CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

sysutils/coreutils 9.12

Free Software Foundation core utilities

Port info

Maintainer
jharris@widomaker.com
Packages
latest: 9.9, update to 9.12 not built yet
Upstream
up to date
Last update
to 9.12 · 690ad752cf
Quarterly
2026Q4: 9.9
Formerly
misc/sh-utils until 2004-01-21, sysutils/fileutils until 2004-01-21, textproc/textutils until 2004-01-21
WWW
https://www.gnu.org/software/coreutils/
Links
cgit · VuXML

Install

Package
# pkg install coreutils
installs 9.9 from latest; from quarterly (2026Q4) 9.9
Port
# cd /usr/ports/sysutils/coreutils && make install clean
# make -C /usr/ports/sysutils/coreutils config  # change options first
Size
2.9 MiB download · 18 MiB installed
Depends on
devel/gettext-runtime 1.0_1, print/indexinfo 0.3.1_1
License
GPLv3
Options
1 of 2 on in the package: NLS
Show the 1 options that are off
GMP

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 169.99.9–
FreeBSD 159.99.9–
FreeBSD 149.99.99.9

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 159.99.9–
FreeBSD 149.99.99.9

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 9.9 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-563914.62026-07-24GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() funct…

VuXML only (0)

Listed in VuXML, the packaged version 9.9 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (2) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
293672regression maintainer-feedback? sysutils/coreutils: fails to build after (presumably) base 28599a1e5f1bIn Progress2026-10-18
294452maintainer-feedback? sysutils/coreutils does not compile with LibreSSL as of Q2 2026New2026-04-12

Commits (138)

Christian Weisgerber (naddy) · 2.0_2 · as misc/sh-utils
Rename included eaccess() function to avoid clash with -CURRENT's eaccess(2) system call.

PR:		46363
Submitted by:	Cyrille Lefevre <cyrille.lefevre@laposte.net>
dcfab635e7
Alan Eldridge (alane) · 4.1_1 · as sysutils/fileutils
fix misspelling of LIB_DEPENDS that prevented gettext dep from being recognized
e6bb1d1625
Ade Lovett (ade) · 4.1_1 · as misc/sh-utils
Chase shlib rev of devel/gettext

Submitted by:	lots and lots
Pointy hat to:	ade
c8eaa93644
Ying-Chieh Liao (ijliao) · 2.0_1 · as misc/sh-utils
${PERL} -> ${REINPLACE_CMD}

PR:		39746
Submitted by:	Cyrille Lefevre <cyrille.lefevre@laposte.net> (maintainer)
7ef18f1429
Ade Lovett (ade) · 4.1_1 · as misc/sh-utils
gettext upgrade uber-patch (stage 3)

- switch devel/gettext (0.11.1) on, installing full package
- flip devel/gettext-old (0.10.35) to installing only static binaries
  with a "-old" suffix -- gettext-old will have its deorbit burn
  sequence initiated just after 4.6-RELEASE
- fix up ports for the new world order

Reviewed by:	portmgr
f18cbf2fa6
Ade Lovett (ade) · 4.1 · as misc/sh-utils
Stage 1 of gettext update.

Move gettext (0.10.35) with gettext-old
Update gettext from gettext-devel (0.10.40)
Remove gettext-devel
Fix dependencies

Stage 2 will involve upgraded gettext to 0.11 and fixing issues
Stage 3 involves a de-orbit burn sequence for gettext-old

Reviewed by:	portmgr
9210b7cb07
David W. Chapman Jr. (dwcjr) · 4.1 · as misc/sh-utils
Update maintainer's email address Update a few MASTER_SITES

PR:		34012
Submitted by:	maintainer
7cdb9dd859
Akinori MUSHA (knu) · 4.1 · as sysutils/fileutils
Update to 4.1.

PR:		ports/30394
Submitted by:	Cyrille Lefevre <clefevre@citeweb.net> (MAINTAINER)
6e413393cb
Mario Sergio Fujikawa Ferreira (lioux) · 2.0 · as misc/sh-utils
o style changes o honor PREFIX

PR:		30390
Submitted by:	MAINTAINER
3f7c619439
Mario Sergio Fujikawa Ferreira (lioux) · 4.0 · as misc/sh-utils
Update MAINTAINER email: clefevre@redirect.to -> clefevre@citeweb.net

Approved by: MAINTAINER
96f3a37ff1
Peter Pentchev (roam) · 4.0 · as sysutils/fileutils
Change maintainer's email address: clefevre@citeweb.net -> clefevre@redirect.to

PR:		27867 (followup)
Submitted by:	maintainer
5d0e1ef13c
Peter Pentchev (roam) · 2.0 · as misc/sh-utils
Change maintainer's email address: clefevre@poboxes.com -> clefevre@redirect.to

PR:		27867
Submitted by:	maintainer
9c0a071864
Maxim Sobolev (sobomax) · 2.0 · as textproc/textutils
-pthread --> ${PTHREAD_LIBS} -D_THREAD_SAFE --> ${PTHREAD_CFLAGS}

Note: my first intention was to test this out on bento/beta, but per ade's
requiest I opted to do it quickly.
4ca0e60800
Steve Price (steve) · 4.0 · as sysutils/fileutils
Minor tweaks to the post-install target and wording changes in pkg-descr.

