CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

textproc/libxml22.15.4

XML parser library for GNOME

Maintainer
desktop@FreeBSD.org
Packages
libxml2 2.15.4
Upstream
up to date
CPE
xmlsoft:libxml2 from the port
WWW
http://xmlsoft.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (29)

Show 29 fixed
VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVE-2026-861408.02026-09-05In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
CVE-2026-861426.92026-09-05In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
CVE-2026-861436.92026-09-05In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for i…
CVE-2026-861386.92026-09-05In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
CVE-2026-861396.92026-09-05In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
CVE-2026-861445.62026-09-05In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PA…
CVE-2026-861412.92026-09-05xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL c…
CVE-2026-861372.92026-09-05In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

Commits (287)

Tobias C. Berner (tcberner) · 2.9.10
textproc/libxml2: update to 2.9.10

PR:		24004
Exp-run by:	antoine
Reviewed by:	madpilot
Differential Revision:	https://reviews.freebsd.org/D22410
7cfca3405b
Tobias C. Berner (tcberner) · 2.9.9
Create desktop@ as maintainer of some shared desktop ports

This idea has been around for quite some time. Time to make it happen.

In order to share the load on the ports required by multiple desktop
environments start to share the responsibility of maintainership.

This is the initial list that came to mind, but we can probably extend it, to
include another handful of ports.

WWW: https://wiki.freebsd.org/DesktopTeam
Mailing List: https://lists.freebsd.org/mailman/listinfo/freebsd-desktop

Approved by:	swills, kwm (gnome), madpilot (xfce)
Differential Revision:	https://reviews.freebsd.org/D22389
5bed1dc473
Antoine Brodin (antoine) · 2.9.9
MASTERDIR is always defined after bsd.port.pre.mk
4d8148ba5f
Mark Linimon (linimon) · 2.9.9
Prepare for powerpc-on-clang by deleting hard-coded tests for libstdc++.so as a stand-in for "are we running on gcc".

For people already testing powerpc on clang, it is possible that they
already have both compilers in base.  Thus, the assumption that "gcc is
in base" (e.g.  libstdc++.so exists) always means "force use of GCC" is
already broken.  It will be for everyone on -CURRENT once the switch is
made.

Tested on both amd64 and powerpc64.

PR:		239153
Approved by:	gnome (maintainer-timeout, > 1 month)
a4c44afe3e
Steve Wills (swills) · 2.9.9
textproc/libxml2: Update to 2.9.9 [1]

While here, fix a bug in libxslt triggered by the libxml2 update

PR:		235713 [1]
PR:		238522
Exp-run by:	antoine
Reported by:	kunda <chitty_cloud@me.com> [1]
Reviewed by:	kwm [1] [2]
Obtained from:	https://gitlab.gnome.org/GNOME/libxslt/commit/5b0965010abf274f7a3a1291d16dde34c167e8a7
8a749f4712
Antoine Brodin (antoine) · 2.9.8
Workaround https://bugzilla.gnome.org/show_bug.cgi?id=789714

PR:		234633
Obtained from:	Fedora / openSuse
89b855b456
Steve Wills (swills) · 2.9.8
textproc/libxml2: fix build with GCC-based architectures

PR:		234563
Submitted by:	Piotr Kubaj <pkubaj@anongoth.pl>
Pointyhat to:	swills
3c061c9867
Antoine Brodin (antoine) · 2.9.8
Fix LICENSE_PERMS
c8ad5ec32c
Steve Wills (swills) · 2.9.8
textproc/libxml2: update to 2.9.8

PR:		233804
Exp-run by:	antoine
585accadec
Koop Mast (kwm) · 2.9.7
Remove usage of _PyVerify_fd().

This function appears to be removed in python 3.5.0. Instead of adding a
version check like the submitter proposed. Grab the upstream patch instead
that just removes the function usage.

PR:		224902
Submitted by:	Michael Zhilin <mizhka@gmail.com>
Obtained from:	libxml2 upstream
815b85b670
Dmitry Marakasov (amdmi3) · 2.9.7
- Add LICENSE

Approved by:	portmgr blanket
e62c4f57b6
Mathieu Arnold (mat) · 2.9.7
Switch some MASTER_SITES from http/ftp to https.

Also some cleanup of dead entries.

PR:		226203
Submitted by:	Sam H
Sponsored by:	Absolight
37677d32e3
Steve Wills (swills) · 2.9.7
textproc/libxml2: update to 2.9.7

PR:		222893
PR:		224189
Reported by:	Walter Hop <walter@lifeforms.nl>
Approved by:	gnome@ (kwm)
Exp-run by:	antoine
MFH:		2017Q4
Security:	76e59f55-4f7a-4887-bcb0-11604004163a
9440728b39
Mathieu Arnold (mat) · 2.9.4
${RM} already has -f.

PR:		213570
Submitted by:	mat
Exp-run by:	antoine
Sponsored by:	Absolight
eabbfd75e3
John Marino (marino) · 2.9.4
textproc/libxml2: remove LICENSE block to unbreak libxml2-reference

The addition of the MIT licence block broke at least the
textproc/libxml2-reference port due to how the helper script
bsd.gnome-reference.mk works.  Removed at the request of person that
suggested the license be added [2].

