CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

sysutils/coreutils 9.12

Free Software Foundation core utilities

Port info

Maintainer
jharris@widomaker.com
Packages
latest: 9.9, update to 9.12 not built yet
Upstream
up to date
Last update
to 9.12 · 690ad752cf
Quarterly
2026Q4: 9.9
Formerly
misc/sh-utils until 2004-01-21, sysutils/fileutils until 2004-01-21, textproc/textutils until 2004-01-21
WWW
https://www.gnu.org/software/coreutils/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install coreutils
installs 9.9 from latest; from quarterly (2026Q4) 9.9
Port
# cd /usr/ports/sysutils/coreutils && make install clean
# make -C /usr/ports/sysutils/coreutils config  # change options first
Size
2.9 MiB download · 18 MiB installed
Depends on
devel/gettext-runtime 1.0_1, print/indexinfo 0.3.1_1
License
GPLv3
Options
1 of 2 on in the package: NLS
Show the 1 options that are off
GMP

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 169.99.9–
FreeBSD 159.99.9–
FreeBSD 149.99.99.9

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 159.99.9–
FreeBSD 149.99.99.9

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 9.9 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-563914.62026-07-24GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() funct…

VuXML only (0)

Listed in VuXML, the packaged version 9.9 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (2) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
293672regression maintainer-feedback? sysutils/coreutils: fails to build after (presumably) base 28599a1e5f1bIn Progress2026-10-18
294452maintainer-feedback? sysutils/coreutils does not compile with LibreSSL as of Q2 2026New2026-04-12

Commits (138)

Raphael Kubo da Costa (rakuco) · 8.20_1
Fix plist, as reported by redports.

Feature safe:	yes
d4a1d5754e
Raphael Kubo da Costa (rakuco) · 8.20_1
Depend on Perl at build time.

Reported by Giacomo Olgeni <g.olgeni@colby.it> via private mail.

PR:		ports/173047
Feature safe:	yes
a6784654db
Raphael Kubo da Costa (rakuco) · 8.20
Update to 8.20.

PR:		ports/173047
Submitted by:	Jason Harris <jharris@widomaker.com> (maintainer)
Feature safe:	yes
3a2c3938af
Bryan Drewery (bdrewery) · 8.19_2
- Fix plist referencing 2 nonexistent files with NLS [1] - Trim header

PR:		ports/172597 [1]
Submitted by:	bdrewery
Approved by:	Jason Harris <jharris@widomaker.com> (maintainer) [1]
Approved by:	portmgr (erwin)
Feature safe:	yes
5227f68ac2
Alex Dupre (ale) · 8.19_1
Fix plist and bump PORTREVISION.
4f6ed685c6
Dmitry Sivachenko (demon) · 8.19
Update to version 8.19. Convert to new OPTIONS framework while I am here.

Maintainer timeout:	1 month
18574ecda9
Chris Rees (crees) · 8.12
- Rename gstat to gnustat; otherwise it collides with base gstat (for geom) [1] - Correct REINPLACE for permissions; \+ is a special character in a BRE

PR:		ports/160060
Submitted by:	Veniamin Gvozdikov <g.veniamin@googlemail.com>
Reviewed by:	Jason Hellenthal, wxs, eadler
Approved by:	Jason Harris <jharris@widomaker.com> (maintainer)
8da8c78868
Wesley Shields (wxs) · 8.12
- No need to specify CPPFLAGS in CONFIGURE_ENV.

Submitted by:	sunpoet@
52f531b38b
Wesley Shields (wxs) · 8.12
- Update to 8.12.

