Port details

security/vuxml 1.1_6

Vulnerability and eXposure Markup Language DTD

unaddressed

VuXML only

fixed

open problem reports

Port info

Maintainer: ports-secteam@FreeBSD.org
Packages: latest: 1.1_6
Upstream: up to date
Last update: 2026-10-29 to 1.1_6 · 898db4939a
Quarterly: 2026Q4: 1.1_6
WWW: https://vuxml.freebsd.org/
CPE: not set in the port, and none could be determined — that does not mean none exists
Links: cgit · VuXML · Report wrong data

Install

Package

# pkg install vuxml

installs 1.1_6 from latest; from quarterly (2026Q4) 1.1_6

Port

# cd /usr/ports/security/vuxml && make install clean

Size

9.7 KiB download · 40 KiB installed

License

BSD2CLAUSE

Packages by version and architecture

latest

FreeBSD version	amd64	aarch64	i386
FreeBSD 16	1.1_6	1.1_6	–
FreeBSD 15	1.1_6	1.1_6	–
FreeBSD 14	1.1_6	1.1_6	1.1_6

quarterly (2026Q4)

FreeBSD version	amd64	aarch64	i386
FreeBSD 15	1.1_6	1.1_6	–
FreeBSD 14	1.1_6	1.1_6	1.1_6

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Dependencies

Depends on 5

lang/python312 3.12.15 25 unaddressed
textproc/libxslt 1.1.45
textproc/xhtml-basic 1.0.20001219_2
textproc/xhtml-modularization 1.0.20010410_1
textproc/xmlcatmgr 2.2_4

Run and library dependencies of the package on latest. Build dependencies are not in the package index.

Required by 0

No package on latest depends on it.

Packages on latest that depend on it directly.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.1_6.

Fixed (0)

No VuXML entries for this package.

Problem reports (6) · open in Bugzilla, most recently changed first

PR	Summary	Status	Changed
300264	maintainer-feedback? security/vuxml: correct double-encoded UTF-8 in Spotipy entry c3fb48cc	In Progress	2026-10-29
295797	maintainer-feedback? security/vuxml: fix nginx ranges vulnerable to CVE-2026-9256	In Progress	2026-07-17
295836	maintainer-feedback? security/vuxml: Multiple vulnerabilities in py-django	New	2026-06-04
291717	security/vuxml: add entry for uriparser < 1.0.0	New	2025-12-16
288090	maintainer-feedback? security/vuxml: make validate warnings after update to new libxml2	New	2025-07-08

Show all 6

PR	Summary	Status	Changed
270795	security maintainer-feedback? security/vuxml: taking port flavours into account in recent new entries	In Progress	2025-07-01

Commits (8,355)

2016-08-06 02:24Jason Unovitch (junovitch) · 1.1_3

Document wnpa-sec-2016-41 through wnpa-sec-2016-49 for issues fixed in Wireshark 2.0.5

Security:	CVE-2016-6505
Security:	CVE-2016-6506
Security:	CVE-2016-6508
Security:	CVE-2016-6509
Security:	CVE-2016-6510
Security:	CVE-2016-6511
Security:	CVE-2016-6512
Security:	CVE-2016-6513
Security:	https://vuxml.FreeBSD.org/freebsd/610101ea-5b6a-11e6-b334-002590263bf5.html

af602cbde3

2016-08-05 19:15Mark Felder (feld) · 1.1_3

Update perl vuxml entries

Perl package names changed somewhat recently, so add more <name> entries
to improve coverage for users on systems with outdated ports/packages

PR:		211561

fbf8ca0628

2016-08-05 18:08Mark Felder (feld) · 1.1_3

Cancel tiff vuxml entry for CVE-2016-5102

Upstream has marked it WONTFIX and is removing the utility in 4.0.7.
There is no indication that this bug does anything other than crash the
utility.