PR:		209806

PR:		212265 [2]
Reported by:	cpm
d2b73d7ce8
Koop Mast (kwm) · 2.9.4
Update libxml2 to 2.9.4.

Add license block.
Pull extra patch to fix NULL pointer deref. [1]

Changelog:	https://mail.gnome.org/archives/xml/2016-May/msg00023.html

PR:		209806
Submitted by:	pi@
Obtained from:	upstream [1]
MFH:		2016Q3
Security:	e195679d-045b-4953-bb33-be0073ba2ac6
08c94c0300
Koop Mast (kwm) · 2.9.3
New release to fix a number of CVE's.

CVE-2015-1819 is also listed in the release notes of 2.9.3 but that issue
was fixed in a previous commit and documented in another vuxml entry.

MFH:		2015Q4
Security:	e5423caf-8fb8-11e5-918c-bcaec565249c
ac9d521985
Dmitry Marakasov (amdmi3) · 2.9.2_3
- Add option to disable validator

Approved by:	kwm
a6cc456e5c
Koop Mast (kwm) · 2.9.2_3
Fix libxml2 CVE-2015-1819

doc/ tree tested by:	wblock@

Obtained from:	libxml2 upstream
MFH:		2015Q3
Security: 9c7177ff-1fe1-11e5-9a01-bcaec565249c
c82aa34d6c
Mathieu Arnold (mat) · 2.9.2_2
Remove $FreeBSD$ from patches files everywhere.

With hat:	portmgr
Sponsored by:	Absolight
6172d4b590
Dmitry Marakasov (amdmi3) · 2.9.2_2
- Add CPE info

Approved by:	portmgr blanket
ce706e44e6
Koop Mast (kwm) · 2.9.2_2
Fix regression introduced in CVE-201403660 fix.

Submitted by:	gjb@
Obtained from:	libxml2 upstream
118edfa083
Koop Mast (kwm) · 2.9.2_1
patch-parser.c:  Replace allready applied patch with new patch from upstream to unbreak the  xmlcatalog command. patch-uri.c: Revert uri.c commit that causes the document chain to fail.

Reported by:	antoine@
Tested by:	bapt@
MFH:		2014Q4
99c102db3d
Koop Mast (kwm) · 2.9.2
Update to 2.9.2.

This release fixes CVE-2014-3660 (DoS).

MFH:		2014Q4
Security:	0642b064-56c4-11e4-8b87-bcaec565249c
06cf046998
Koop Mast (kwm) · 2.9.1_1
Fix miss merge relating to iconv support.

Reported & tested by:	Cyril Kalinchikov <cyr.k@me.com>
fc406f4c65
Koop Mast (kwm) · 2.9.1
Make sure to remove all orphaned doc dirs.

Submitted by:	port jenkins via swills@
0eb79be561
Koop Mast (kwm) · 2.9.1
Make check-plist not trow it cookies.
9d4f1e2d7b
Koop Mast (kwm) · 2.9.1
Update to libxml2 2.9.1 [1]

This version fixes CVE-2013-2877.
Add upstream patch for CVE-2014-0191.

CVE's Reported by:	Akinori MUSHA <knu@iDaemons.org>
Obtained from:	GNOME dev repo [1], libxml2 upstream [2]
MFH:		2014Q2
607eebc44b
Tijl Coosemans (tijl) · 2.8.0_5
When linking a library libA with a library libB using libtool, if libB.la exists, libtool will add all libraries libB.la refers to (dependency_libs field) to the linker command line and store them in the dependency_libs field of libA.la.  So everything that subsequently links with libA will also link to these extra libraries.  This causes too much overlinking.

This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs
field in .la libraries during staging.  However, because .la libraries have
very limited use when dependency_libs is empty it makes sense to completely
remove them during staging.

So with this commit USES=libtool is modified to remove .la libraries and a
new form (USES=libtool:keepla) is introduced in case they need to be kept
(dependency_libs is still emptied).

PORTREVISION is bumped on all ports with USES=libtool that install .la
libraries.  Most ports are also changed to add :keepla because .la
libraries have to be kept around as long as there are dependent ports with
.la libraries that refer to them in their dependency_libs field.  In most
cases :keepla can be removed again as soon as all dependent ports that
install .la libraries have some form of USES=libtool added to their
Makefile.

PR:		ports/188759
Exp-run:	bdrewery
Approved by:	portmgr (bdrewery)
aad09bc5e2
Niclas Zeising (zeising) · 2.8.0_4
The FreeBSD x11@ and graphics team proudly presents a zeising, kwm production, with help from dumbbell, bdrewery:

NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE

This update switches over to use the new xorg stack by default on FreeBSD 9
and 10 stable, on osversions where vt(9) is available.
It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in
/etc/make.conf .
FreeBSD 8-STABLE and released versions of FreeBSD still use
the old version.
A package repository with binary packages for new xorg will
be available soon.

This patch also contains updates of libxcb and related ports, pixman, as well
as some drivers and utilities.

