textproc/libxml2: update to 2.9.10 PR: 24004 Exp-run by: antoine Reviewed by: madpilot Differential Revision: https://reviews.freebsd.org/D224107cfca3405b
CVE-2025-49794, CVE-2025-49795, CVE-2025-6021, CVE-2025-6170
XML parser library for GNOME
xmlsoft:libxml2 from the portpkg audit reports nothing for this version.| CVE-2026-86140 | 8.0 | 2026-09-05 | In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. |
| CVE-2026-86142 | 6.9 | 2026-09-05 | In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. |
| CVE-2026-86143 | 6.9 | 2026-09-05 | In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for i… |
| CVE-2026-86138 | 6.9 | 2026-09-05 | In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. |
| CVE-2026-86139 | 6.9 | 2026-09-05 | In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. |
| CVE-2026-86144 | 5.6 | 2026-09-05 | In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PA… |
| CVE-2026-86141 | 2.9 | 2026-09-05 | xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL c… |
| CVE-2026-86137 | 2.9 | 2026-09-05 | In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. |
CVE-2025-49794, CVE-2025-49795, CVE-2025-6021, CVE-2025-6170
no CVE referenced
CVE-2017-8872, CVE-2017-9047, CVE-2017-9048, CVE-2017-9049, CVE-2017-9050
CVE-2016-1762, CVE-2016-1833, CVE-2016-1834, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-1840, CVE-2016-3627, CVE-2016-3705, CVE-2016-4449, CVE-2016-4483
CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7941, CVE-2015-7942, CVE-2015-8035, CVE-2015-8241, CVE-2015-8242
textproc/libxml2: update to 2.9.10 PR: 24004 Exp-run by: antoine Reviewed by: madpilot Differential Revision: https://reviews.freebsd.org/D224107cfca3405b
Create desktop@ as maintainer of some shared desktop ports This idea has been around for quite some time. Time to make it happen. In order to share the load on the ports required by multiple desktop environments start to share the responsibility of maintainership. This is the initial list that came to mind, but we can probably extend it, to include another handful of ports. WWW: https://wiki.freebsd.org/DesktopTeam Mailing List: https://lists.freebsd.org/mailman/listinfo/freebsd-desktop Approved by: swills, kwm (gnome), madpilot (xfce) Differential Revision: https://reviews.freebsd.org/D223895bed1dc473
MASTERDIR is always defined after bsd.port.pre.mk4d8148ba5f
Prepare for powerpc-on-clang by deleting hard-coded tests for libstdc++.so as a stand-in for "are we running on gcc". For people already testing powerpc on clang, it is possible that they already have both compilers in base. Thus, the assumption that "gcc is in base" (e.g. libstdc++.so exists) always means "force use of GCC" is already broken. It will be for everyone on -CURRENT once the switch is made. Tested on both amd64 and powerpc64. PR: 239153 Approved by: gnome (maintainer-timeout, > 1 month)a4c44afe3e
textproc/libxml2: Update to 2.9.9 [1] While here, fix a bug in libxslt triggered by the libxml2 update PR: 235713 [1] PR: 238522 Exp-run by: antoine Reported by: kunda <chitty_cloud@me.com> [1] Reviewed by: kwm [1] [2] Obtained from: https://gitlab.gnome.org/GNOME/libxslt/commit/5b0965010abf274f7a3a1291d16dde34c167e8a78a749f4712
Workaround https://bugzilla.gnome.org/show_bug.cgi?id=789714 PR: 234633 Obtained from: Fedora / openSuse89b855b456
textproc/libxml2: fix build with GCC-based architectures PR: 234563 Submitted by: Piotr Kubaj <pkubaj@anongoth.pl> Pointyhat to: swills3c061c9867
Fix LICENSE_PERMSc8ad5ec32c
textproc/libxml2: update to 2.9.8 PR: 233804 Exp-run by: antoine585accadec
Remove usage of _PyVerify_fd(). This function appears to be removed in python 3.5.0. Instead of adding a version check like the submitter proposed. Grab the upstream patch instead that just removes the function usage. PR: 224902 Submitted by: Michael Zhilin <mizhka@gmail.com> Obtained from: libxml2 upstream815b85b670
- Add LICENSE Approved by: portmgr blankete62c4f57b6
Switch some MASTER_SITES from http/ftp to https. Also some cleanup of dead entries. PR: 226203 Submitted by: Sam H Sponsored by: Absolight37677d32e3
textproc/libxml2: update to 2.9.7 PR: 222893 PR: 224189 Reported by: Walter Hop <walter@lifeforms.nl> Approved by: gnome@ (kwm) Exp-run by: antoine MFH: 2017Q4 Security: 76e59f55-4f7a-4887-bcb0-11604004163a9440728b39
${RM} already has -f.