0e6ec45fa9

2016-08-05 15:54Mark Felder (feld) · 1.1_3

Update vuxml entry for perl to correct range for perl5-devel

bbbd5f4eba

2016-08-04 20:19Mark Felder (feld) · 1.1_3

Fix vuxml entry for recent perl vulnerabilities to correctly match package names

PR:		211561

a05e377926

2016-08-04 20:12Mark Felder (feld) · 1.1_3

Document p5-XSLoader vulnerability

PR:		211561
Security:	CVE-2016-6185

14b933b2c1

2016-08-04 19:52Mark Felder (feld) · 1.1_3

Document perl vulnerability

PR:		211561
Security:	CVE-2016-1238

3f7cf88040

2016-08-04 16:49Mark Felder (feld) · 1.1_3

Document gd vulnerabilities

PR:		211562

0ab1f3e273

2016-08-04 16:33Mark Felder (feld) · 1.1_3

Document curl vulnerabilities

PR:		211575

d0c0311f75

2016-08-03 16:54Mark Felder (feld) · 1.1_3

Document lighttpd vulnerabilities

PR:		211495

49ed97e03d

2016-08-02 04:07Jason Unovitch (junovitch) · 1.1_3

Document Xen Security Advisories (XSAs 182, 183, and 184)

PR:		211482
Security:	CVE-2016-5403
Security:	CVE-2016-6259
Security:	CVE-2016-6258
Security:	https://vuxml.FreeBSD.org/freebsd/06574c62-5854-11e6-b334-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/04cf89e3-5854-11e6-b334-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/032aa524-5854-11e6-b334-002590263bf5.html

41d49416dc

2016-07-31 17:14Jason Unovitch (junovitch) · 1.1_3

Document security issues fixed Libidn 1.33

PR:		211407
Reported by:	Piotr Kubaj <pkubaj@anongoth.pl>
Security:	CVE-2015-8948
Security:	CVE-2016-6261
Security:	CVE-2016-6262
Security:	CVE-2016-6263
Security:	https://vuxml.FreeBSD.org/freebsd/cb5189eb-572f-11e6-b334-002590263bf5.html

56365fadf7

2016-07-29 09:30Christoph Moench-Tegeder (cmt) · 1.1_3

document Gimp XCF loader vulnerability

Approved by:	rene (mentor)

9f840f3eec

2016-07-27 03:54Cy Schubert (cy) · 1.1_3

With the release of krb5 1.13.6, which also fixes the KDC denial of service vulnerability (CVE-2016-3120 -- same vulnerability fixed in krb5 1.14.3), update entry 62d45229-4fa0-11e6-9d13-206a8a720317 to also document the same in krb5 1.13.6.

Security:	62d45229-4fa0-11e6-9d13-206a8a720317
Security:	CVE-2016-3120

2f904300b4

2016-07-26 18:03Mark Felder (feld) · 1.1_3

Document xerces-c3 vulnerabilities

PR:		211023
Security:	CVE-2016-2099
Security:	CVE-2016-4463

05a4fe758b

2016-07-26 16:58Mark Felder (feld) · 1.1_3

Document php vulnerabilities

Security:	CVE-2015-8879
Security:	CVE-2016-5385
Security:	CVE-2016-5399
Security:	CVE-2016-6288
Security:	CVE-2016-6289
Security:	CVE-2016-6290
Security:	CVE-2016-6291
Security:	CVE-2016-6292
Security:	CVE-2016-6294
Security:	CVE-2016-6295
Security:	CVE-2016-6296
Security:	CVE-2016-6297

45212f84f7

2016-07-22 22:30Rene Ladan (rene) · 1.1_3

Document new vulnerabilities in www/chromium < 52.0.2743.82

Obtained from:	https://googlechromereleases.blogspot.nl/2016/07/stable-channel-update.html

630bc7e88a

2016-07-22 02:22Cy Schubert (cy) · 1.1_3

Document a rare KDC denial of service vulnerability when anonymous client principals are restricted to obtaining TGTs only [CVE-2016-3120]