PR:		ports/157808
Submitted by:	Ryan Steinmetz <rpsfa@rit.edu>
Approved by:	maintainer timeout
ed55f69267
Martin Wilke (miwi) · 8.5
- Get Rid MD5 support
a9481afc8a
Pav Lucistnik (pav) · 8.5
- Disable tests for now, they hang on pointyhat

Reported by:	pointyhat
Ok'ed by:	wxs
ecf675d301
Wesley Shields (wxs) · 8.5
Update to 8.5

PR:		ports/148822
Submitted by:	Klaus Aehlig <aehlig@linta.de>
Approved by:	Jason Harris <jharris@widomaker.com> (maintainer)
62f98d498c
Pav Lucistnik (pav) · 7.5_1
- Introduce a new USE_XZ knob that handles lzma/xz compressed distfiles - Convert a bunch of ports to use it

PR:		ports/146329
Submitted by:	mm
With hat:	portmgr
fe337e0489
Ade Lovett (ade) · 7.5_1
Bounce PORTREVISION for gettext-related ports.  Have fun, ya'll.
8d837132c7
Max Brazhnikov (makc) · 7.5
Some utils link with gmp library if exists. Add optional dependency on math/gmp and disable gmp support properly when it's not needed.

PR:		ports/146027
Reported by:	Craig Leres <leres at ee.lbl.gov>
57ee8e41fd
Renato Botelho (garga) · 7.5
Update to 7.5

PR:		ports/138083
Submitted by:	Sylvio Cesar <scjamorim@bsd.com.br>
Approved by:	maintainer timeout (3 weeks)
Feature safe:	yes
c0a9161eaf
Jeremy Chadwick (koitsu) · 6.9_3
Fixup for my previous commit/patch.

- OSVERSION check should be against 800039 or higher, as that's when
  the sgtty changes were committed.
  http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/sys/param.h.diff?r1=1.355;r2=1.356;f=h

- Fix stty.c patch.  Previous version would result in termios bits
  being overridden by #include <sys/ioctl_compat.h>, causing coreutils'
  stty to modify bits different than /bin/stty.  This version removes
  tab1/tab2 delay support, since tab1/tab2 delays aren't available in HEAD
  outside of the binary compatibility interface.  Also fixes stty --help
  usage to indicate only tab0 and tab3 are available.
0f313cf5f3
Jeremy Chadwick (koitsu) · 6.9_3
Fix-up for 8.0-CURRENT.  src/stty.c fails to compile due to TAB1 and TAB2 termios bits being undefined.  They've been moved to sys/ioctl_compat.h which requires _KERNEL be defined.  Somewhat of an ugly hack; possible alternative would be to remove use of TAB1 and TAB2 in src/stty.c altogether.

Reported by:	jsa @ EFnet
11e7c7e8e8
Rong-En Fan (rafan) · 6.9_3
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script. Specifically, newer autoconf (> 2.13) has different semantic of the configure target. In short, one should use --build=CONFIGURE_TARGET instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk
 - Remove CONFIGURE_TARGET hack in various bsd.*.mk
 - USE_GNOME=gnometarget is now an no-op

Changes to individual ports, other than removing the CONFIGURE_TARGET hack:

= pkg-plist changed (due to the ugly CONFIGURE_TARGET prefix in * executables)
  - comms/gnuradio
  - science/abinit
  - science/elmer-fem
  - science/elmer-matc
  - science/elmer-meshgen2d
  - science/elmerfront
  - science/elmerpost

= use x86_64 as ARCH
  - devel/g-wrap

= other changes
  - print/magicfilter
    GNU_CONFIGURE -> HAS_CONFIGURE since it's not generated by autoconf

Total # of ports modified:  1,027
Total # of ports affected: ~7,000 (set GNU_CONFIGURE to yes)

PR:		126524 (obsoletes 52917)
Submitted by:	rafan
Tested on:	two pointyhat 7-amd64 exp runs (by pav)
Approved by:	portmgr (pav)
741aa71483
Edwin Groothuis (edwin) · 6.9_3
Minor enhancement to sysutils/coreutils

Cleanup conflicts in this port (fileutils, sh-utils and
	textutils don't exist anymore)
	Provide a regression-test target to determine the convenience
	of updating this port.  Add commented USE_BISON line as it
	is recommended but not required, maybe future versions will
	need it.
	Update the WWW.
	No functional change.

