications, LLC (netgate.com)02d3f925ff
The vuxml build is now fixed. Remove the 'ignore' block and its contents. Sponsored by: Rubicon Communications, LLC (netgate.com)e4d380a27a
Comment the second name tag, which I believe is what is causing the vuxml build to fail. If I am wrong, I will revert this commit. Sponsored by: Rubicon Communications, LLC (netgate.com)97c7d97fdc