URL:		http://web.mit.edu/kerberos/krb5-1.14/
Security:	CVE-2016-3120

79ef2068a9

2016-07-21 20:25Bernard Spil (brnrd) · 1.1_3

security/vuxml: Current mysql57 is NOT vulnerable

PR:		211248

1f594365ae

2016-07-21 20:04Don Lewis (truckman) · 1.1_3

Apache OpenOffice CVE-2016-1513 Memory Corruption Vulnerability (Impress Presentations)

8b5a947df8

2016-07-21 16:58Bernard Spil (brnrd) · 1.1_3

security/vuxml: Add MySQL vulnerabilities from quarterly update

- Add MariaDB ports
  - Add Percona ports

PR:		211248

ac8636cbcb

2016-07-21 16:23Mark Felder (feld) · 1.1_3

Properly cancel the httpoxy vuxml entry

127cac6112

2016-07-20 14:25Mark Felder (feld) · 1.1_3

Remove HTTPoxy entry in vuxml until a we know if upstream vendors will patch this so things aren't marked vulnerable forever.

195ec0cc01

2016-07-19 14:55Torsten Zuehlsdorff (tz) · 1.1_3

www/typo3 and www/typo3-lts: Document missing access check in Extbase

PR:          210870, 210871
Security:    CVE-2016-5091
Security:    https://vuxml.freebsd.org/freebsd/3caf4e6c-4cef-11e6-a15f-00248c0c745d.html
Approved by: junovitch (mentor)

e9db627b0d

2016-07-19 08:43Bernard Spil (brnrd) · 1.1_3

net/haproxy: Mark vulnerable to httpoxy in vuxml

Security:	cf0b5668-4d1b-11e6-b2ec-b499baebfeaf

2fe082806e

2016-07-18 22:38Bernard Spil (brnrd) · 1.1_3

lang/go: Mark 1.6.3 as NOT vulnerable to httpoxy

- Version 1.6.3 includes fix for "httpoxy" [1]

1: https://groups.google.com/forum/#!topic/golang-announce/7jZDOQ8f8tM

Security:	cf0b5668-4d1b-11e6-b2ec-b499baebfeaf
Security:	CVE-2016-5386

481e9059a7

2016-07-18 22:15Bernard Spil (brnrd) · 1.1_3

www/apache24: Fix httpoxy vulnerability (+2.2)

- Mark new Apache revisions not vulnerable
  - Add apache22-mpm-* ports
  - Add Apache CVE-number

Security:       cf0b5668-4d1b-11e6-b2ec-b499baebfeaf
Security:       CVE-2016-5387

a5d377885b

2016-07-18 21:47Bernard Spil (brnrd) · 1.1_3

httpoxy: Mark ports as vulnerable

- apache22, apache24, go, go14, php55, php56, php70, python27, python33,
    python34, python35, nginx are all vulnerable.
  - No new versions fixing the HTTP Proxy header vulnerability

ad747778af

2016-07-18 19:36Bryan Drewery (bdrewery) · 1.1_3

Fix CVE-2016-0772 entry to not blame only Python 2.7

7bf4bba509

2016-07-16 04:26Jason Unovitch (junovitch) · 1.1_3

Document security issues from ATutor 2.2.1 and 2.2.2 changelog

Security:	https://vuxml.FreeBSD.org/freebsd/00cb1469-4afc-11e6-97ea-002590263bf5.html
Security:	https://vuxml.FreeBSD.org/freebsd/ffa8ca79-4afb-11e6-97ea-002590263bf5.html

7c882984ea

2016-07-16 03:08Jason Unovitch (junovitch) · 1.1_3

Update Drupal SA-CORE-2016-002 with the assigned CVEs

PR:		210317
Security:	CVE-2016-6211
Security:	CVE-2016-6212
Security:	https://vuxml.FreeBSD.org/freebsd/7932548e-3427-11e6-8e82-002590263bf5.html