PR: 213570
Submitted by: mat
Exp-run by: antoine
Sponsored by: Absolighteabbfd75e3textproc/libxml2: remove LICENSE block to unbreak libxml2-reference The addition of the MIT licence block broke at least the textproc/libxml2-reference port due to how the helper script bsd.gnome-reference.mk works. Removed at the request of person that suggested the license be added [2]. PR: 209806 PR: 212265 [2] Reported by: cpmd2b73d7ce8
Update libxml2 to 2.9.4. Add license block. Pull extra patch to fix NULL pointer deref. [1] Changelog: https://mail.gnome.org/archives/xml/2016-May/msg00023.html PR: 209806 Submitted by: pi@ Obtained from: upstream [1] MFH: 2016Q3 Security: e195679d-045b-4953-bb33-be0073ba2ac608c94c0300
New release to fix a number of CVE's. CVE-2015-1819 is also listed in the release notes of 2.9.3 but that issue was fixed in a previous commit and documented in another vuxml entry. MFH: 2015Q4 Security: e5423caf-8fb8-11e5-918c-bcaec565249cac9d521985
- Add option to disable validator Approved by: kwma6cc456e5c
Fix libxml2 CVE-2015-1819 doc/ tree tested by: wblock@ Obtained from: libxml2 upstream MFH: 2015Q3 Security: 9c7177ff-1fe1-11e5-9a01-bcaec565249cc82aa34d6c
Remove $FreeBSD$ from patches files everywhere. With hat: portmgr Sponsored by: Absolight6172d4b590
- Add CPE info Approved by: portmgr blanketce706e44e6
Fix regression introduced in CVE-201403660 fix. Submitted by: gjb@ Obtained from: libxml2 upstream118edfa083
patch-parser.c: Replace allready applied patch with new patch from upstream to unbreak the xmlcatalog command. patch-uri.c: Revert uri.c commit that causes the document chain to fail. Reported by: antoine@ Tested by: bapt@ MFH: 2014Q499c102db3d
Update to 2.9.2. This release fixes CVE-2014-3660 (DoS). MFH: 2014Q4 Security: 0642b064-56c4-11e4-8b87-bcaec565249c06cf046998
Fix miss merge relating to iconv support. Reported & tested by: Cyril Kalinchikov <cyr.k@me.com>fc406f4c65
Make sure to remove all orphaned doc dirs. Submitted by: port jenkins via swills@0eb79be561
Make check-plist not trow it cookies.9d4f1e2d7b
Update to libxml2 2.9.1 [1] This version fixes CVE-2013-2877. Add upstream patch for CVE-2014-0191. CVE's Reported by: Akinori MUSHA <knu@iDaemons.org> Obtained from: GNOME dev repo [1], libxml2 upstream [2] MFH: 2014Q2607eebc44b
When linking a library libA with a library libB using libtool, if libB.la exists, libtool will add all libraries libB.la refers to (dependency_libs field) to the linker command line and store them in the dependency_libs field of libA.la. So everything that subsequently links with libA will also link to these extra libraries. This causes too much overlinking. This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs field in .la libraries during staging. However, because .la libraries have very limited use when dependency_libs is empty it makes sense to completely remove them during staging. So with this commit USES=libtool is modified to remove .la libraries and a new form (USES=libtool:keepla) is introduced in case they need to be kept (dependency_libs is still emptied). PORTREVISION is bumped on all ports with USES=libtool that install .la libraries. Most ports are also changed to add :keepla because .la libraries have to be kept around as long as there are dependent ports with .la libraries that refer to them in their dependency_libs field. In most cases :keepla can be removed again as soon as all dependent ports that install .la libraries have some form of USES=libtool added to their Makefile. PR: ports/188759 Exp-run: bdrewery Approved by: portmgr (bdrewery)aad09bc5e2