PR:		ports/124623
Submitted by:	"Pedro F. Giffuni" <pfgshield-freebsd@yahoo.com>
Approved by:	maintainer timeout
77837c3567
Edwin Groothuis (edwin) · 6.9_3
Bump portrevision due to upgrade of devel/gettext.

The affected ports are the ones with gettext as a run-dependency
according to ports/INDEX-7 (5007 of them) and the ones with USE_GETTEXT
in Makefile (29 of them).

PR:             ports/124340
Submitted by:   edwin@
Approved by:    portmgr (pav)
090059a210
Christian Weisgerber (naddy) · 6.9_2
Revert previous workaround, 8.0-CURRENT has grown fdopendir(3).

Don't bother with __FreeBSD_version checking for what was only an
eight-day window.
a8ec5918ce
Christian Weisgerber (naddy) · 6.9_1
Work around the assumption that openat() implies the existence of fdopendir().  FreeBSD 8 has the former, but not the latter.

PR:		122433
Approved by:	maintainer
0491e1d212
Rong-En Fan (rafan) · 6.9_1
- Set --mandir and --infodir in CONFIGURE_ARGS if the configure script   supports them.  This is determined by running ``configure --help'' in   do-configure target and set the shell variable _LATE_CONFIGURE_ARGS   which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable   Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - 

PR:		ports/111470
Approved by:	portmgr
Discussed with:	stas (Mk/*), gerald (info related stuffs)
Tested by:	pointyhat exp run
f935a609c5
Li-Wen Hsu (lwhsu) · 6.9_1
- Put back accidentally deleted line in pkg-plist when applying the patch - Bump PORTREVISION

Noticed by:	pav
Approved by:	maintainer
4017c80408
Li-Wen Hsu (lwhsu) · 6.9
From the PR: - Update to GNU coreutils 6.9 - Eliminate configure warning - Sort plist

While I am here:
- Remove unsupported checksum algorithm SHA1 and RMD160

PR:		ports/111489
Submitted by:	"Eric P. Scott" <eps+pbug0704 AT ana.com>
Approved by:	Jason Harris <jharris AT widomaker.com> (maintainer)
cefa076561
Florent Thoumie (flz) · 6.7_1
- Welcome X.org 7.2 \o/. - Set X11BASE to ${LOCALBASE} for recent ${OSVERSION}. - Bump PORTREVISION for ports intalling files in ${X11BASE}.
d4f0d0048a
Gabor Kovesdan (gabor) · 6.7
Remove USE_GPG from all effected ports. This knob is a no-op and the way it was supposed to work is useless, because if we can't trust the distfile from the remote machine, we can't trust the signature from the same machine either. Our MD5 and SHA256 are good for checking both the sanity and the trustiness of distfiles.

Approved by:	portmgr (erwin), erwin (mentor)
c0ce4105e7
Nicola Vitale (nivit) · 6.7
- Updated to 6.7

PR:		ports/107954
Submitted by:	Jason Harris <jharris@widomaker.com>
Approved by:	alexbl (mentor, implicit)
9a425f895d
Martin Wilke (miwi) · 6.4_1
- Fix Update problems - Bump PORTREVISION

Submitted by:	ports@ ml
Thanks To:      trasz
d1a47691a2
Martin Wilke (miwi) · 6.4
- Update to 6.4

PR:		ports/105181
Submitted by:	trasz <trasz@pin.if.uz.zgora.pl>
Approved by:	maintainer timeout
5260088d31
Renato Botelho (garga) · 5.2.1
Fix PLIST: It was not removing some locale dirs that are not listed on BSD.local.dist