cbee3e20d3

2016-07-16 02:59Jason Unovitch (junovitch) · 1.1_3

Document Flash vulnerabilities in Adobe Security Bulletins APSB16-25

Security:	CVE-2016-4172
Security:	CVE-2016-4173
Security:	CVE-2016-4174
Security:	CVE-2016-4175
Security:	CVE-2016-4176
Security:	CVE-2016-4177
Security:	CVE-2016-4178
Security:	CVE-2016-4179
Security:	CVE-2016-4180
Security:	CVE-2016-4181
Security:	CVE-2016-4182
Security:	CVE-2016-4183
Security:	CVE-2016-4184
Security:	CVE-2016-4185
Security:	CVE-2016-4186
Security:	CVE-2016-4187
Security:	CVE-2016-4188
Security:	CVE-2016-4189
Security:	CVE-2016-4190
Security:	CVE-2016-4217
Security:	CVE-2016-4218
Security:	CVE-2016-4219
Security:	CVE-2016-4220
Security:	CVE-2016-4221
Security:	CVE-2016-4222
Security:	CVE-2016-4223
Security:	CVE-2016-4224
Security:	CVE-2016-4225
Security:	CVE-2016-4226
Security:	CVE-2016-4227
Security:	CVE-2016-4228
Security:	CVE-2016-4229
Security:	CVE-2016-4230
Security:	CVE-2016-4231
Security:	CVE-2016-4232
Security:	CVE-2016-4233
Security:	CVE-2016-4234
Security:	CVE-2016-4235
Security:	CVE-2016-4236
Security:	CVE-2016-4237
Security:	CVE-2016-4238
Security:	CVE-2016-4239
Security:	CVE-2016-4240
Security:	CVE-2016-4241
Security:	CVE-2016-4242
Security:	CVE-2016-4243
Security:	CVE-2016-4244
Security:	CVE-2016-4245
Security:	CVE-2016-4246
Security:	CVE-2016-4247
Security:	CVE-2016-4248
Security:	CVE-2016-4249
Security:	https://vuxml.FreeBSD.org/freebsd/a522d6ac-4aed-11e6-97ea-002590263bf5.html

c48847f6f6

2016-07-15 19:13Mark Felder (feld) · 1.1_3

Rename vuxml entry, add new detailed reference as primary.

This new reference has much more detailed information. It appears even
the latest version of struts is affected and this may affect many
products using the Apache Commons FileUpload Utility such as Jenkins,
Lucene-Solr, etc. Unfortunately it's difficult to identify which version
of the Apache Commons FileUpload Utility products may have, so this vuxml
may be expanded as more products are successfully identified.

PR:		211105
Security:	CVE-2016-3092

cba90a8663

2016-07-15 18:56Mark Felder (feld) · 1.1_3

Package name for jakarta-struts is actually apache-struts

Pointyhat:	me

PR:		211105

dcc5437b46

2016-07-15 18:54Mark Felder (feld) · 1.1_3

Also add jakara-struts to the vuxml entry for CVE-2016-3092

PR:		211105

af9d1e2a3a

2016-07-15 18:48Mark Felder (feld) · 1.1_3

Document tomcat vulnerability

PR:		211105
Security:	CVE-2016-3092

9b7e833b7b

2016-07-15 18:41Mark Felder (feld) · 1.1_3

Document libreoffice vulnerability

PR:		211111
Security:	CVE-2016-4324

b66440513f

2016-07-15 18:34Mark Felder (feld) · 1.1_3

Update name in vuxml of person who reported CVE-2016-5102

7eb73d63e7

2016-07-15 18:19Mark Felder (feld) · 1.1_3

Document tiff vulnerabilities

Security:	CVE-2016-5102
Security:	CVE-2016-5875
Security:	CVE-2016-3186

PR:		211113

34cd680a2d

2016-07-15 13:23Raphael Kubo da Costa (rakuco) · 1.1_3

Document CVE-2016-2334 and CVE-2016-2335 in archivers/p7zip.

PR:		211114

391c843c6c

2016-07-13 03:26Timur I. Bakeyev (timur) · 1.1_3

Add information about CVE-2016-2119 vulnerability in Samba suits.

