Port details

textproc/libxml22.15.4

XML parser library for GNOME

unaddressed

VuXML only, still affected

fixed

Maintainer: desktop@FreeBSD.org
Packages: libxml2 2.15.4
Upstream: up to date
CPE: xmlsoft:libxml2 from the port
WWW: http://xmlsoft.org/
Links: cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (29)

Show 29 fixed

VuXML entries whose affected range this version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).

CVE-2026-86140	8.0	2026-09-05	In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
CVE-2026-86142	6.9	2026-09-05	In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
CVE-2026-86143	6.9	2026-09-05	In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for i…
CVE-2026-86138	6.9	2026-09-05	In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
CVE-2026-86139	6.9	2026-09-05	In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
CVE-2026-86144	5.6	2026-09-05	In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PA…
CVE-2026-86141	2.9	2026-09-05	xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL c…
CVE-2026-86137	2.9	2026-09-05	In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.

libxml2 -- multiple vulnerabilitiesentered 2025-07-12

CVE-2025-49794, CVE-2025-49795, CVE-2025-6021, CVE-2025-6170

libxml2 -- Use After Freeentered 2025-05-31

CVE-2024-56171

libxml2 -- Stack-based Buffer Overflowentered 2025-05-31

CVE-2025-24928

libxml2 -- multiple vulnerabilitiesentered 2023-04-16

CVE-2023-28484, CVE-2023-29469

libxml2 -- Possible denial of serviceentered 2021-05-23

CVE-2021-3541

libxml -- multiple vulnerabilitiesentered 2020-09-22

no CVE referenced

libxml2 -- Multiple Issuesentered 2017-12-13

CVE-2017-8872, CVE-2017-9047, CVE-2017-9048, CVE-2017-9049, CVE-2017-9050

libxml2 -- multiple vulnerabilitiesentered 2016-08-28

CVE-2016-1762, CVE-2016-1833, CVE-2016-1834, CVE-2016-1835, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, CVE-2016-1840, CVE-2016-3627, CVE-2016-3705, CVE-2016-4449, CVE-2016-4483

libxml2 -- multiple vulnerabilitiesentered 2015-11-20

CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7941, CVE-2015-7942, CVE-2015-8035, CVE-2015-8241, CVE-2015-8242

libxml2 -- Enforce the reader to run in constant memoryentered 2015-07-01

CVE-2015-1819

libxml2 -- Denial of serviceentered 2014-10-18

CVE-2014-3660

libxml2 -- entity substitution DoSentered 2014-05-06

CVE-2014-0191

libxml2 -- lack of end-of-document check DoSentered 2013-07-10

CVE-2013-2877

libxml2 -- cpu consumption Dosentered 2013-03-29

CVE-2013-0338, CVE-2013-0339

libxml2 -- An off-by-one out-of-bounds write by XPointerentered 2012-05-18

CVE-2011-3202

libxml2 -- heap buffer overflowentered 2012-02-27

CVE-2011-3919

libxml -- Integer overflowentered 2011-11-10

CVE-2011-1944

libxml2 -- multiple vulnerabilitiesentered 2008-11-19

CVE-2008-4225, CVE-2008-4226

libxml2 -- two vulnerabilitiesentered 2008-10-15

CVE-2008-3281, CVE-2008-3529

libxml -- remote buffer overflowsentered 2004-11-09

CVE-2004-0989

libxml2 stack buffer overflow in URI parsingentered 2004-02-25

CVE-2004-0110

Commits (287)

2000-11-29 12:46Maxim Sobolev (sobomax) · 2.2.8_1

Update iconv to 2.0 and reflect shared library version bump.

PR:		23163, 23164, 23165
Submitted by:	maintainer

2d8ff23a74

2000-11-15 17:29Ade Lovett (ade) · 2.2.8_1

Persuade libxml2 to install into different filesystem space than libxml (cursing the author all the way for having two incompatible versions of their software do this).

This is still not 100%, but a step in the right direction for those
ports that need libxml2, but also have to co-exist with GNOME
(which, for the moment, uses libxml exclusively).

Max will be committing a port shortly to show exactly how to
tell a port to use libxml2 under this new scheme of things.

As and when GNOME (the primary consumer of libxml) moves over
to libxml2, these hacks will be reverted, and similar hacks put
in to libxml until it dies a quiet death.

Submitted by:	sobomax

5ab6c2fc42

2000-11-14 22:49Ade Lovett (ade) · 2.2.8

Update to 2.2.8

dbe5261b5e

2000-11-02 22:19Ade Lovett (ade) · 2.2.7

Update to 2.2.7

8b95c3d950

2000-10-16 04:48Ade Lovett (ade) · 2.2.5

Update to 2.2.5

2ba28250dd

2000-10-03 18:32Ade Lovett (ade) · 2.2.4

Update to 2.2.4 and enable iconv support.