PR:		ports/101477
Submitted by:	Stanislav Sedov <ssedov@mbsd.msk.ru>
Approved by:	maintainer timeout (16 days)
7390aaa2d3
Edwin Groothuis (edwin) · 5.2.1
Remove USE_REINPLACE from all categories starting with S
28dd10dcb4
Edwin Groothuis (edwin) · 5.2.1
Replace ugly "@unexec rmdir %D... 2>/dev/null || true" with @dirrmtry

Approved by:    krion@
PR:             ports/88711 (related)
186c2e326c
Edwin Groothuis (edwin) · 5.2.1
Remove install-info from Makefile, it's automatically done when INFO is defined
fd3176ded7
Simon Barner (barner) · 5.2.1
- Add linux-gid-[0-9]* to CONFLICTS - coreutils: sort CONFLICTS - id-utils: use portname-[0-9]* instead of portname-*

Approved by:	arved (mentor)
be6115ff90
Kris Kennaway (kris) · 5.2.1
Clean up handling of locale directories at deinstall-time:

* Don't remove "system directories" (which were created by BSD.*.dist)
* Silently try to remove locale directories which we might have created
be3e1f7794
Yen-Ming Lee (leeym) · 5.2.1
- fix CONFLICTS - add WITHOUT_NLS for USE_GETTEXT - don't make install in WRKSRC/lib, which will install useless charset.alias

PR:		ports/71579
Submitted by:	leeym
Approved by:	maintainer
d89c0b304a
Pav Lucistnik (pav) · 5.2.1
- Update to 5.2.1

PR:		ports/64515
Submitted by:	Jason Harris <jharris@widomaker.com> (maintainer)
f60210bc28
Pav Lucistnik (pav) · 5.2.0
- Update to 5.2.0

PR:		ports/63504
Submitted by:	Jason Harris <jharris@widomaker.com> (maintainer)
54456f6afd
Joe Marcus Clarke (marcus) · 5.0_1
Add USE_GETTEXT and bump PORTREVISION.

Submitted by:	trevor
Tested by:	bento
186b8ba82f
Trevor Johnson (trevor) · 5.0
Now gettext 0.12.1 is gettext-old.
78da40aa98
Pav Lucistnik (pav) · as textproc/textutils
- Remove GNU textutils, they are replaced by GNU coreutils package,   available as sysutils/coreutils.

Approved by:	maintainer
51b2cef52f
Pav Lucistnik (pav) · as sysutils/fileutils
- Remove GNU fileutils, they are replaced by GNU coreutils package,   available as sysutils/coreutils.

Approved by:	maintainer timeout (1 month)
1ad8195df1
Pav Lucistnik (pav) · as misc/sh-utils
- Remove GNU shellutils, they are replaced by GNU coreutils package,   available as sysutils/coreutils.

Approved by:	maintainer timeout (1 month)
5961e2d83e
Pav Lucistnik (pav) · 4.1_2 · as misc/sh-utils
- Add CONFLICTS against newly added coreutils port.
f2bd7a7ff4
Pav Lucistnik (pav) · 5.0
Add coreutils, port of basic GNU file, shell and text manipulation utilities.

This port replaces fileutils, shellutils and textutils, which were distributed
as three individual sets, but now have been combined into coreutils.

For more details, see http://www.gnu.org/software/coreutils/

PR:		ports/59422
Submitted by:	Jason Harris <jharris@widomaker.com>
4a2e1af213
Joe Marcus Clarke (marcus) · 4.1_2 · as misc/sh-utils
Bump the PORTREVISION for the ports directly affected by the gettext upgrade.

Prodded by:	kris
a3108b1e51
Joe Marcus Clarke (marcus) · 4.1_1 · as misc/sh-utils
Chase the libintl.so shared lib version.
adccc29aad
Christian Weisgerber (naddy) · 2.0_3 · as misc/sh-utils
perl5 is needed at build time, add USE_PERL5_BUILD.

PR:		52710
Submitted by:	Cyrille Lefevre <cyrille.lefevre@laposte.net>
f0dc2532d4