Security:	CVE-2016-2119

4affeb6997

2016-07-11 17:31Torsten Zuehlsdorff (tz) · 1.1_3

rubygem-ruby-saml: Document XML signature wrapping attack

Security:    CVE-2016-5697
Security: https://vuxml.freebsd.org/freebsd/3fcd52b2-4510-11e6-a15f-00248c0c745d.html
Approved by: junovitch (mentor)

da1dcc09bf

2016-07-07 05:36Li-Wen Hsu (lwhsu) · 1.1_3

- Fix affected versions of qemu and qemu-devel

Reviewed by:	junovitch

5a3aed2a3d

2016-07-07 03:44Jason Unovitch (junovitch) · 1.1_3

Document remote denial of service in quassel

PR:		209218
Security:	CVE-2016-4414
Security:	https://vuxml.FreeBSD.org/freebsd/7d64d00c-43e3-11e6-ab34-002590263bf5.html

aa52556149

2016-07-05 19:59Olli Hauer (ohauer) · 1.1_3

- document apache24 H2/X509 sec. issue.

The sec. issue is only present if the port was built with
  non default settings (experimental H2 feature) and
  used in combination with X509 client auth!

b52cc06426

2016-07-04 21:02Jason Unovitch (junovitch) · 1.1_3

Document Xen Security Advisories (XSAs 173, 175, 176, 178, 179, and 180).

XSAs 171, 172, 174, and 181 are not applicable to FreeBSD.

Discussed with:	royger
Security:	CVE-2014-3672
Security:	CVE-2016-3710
Security:	CVE-2016-3712
Security:	CVE-2016-4963
Security:	CVE-2016-4480
Security:	CVE-2016-4962
Security:	CVE-2016-3960
Security:	https://vuxml.FreeBSD.org/freebsd/e800cd4b-4212-11e6-942d-bc5ff45d0f28.html
Security:	https://vuxml.FreeBSD.org/freebsd/e6ce6f50-4212-11e6-942d-bc5ff45d0f28.html
Security:	https://vuxml.FreeBSD.org/freebsd/e589ae90-4212-11e6-942d-bc5ff45d0f28.html
Security:	https://vuxml.FreeBSD.org/freebsd/e43b210a-4212-11e6-942d-bc5ff45d0f28.html
Security:	https://vuxml.FreeBSD.org/freebsd/e2fca11b-4212-11e6-942d-bc5ff45d0f28.html
Security:	https://vuxml.FreeBSD.org/freebsd/d51ced72-4212-11e6-942d-bc5ff45d0f28.html

84f4a8e508

2016-07-04 15:40Jason Unovitch (junovitch) · 1.1_3

Update wnpa-sec-2016-12 through wnpa-sec-2016-18 with CVE assignment for issues fixed in Wireshark 2.0.2

While here, fix bad copy/paste on upstream URL when the entry was made.

Security:	CVE-2016-4415
Security:	CVE-2016-4416
Security:	CVE-2016-4417
Security:	CVE-2016-4418
Security:	CVE-2016-4419
Security:	CVE-2016-4420
Security:	CVE-2016-4421
Secuirty:	https://vuxml.FreeBSD.org/freebsd/45117749-df55-11e5-b2bd-002590263bf5.html

f5904942af

2016-07-04 15:32Jason Unovitch (junovitch) · 1.1_3

Update wnpa-sec-2016-19 through wnpa-sec-2016-27 with CVE assignment for issues fixed in Wireshark 2.0.3

Security:	CVE-2016-4006
Security:	CVE-2016-4076
Security:	CVE-2016-4077
Security:	CVE-2016-4078
Security:	CVE-2016-4079
Security:	CVE-2016-4080
Security:	CVE-2016-4081
Security:	CVE-2016-4082
Security:	CVE-2016-4083
Security:	CVE-2016-4084
Security:	https://vuxml.FreeBSD.org/freebsd/7e36c369-10c0-11e6-94fa-002590263bf5.html

cfc4b815ba

2016-07-04 15:25Jason Unovitch (junovitch) · 1.1_3

Document wnpa-sec-2016-29 through wnpa-sec-2016-37 for issues fixed in Wireshark 2.0.4