PR:		24565
Submitted by:	maintainer
bb88a12a17
Trevor Johnson (trevor) · 4.0 · as sysutils/fileutils
change maintainer for findutils and fileutils ports

PR:		24561, 24565 (followups)
Approved by:	maintainer
a79343f08e
Kevin Lo (kevlo) · 2.0 · as misc/sh-utils
Add USE_GMAKE and fix pkg-plist

Submitted by: MAINTAINER
ee7a2c477f
Kevin Lo (kevlo) · 2.0 · as misc/sh-utils
- Fix Makefile - Add WWW - Take over maintainership

BTW, I fixed pkg-plist

PR: 24111
Submitted by: Cyrille Lefevre <clefevre@citeweb.net>
e092ade9f6
Will Andrews (will) · 2.0 · as misc/sh-utils
Goodbye, YEAR2000.  Hello, 2001.

Approved by:	asami
60f2b6b7a8
Dmitry Sivachenko (demon) · 2.0 · as misc/sh-utils
Remove trailing period and package name from the pkg-comment.
0aafce6a70
Trevor Johnson (trevor) · 2.0 · as misc/sh-utils
Add GNU sh-utils 2.0, enhanced versions of yes, true, pwd, and so forth (all with a "g" prepended to their names).  With the approval of the submitter, I've disabled the suid bit on gsu by default, with a note to users that they should review the philosophy behind GNU su:

Why GNU `su' does not support the `wheel' group
===============================================

   (This section is by Richard Stallman.)

   Sometimes a few of the users try to hold total power over all the
rest.  For example, in 1984, a few users at the MIT AI lab decided to
seize power by changing the operator password on the Twenex system and
keeping it secret from everyone else.  (I was able to thwart this coup
and give power back to the users by patching the kernel, but I wouldn't
know how to do that in Unix.)

   However, occasionally the rulers do tell someone.  Under the usual
`su' mechanism, once someone learns the root password who sympathizes
with the ordinary users, he or she can tell the rest.  The "wheel
group" feature would make this impossible, and thus cement the power of
the rulers.

   I'm on the side of the masses, not that of the rulers.  If you are
used to supporting the bosses and sysadmins in whatever they do, you
might find this idea strange at first.

PR:		21884
Submitted by:	Cyrille Lefevre <clefevre@citeweb.net>
Reviewed by:	submitter
Approved by:	silence on -ports regarding category
437e13fc3b
Jeremy Lea (reg) · 2.0 · as textproc/textutils
Use the gettext port instead of own static libintl.  No need to remove share/locale, it is handled by the gettext port.

Approved by:	maintainer
6bf486c13d
Satoshi Taoka (taoka) · 2.0 · as textproc/textutils
(1) /usr/share/info/dir was renamed to dir-tmpl. (2) Now it is not necessary to exist a file "info/dir" when install-info is executed.

By (1) and (2), I removed the next line:

[ -f %D/info/dir ] || sed -ne 1,/Menu:/p /usr/share/info/dir > %D/info/dir

from PLIST or Makefile

CV: ----------------------------------------------------------------------
5d7d820639
SADA Kenji (sada) · 4.0 · as sysutils/fileutils
Ports of GNU file-utilities.

PR:		ports/16638
Submitted by:	Udo Schweigert <ust@cert.siemens.de>
ff846e2db8
Michael Haro (mharo) · as textproc/textutils
Remove the test to create ${PREFIX}/share/info/dir as it is now in bsd.port.mk and this helps to unify the check and install.
5ce8e8e5c7
Satoshi Asami (asami) · as textproc/textutils
Mark this broken while maintainer works on fixing the makeinfo problem.

Submitted by:	maintainer
ea502b1bf4
Tim Vanderhoek (hoek) · as textproc/textutils
None of these textproc tools were quite advanced enough to be able to textproc away the manpages in their PLISTs.  I'll do it for them.  Or, rather, bento.freebsd.org will do it for them under my direction.  :-)
23bd11f48e
Matthew Hunt (mph) · as textproc/textutils
Import of GNU textutils 1.22, including GNU cat and so forth.  The programs are installed wit the prefix "g", a la gmake.  This produces the interesting program /usr/local/bin/god.

PR:		6050
Submitted by:	Adrian Wontroba <aw1@stade.co.uk>
0c8bab91b3