The FreeBSD x11@ and graphics team proudly presents a zeising, kwm production, with help from dumbbell, bdrewery: NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE This update switches over to use the new xorg stack by default on FreeBSD 9 and 10 stable, on osversions where vt(9) is available. It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in /etc/make.conf . FreeBSD 8-STABLE and released versions of FreeBSD still use the old version. A package repository with binary packages for new xorg will be available soon. This patch also contains updates of libxcb and related ports, pixman, as well as some drivers and utilities. Bump portrevisions for xf86-* ports, as well as virtualbox-ose-additions due to xserver version change. Apart from these updates, the way shared libraries are handled has been changed for all xorg ports, as well as libxml2 and freetype, which means ltverhack is gone and as a consequence shared libraries have been bumped. The plan is that this change will make library bumps less likely in the future. All affected ports have had their portrevisions bumped as a consequence of this. Fix some issues where WITH_NEW_XORG weren't detected properly on CURRENT. Update instructions, hardware support, and more notes can be found on https://wiki.freebsd.org/Graphics Thanks to: all testers, bdrewery and the FreeBSD x11@ team exp-run by: bdrewery [1] PR: ports/187602 [1] Approved by: portmgr (bdrewery), core (jhb)39fc32e828
- Add STAGEDIR support. - Use *_CONFIGURE_WITH. - Add workaround for an iconv incompatibility on 10.X and later.839dc18139
Add NO_STAGE all over the place in preparation for the staging support (cat: textproc)0068f2d47f
Introduce variable ICONV_PREFIX at Mk/Uses/iconv.mk. The default for pre 100043 is ${LOCALBASE} and /usr otherwise. Convert all ports to new variable usage.
Approved by: portmgr (bapt, implicit)7046a55fd8Track down the latest USE_GNOME=pkgconfiga79c5a7d1a
- Remove MAKE_JOBS_SAFE variable Approved by: portmgr (bdrewery)d4041784dc
- Convert USE_ICONV=yes to USES=iconv - Change USE_GNOME=pkgconfig|gnomehack to USES=pathfix|pkgconfig and USE_GETTEXT=yes to USES=gettext while here95e7081976
Fix build with LZMA. All supported versions have liblzma in the base. Approved by: gnome (mezz) Feature safe: yes879bb9b6c2
- Add http mirror in case FTP is not available Approved by: gnome (kwm) Approved by: portmgr (implicit)9d61e86da1
Fix options evaluation that got mixed up in the OptionsNG converstion. PR: ports/177480 Submitted by: scf@ Pointyhat for: kwm2e337aebfc
Fix typo PR: ports/177480 Submitted by: Sayetsky Anton <vsjcfm@gmail.com>11b42c3627
Update to 2.8.0. [1] Add patch to fix CVE-2013-0338 and CVE-2013-0339. [2] Convert to OptionsNG, rename patches to standard form. [1] Notified by: swills@ [2] Obtained from: gnome team repo [1] Security: 843a4641-9816-11e2-9c51-080027019be0be6202887a
Switch main site and mirror around. The mirror is still valid but it is really slow. Reported by: many Feature safe: yesc7d5467d51
- Revert previous change to add -pthread since libxml2 is not threaded, but is thread-safe, so -pthread is not needed here, but in threaded programs that use libxml2 Pointed out by: ale@ Discussed with: marcus, kwm Pointyhat to: swills8c33e8cf1b
- Build with -pthread and include -pthread in xml2-config --libs output when threads are enabled PR: ports/171353 Discussed with: marcus, kwm Approved by: marcus25a5a99b79
Merge the patch-Makefile.in into patch-aa which already patched Makefile.in.9df7deee2a
Compile static libxml2.a with -fPIC so 3rd party shared libs can link statically with libxml2.a. OK from: mezz12e0349f95
Fix the disable iconv option. PR: ports/167211 Submitted by: sunpoet4bc0dc3de0
Document and fix a off-by-one vulnability in libxml2. Obtained from: libxml upstream Security: b8ae4659-a0da-11e1-a294-bcaec565249cb7e1fac56a
Fix last commit which broke the build. Feature safe: yesb4387127d5
-Make the iconv optional. PR: ports/162571 Submitted by: Pedro Giffuni <giffunip@tutopia.com> Feature safe: yes4a44abaad9