Security:	CVE-2016-5350
Security:	CVE-2016-5351
Security:	CVE-2016-5352
Security:	CVE-2016-5353
Security:	CVE-2016-5354
Security:	CVE-2016-5355
Security:	CVE-2016-5356
Security:	CVE-2016-5357
Security:	CVE-2016-5358
Security:	https://vuxml.FreeBSD.org/freebsd/313e9557-41e8-11e6-ab34-002590263bf5.html

c6c5aeb46a

2016-07-04 03:46Jason Unovitch (junovitch) · 1.1_3

Add fixed entries for Python 2.7, 3.4, 3.5 for urllib vulnerability.

Reset 3.3 as unfixed.

PR:		210539
PR:		210541
Reported by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	CVE-2016-5699
Security:	https://vuxml.FreeBSD.org/freebsd/a61374fc-3a4d-11e6-a671-60a44ce6887b.html

449054770b

print/py-pypdf 32 unaddressed · 8.7	Oct 29
devel/py-pyasn1 4 unaddressed · 7.5	Oct 29
sysutils/nomad 3 unaddressed · 8.8	Oct 29
lang/python27 3 unaddressed · 6.3	Oct 29
lang/python311 +5 related 13 unaddressed · 9.4	Oct 29
lang/python315 6 unaddressed · 9.4	Oct 29
security/botan3 5 CVEs · 9.2 fixed 3.13.0	Oct 29
devel/libwasmtime 17 unaddressed · 9.9	Oct 29
graphics/ImageMagick6 2 unaddressed · 6.3 VuXML	Oct 29
graphics/ImageMagick7 83 CVEs · 7.2 fixed 7.1.2.34 VuXML	Oct 29
textproc/py-markdown 1 unaddressed · 8.7	Oct 29
www/openemr 11 unaddressed · 9.4	Oct 29
www/dolibarr 17 unaddressed · 8.8	Oct 28
www/dolibarr19 +1 related 18 unaddressed · 8.8	Oct 28
www/dolibarr21 +1 related 19 unaddressed · 8.8	Oct 28

CVE-2026-119209 7.1 print/py-pypdf	Oct 29
CVE-2026-119208 7.1 print/py-pypdf	Oct 29
CVE-2026-119207 7.1 print/py-pypdf	Oct 29
CVE-2026-119206 7.1 print/py-pypdf	Oct 29
CVE-2026-119205 7.1 print/py-pypdf	Oct 29
CVE-2026-119204 7.1 print/py-pypdf	Oct 29
CVE-2026-119203 7.1 print/py-pypdf	Oct 29
CVE-2026-119197 7.5 devel/py-pyasn1	Oct 29
CVE-2026-119196 7.5 devel/py-pyasn1	Oct 29
CVE-2026-119195 7.5 devel/py-pyasn1	Oct 29
CVE-2026-119194 7.5 devel/py-pyasn1	Oct 29
CVE-2026-119168 8.8 sysutils/nomad	Oct 29
CVE-2026-107347 8.4 sysutils/nomad	Oct 29
CVE-2026-102260 4.3 sysutils/nomad	Oct 29
CVE-2026-116566 5.3 lang/python27 +7 more	Oct 29

git-lfs	Oct 28
jenkins	Oct 28
jenkins-lts	Oct 28
p5-GD	Oct 28
p5-HTTP-Body	Oct 28
p5-MIME-Tools	Oct 28
p5-Plack	Oct 28
p5-Starman	Oct 28
py311-pillow	Oct 28
py312-pillow	Oct 28
py313-pillow	Oct 28
py313t-pillow	Oct 28
py314-pillow	Oct 28
py314t-pillow	Oct 28
py315-pillow	Oct 28
trafficserver	Oct 28
py311-svglib	Oct 27
py312-svglib	Oct 27
py313-svglib	Oct 27
py313t-svglib	Oct 27
py314-svglib	Oct 27
py314t-svglib	Oct 27
py315-svglib	Oct 27
rustls-ffi	Oct 27
ImageMagick6	Oct 26