Bump portrevisions for xf86-* ports, as well as virtualbox-ose-additions due
to xserver version change.

Apart from these updates, the way shared libraries are handled has been
changed for all xorg ports, as well as libxml2 and freetype, which means
ltverhack is gone and as a consequence shared libraries have been bumped.
The plan is that this change will make library bumps less likely in the
future.
All affected ports have had their portrevisions bumped as a consequence of
this.

Fix some issues where WITH_NEW_XORG weren't detected properly on CURRENT.

Update instructions, hardware support, and more notes can be found on
https://wiki.freebsd.org/Graphics

Thanks to:	all testers, bdrewery and the FreeBSD x11@ team
exp-run by:	bdrewery [1]
PR:		ports/187602 [1]
Approved by:	portmgr (bdrewery), core (jhb)
39fc32e828
Hiroki Sato (hrs) · 2.8.0_3
- Add STAGEDIR support. - Use *_CONFIGURE_WITH. - Add workaround for an iconv incompatibility on 10.X and later.
839dc18139
Baptiste Daroussin (bapt) · 2.8.0_2
Add NO_STAGE all over the place in preparation for the staging support (cat: textproc)
0068f2d47f
Boris Samorodov (bsam) · 2.8.0_2
Introduce variable ICONV_PREFIX at Mk/Uses/iconv.mk. The default for pre 100043 is ${LOCALBASE} and /usr otherwise. Convert all ports to new variable usage.

Approved by:	portmgr (bapt, implicit)
7046a55fd8
Baptiste Daroussin (bapt) · 2.8.0_2
Track down the latest USE_GNOME=pkgconfig
a79c5a7d1a
Alex Kozlov (ak) · 2.8.0_2
- Remove MAKE_JOBS_SAFE variable

Approved by:	portmgr (bdrewery)
d4041784dc
Marcus von Appen (mva) · 2.8.0_2
- Convert USE_ICONV=yes to USES=iconv - Change USE_GNOME=pkgconfig|gnomehack to USES=pathfix|pkgconfig and   USE_GETTEXT=yes to USES=gettext while here
95e7081976
Jung-uk Kim (jkim) · 2.8.0_2
Fix build with LZMA.  All supported versions have liblzma in the base.

Approved by:	gnome (mezz)
Feature safe:	yes
879bb9b6c2
Bryan Drewery (bdrewery) · 2.8.0_1
- Add http mirror in case FTP is not available

Approved by:	gnome (kwm)
Approved by:	portmgr (implicit)
9d61e86da1
Koop Mast (kwm) · 2.8.0_1
Fix options evaluation that got mixed up in the OptionsNG converstion.

PR:		ports/177480
Submitted by:	scf@
Pointyhat for:	kwm
2e337aebfc
Koop Mast (kwm) · 2.8.0
Fix typo

PR:		ports/177480
Submitted by:	Sayetsky Anton <vsjcfm@gmail.com>
11b42c3627
Koop Mast (kwm) · 2.8.0
Update to 2.8.0. [1] Add patch to fix CVE-2013-0338 and CVE-2013-0339. [2] Convert to OptionsNG, rename patches to standard form. [1]

Notified by:	swills@ [2]
Obtained from:	gnome team repo [1]
Security:	843a4641-9816-11e2-9c51-080027019be0
be6202887a
Koop Mast (kwm) · 2.7.8_5
Switch main site and mirror around. The mirror is still valid but it is really slow.

Reported by:	many
Feature safe:	yes
c7d5467d51
Steve Wills (swills) · 2.7.8_5
- Revert previous change to add -pthread since libxml2 is not threaded, but is   thread-safe, so -pthread is not needed here, but in threaded programs that   use libxml2

Pointed out by:	ale@
Discussed with:	marcus, kwm
Pointyhat to:	swills
8c33e8cf1b
Steve Wills (swills) · 2.7.8_4
- Build with -pthread and include -pthread in xml2-config --libs output when threads are enabled

PR:		ports/171353
Discussed with:	marcus, kwm
Approved by:	marcus
25a5a99b79
Koop Mast (kwm) · 2.7.8_3
Merge the patch-Makefile.in into patch-aa which already patched Makefile.in.
9df7deee2a
Dmitry Sivachenko (demon) · 2.7.8_3
Compile static libxml2.a with -fPIC so 3rd party shared libs can link statically with libxml2.a.

OK from:	mezz
12e0349f95
Jeremy Messenger (mezz) · 2.7.8_3
Fix the disable iconv option.

PR:		ports/167211
Submitted by:	sunpoet
4bc0dc3de0
Koop Mast (kwm) · 2.7.8_3
Document and fix a off-by-one vulnability in libxml2.

Obtained from:	libxml upstream
Security:	b8ae4659-a0da-11e1-a294-bcaec565249c
b7e1fac56a
Koop Mast (kwm) · 2.7.8_2
Fix last commit which broke the build.

Feature safe:	yes
b4387127d5
Jeremy Messenger (mezz) · 2.7.8_2
-Make the iconv optional.

PR:		ports/162571
Submitted by:	Pedro Giffuni <giffunip@tutopia.com>
Feature safe:	yes
4a44abaad9