92e94c953d

2000-09-19 21:13Ade Lovett (ade) · 2.2.3

Update to 2.2.3

bd178865a8

2000-08-17 18:40Ade Lovett (ade) · 2.2.2

Update to 2.2.2

77c0d15647

2000-08-04 03:17Ade Lovett (ade) · 2.2.1

Update to 2.2.1

c75a396481

2000-07-02 11:30Ade Lovett (ade) · 2.1.1

Bring libxml2 2.1.1 into the fold after a repo-copy.  This will eventually replace libxml for GNOME.

248fb0cf95

2000-07-01 07:56Ade Lovett (ade) · 1.8.8

Update to 1.8.8

cdc2e6ac19

2000-06-16 23:52Satoshi Asami (asami) · 1.8.7

Rename INSTALLS_SHLIBS to INSTALLS_SHLIB.  (There was a typo in the previous commit message to bsd.port.mk, which said INSTALL_SHLIBS.  Boo.)

Line up the rhs of variable assignments nicely.  Remove a couple of extra
whitespaces while I'm here.

Suggested by:	 sobomax

ffb21b5654

2000-06-16 10:48Maxim Sobolev (sobomax) · 1.8.7

Fourth round of INSTALLS_SHLIBS conversion.

dc1177a9a5

2000-04-09 23:54Chris Piazza (cpiazza) · 1.8.7

Update with the new PORTNAME/PORTVERSION variables

37c0ef8e3b

2000-03-06 11:01Ade Lovett (ade)

Update to 1.8.7

e1b9283501

2000-02-03 22:30Ade Lovett (ade)

Update to 1.8.6

ed8a8521f8

2000-01-22 05:43Ade Lovett (ade)

Update to 1.8.5

cf96f2d7f6

2000-01-14 21:40Ade Lovett (ade)

Update to 1.8.4

16fbd17adc

2000-01-10 22:19Ade Lovett (ade)

Update to 1.8.3

27342b5d60

2000-01-07 03:07Yukihiro Nakai (nakai)

Change MAINTAINER to ade@FreeBSD.org .

a6844f7b83

1999-12-28 03:32Yukihiro Nakai (nakai)

Update to 1.8.2

PR:		ports/15725
Submitted by:	Ade Lovett <ade@lovett.com>

54985dbae5

1999-12-24 11:44Yukihiro Nakai (nakai)

Update to 1.8.0

PR:		ports/15503
Submitted by:	Ade Lovett <ade@lovett.com>

ae1e462c77

1999-12-04 20:08Steve Price (steve)

New location on MASTER_SITE.

PR:		15238, 15248
Submitted by:	Ade Lovett <ade@lovett.com>

4275cb17e6

1999-10-14 05:39Yukihiro Nakai (nakai)

PR:	ports/14303 Submitted by:Ade Lovett <ade@lovett.com> Update to 1.7.3

b29c6736cb

1999-08-31 04:11Peter Wemm (peter)

$Id$ -> $FreeBSD$

85bc214e28

1999-08-22 05:40Steve Price (steve)

Update to version 1.4.0.

PR:		12781 (2 of 19)
Submitted by:	Ade Lovett <ade@lovett.com>

2632c100ba

1999-06-26 21:22Tim Vanderhoek (hoek)

#4/4 enforcing Caps, no period

[Has anyone figured-out what makes the number 393 so interesting to PW, now?]

I wonder what was going through Jordan's head during his infamous
$Id$-smashing commit.

Before I forget....

Thanks to naddy@mips.rhein-neckar.de (Christian Weisgerber) for prompting
this commit.  See msg-id: 7geokh$tje$1@mips.rhein-neckar.de

a84b5b5f94

1999-04-08 20:08Steve Price (steve)

DISTFILES moved on MASTER_SITE.

466b1016aa

1999-03-09 02:13Jacques Vidrine (nectar)

Upgrade to GNOME 1.0.  The following are the details:

ports/audio/esound			0.2.7    ->  0.2.8	PR ports/10422
 ports/audio/gnomeaudio			0.99.8   ->  1.0.0	PR ports/10426
 ports/audio/libaudiofile		0.1.5    ->  0.1.6	PR ports/10421
 ports/deskutils/gnomepim		0.99.8.1 ->  1.0.1	PR ports/10435
 ports/devel/ORBit			0.3.98   ->  0.4.0	PR ports/10423
 ports/devel/gettext			shared libs now		PR ports/10293
 ports/devel/glib12			1.1.16   ->  1.2.0	PR ports/10419
 ports/devel/libgtop			0.99.8   ->  1.0.1	PR ports/10430
 ports/games/gnomegames			0.99.8   ->  1.0.1	PR ports/10436
 ports/graphics/electriceyes		distfile moved		PR ports/10437
 ports/graphics/imlib			1.9.3    ->  1.9.4	PR ports/10424
 ports/lang/gnomeobjc			0.99.3   ->  1.0.1	PR ports/10441
 ports/math/gnumeric			0.6      ->  0.15	PR ports/10439
 ports/misc/gnomeutils			0.99.5   ->  1.0.1	PR ports/10442
 ports/sysutils/gnomeadmin		0.99.1   ->  1.0.1	PR ports/10445
 ports/sysutils/gnomecontrolcenter	0.99.3.1 ->  1.0.1	PR ports/10446
 ports/sysutils/gtop			0.99.2   ->  1.0.1	PR ports/10477
 ports/textproc/libxml			0.99.8   ->  1.0.0	PR ports/10438
 ports/www/libghttp			distfile moved		PR ports/10429
 ports/x11/gnome			0.99.3   ->  1.0.0	PR ports/10450
 ports/x11/gnomecore			0.99.8.1 ->  1.0.1	PR ports/10432
 ports/x11/gnomelibs			0.99.8.1 ->  1.0.1	PR ports/10425
 ports/x11-fm/gnomemc			4.5.10   ->  4.5.23	PR ports/10448
 ports/x11-toolkits/gtk-engines		0.1      ->  0.5	PR ports/10427
 ports/x11-toolkits/gtk12		1.1.6    ->  1.2.0	PR ports/10420

Note that repository copies were made before this commit, as follows:

 ports/devel/glib11-devel       -> ports/devel/glib12
 ports/x11-toolkits/gtk11-devel -> ports/x11-toolkits/gtk12

Submitted by:	Jeremy Lea <reg@shale.csir.co.za>

f4442a7aa7

1999-02-24 23:12Vanilla I. Shu (vanilla)

Upgrade to 0.99.8.

b66f03295a

1999-02-22 03:52Steve Price (steve)

New checksum.

7d3ed01d62

1999-01-31 20:06Vanilla I. Shu (vanilla)

Upgrade to 0.99.5.

6dcb4ed514

1999-01-27 09:31Bill Fenner (fenner)

Use ${MASTER_SITE_GNOME}

dc90d64404

1999-01-17 09:44Vanilla I. Shu (vanilla)

Upgrade to 0.99.3.

61bb3e5b9c

1999-01-12 17:51Vanilla I. Shu (vanilla)

Change maitainer's email address, and BROKEN some gnome ports until I upgrade it.

edecf3c4f0

1999-01-05 09:00Vanilla I. Shu (vanilla)

Upgrade gnumeric to 0.5, libxml to 0.99, Correct gtk11-devel's PLIST, and fix some configure problem of electriceyes.

5902155466

1998-10-10 15:48Vanilla I. Shu (vanilla)

Import XML parser library. PR:		ports/8227 Submitted by:	<nakai@technologist.com>

e1fbee612d

lang/php82 +57 related 11 CVEs · 9.2 fixed 8.2.35 VuXML	Oct 21
lang/php83 +57 related 11 CVEs · 9.2 fixed 8.3.36 VuXML	Oct 21
lang/php84 +55 related 12 CVEs · 9.2 fixed 8.4.27 VuXML	Oct 21
lang/php85 +54 related 12 CVEs · 9.2 fixed 8.5.12 VuXML	Oct 21
lang/php86 2 open · 9.2 → 8.6.0.r4 VuXML	Oct 21
www/linux-chrome 819 open · 9.8	Oct 20
graphics/py-pillow 2 open · 8.2	Oct 19
textproc/antiword 2 open · 6.8	Oct 16
databases/mariadb1011-client +1 related 14 CVEs · 9.9 fixed 10.11.19	Oct 16
databases/mariadb114-client +1 related 14 CVEs · 9.9 fixed 11.4.13	Oct 16
databases/mariadb118-client +1 related 14 CVEs · 9.9 fixed 11.8.9	Oct 16
databases/mariadb123-client +1 related 15 CVEs · 9.9 fixed 12.3.3	Oct 16
net/freerdp 53 open · 9.4	Oct 16
net/freerdp3 33 CVEs · 8.7 fixed 3.32.2	Oct 16
astro/cfitsio 2 open · 6.9	Oct 15

node	Oct 24
node22	Oct 24
node24	Oct 24
node26	Oct 24
traefik	Oct 24
ca_root_nss	Oct 23
gitlab-ce	Oct 23
gitlab-ee	Oct 23
mailpit	Oct 23
vifm	Oct 23
brotli	Oct 22
chromium	Oct 22
jackson-core	Oct 22
jackson-databind	Oct 22
jackson-databind	Oct 22
keycloak	Oct 22
ungoogled-chromium	Oct 22
FreeBSD	Oct 21
p5-DBI	Oct 21
php82	Oct 21
php83	Oct 21
php84	Oct 21
php85	Oct 21
php86	Oct 21
powerdns-recursor	Oct 21