CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

www/suphp 0.7.2_2

Securely execute PHP scripts under Apache

0
unaddressed
0
VuXML only
0
fixed
0
open problem reports

Port info

Maintainer
freebsd-ports@dan.me.uk
Packages
latest: suphp-php82 0.7.2_2, suphp-php83 0.7.2_2, suphp-php84 0.7.2_2, suphp-php85 0.7.2_2, suphp-php86 0.7.2_2
Upstream
up to date
Last update
to 0.7.2_2 · 40843b1ccb
Quarterly
2026Q4: suphp-php82 0.7.2_2, suphp-php83 0.7.2_2, suphp-php84 0.7.2_2, suphp-php85 0.7.2_2, suphp-php86 0.7.2_2
WWW
https://www.suphp.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install suphp-php82
# pkg install suphp-php83
# pkg install suphp-php84
# pkg install suphp-php85
# pkg install suphp-php86
installs suphp-php82 0.7.2_2, suphp-php83 0.7.2_2, suphp-php84 0.7.2_2, suphp-php85 0.7.2_2, suphp-php86 0.7.2_2 from latest; from quarterly (2026Q4) suphp-php82 0.7.2_2, suphp-php83 0.7.2_2, suphp-php84 0.7.2_2, suphp-php85 0.7.2_2, suphp-php86 0.7.2_2
Port
# cd /usr/ports/www/suphp && make install clean
# make -C /usr/ports/www/suphp config  # change options first
Size
76 KiB download · 218 KiB installed
Depends on
lang/php82 8.2.35_2, www/apache24 2.4.69
License
GPLv2
Options
1 of 1 on in the package: DOCS
pkg-message
Shown after installing
SuPHP has no upstream maintainer and thus is not actively having
bugs and security issues addressed.

Its security track record is pretty good. The worst so far has been
privilege escalation to the httpd user, which is no worse than not
using SuPHP.

It is advisable to convert your system to PHP-FPM if possible.

The port maintainer's thoughts on sandboxing PHP are here:

  http://blog.shatow.net/post/2013-07-17-sandboxing-php-part1.markdown

An overview of using PHP-FPM for application sandboxing is here:

  http://blog.shatow.net/post/2013-11-27-sandboxing-php-part2.markdown
Note
Size, dependencies, options and messages are those of suphp-php82.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 16✗✗–
FreeBSD 150.7.2_20.7.2_2–
FreeBSD 140.7.2_20.7.2_20.7.2_2

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 150.7.2_20.7.2_2–
FreeBSD 140.7.2_20.7.2_20.7.2_2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 0.7.2_2.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (75)

Alex Dupre (ale) · 0.5.2_1
Fix or remove obsolate or broken ways to depend on php.
fbc062586d
Pav Lucistnik (pav) · 0.5.2_1
- Add support for Apache 2.2

PR:		ports/94034
Submitted by:	Craig Boston <craig@yekse.gank.org>
Approved by:	Jeremy Chadwick <freebsd@jdc.parodius.com> (maintainer)
f0df633c49
Edwin Groothuis (edwin) · 0.5.2_1
SHA256ify

Approved by: krion@
84b1517c16
Clement Laforet (clement) · 0.5.2_1
- prepare removal of www/apache2 in favor of www/apache20 for naming   consistency - add entries in UPDATING (for apache22 too)

PR:		ports/78119
Repocopied by:	marcus
05684b80dd
Pav Lucistnik (pav) · 0.5.2_1
- Avoid make -C fixing build on FreeBSD 4.8 and older - Expand CONFLICTS - Style

PR:		ports/73226
Submitted by:	Jeremy Chadwick <freebsd@jdc.parodius.com> (maintainer)
a7ffb3b0d0
Volker Stolz (vs) · 0.5.2_1
- Fix "make -C"-issues - Unregister from Apache through apxs on deinstall - Cleanup

PR:		ports/70345
Submitted by:	Jeremy Chadwick (maintainer)
80e1966e4e
Volker Stolz (vs) · 0.5.2
Needs 'make -C', available since 4.9.

PR:		ports/69624
Submitted by:	Jeremy Chadwick (maintainer)
8420e95755
Tilman Keskinoz (arved) · 0.5.2
Change logic of the LOGFILE path: 	Assuming the user DOES NOT specify the         LOG_PATH variable upon build (by default, it's empty). 	The logfile will end up in / (a.k.a. /suphp.log)

PR:		69334
Submitted by:	Jeremy Chadwick <freebsd@jdc.parodius.com>
2cfe1f6bbf
Pav Lucistnik (pav) · 0.5.2
- Unbreak on 4.x: adapt make(1) syntax

PR:		ports/69139
Submitted by:	Jeremy Chadwick <freebsd@jdc.parodius.com> (maintainer)
64de42939c
Clement Laforet (clement) · 0.5.2
- Update to 0.5.2   Add a workaroung to make it work with apache 2 (due to an apr bug)   (so be careful) - Pass maintainership to submitter

PR:             ports/69048
Submitted by:   Jeremy Chadwick <freebsd@jdc.parodius.com>
686ce339ee
Clement Laforet (clement) · 0.5.1
- s/--enable-setid-mode/--with-setid-mode/

Reported by:	Andries Filmer <andries@netexpo.nl>
0eb0ad5f27
Clement Laforet (clement) · 0.5.1
- Add WITH_LOGNAME and WITH_LOGPATH knobs.   I kept LOG_NAME to not break POLA (Will be removed for next release).

Requested by:	Dennis Koster <dennis@phlex.net>
82a666fe43
Clement Laforet (clement) · 0.5.1
Fix mispelled CONFIGURE_ARGS option

Spotted by:	Johan Mulder <johan@localhost.nl>
5b35dfde8e
Clement Laforet (clement) · 0.5.1
- Update to 0.5.1

This version is mainly a bugfix release, fixing a bug causing a
segmentation fault in the Apache 2 module and improving the handling
of environment variables. Instead of setting unneeded / unwanted
environment variables to an empty string, they are now completely
removed from the environment.
15430971a1
Clement Laforet (clement) · 0.5_2
- SIZEify distinfo
3b8591d72d
Joe Marcus Clarke (marcus) · 0.5_2
Bump PORTREVISION on all ports that depend on gettext to aid with upgrading.

(Part 1)
73f7c91b5d
Clement Laforet (clement) · 0.5_1
- Fix suPHP. - Bump PORTREVISION

Noticed by:         Starhost.nl - N.Elsten <elsten@starhost.nl>
Approved by:        erwin (mentor) (implicitly)
ab97728208
Clement Laforet (clement) · 0.5
- Update my email address

Approved and reviewed by:    erwin (mentor)
3887814e09
Clement Laforet (clement) · 0.5
Update to 0.5 now suPHP supports apache2.

Approved by:    erwin (mentor) (implicitly)
32db161a56
Joe Marcus Clarke (marcus) · 0.3.1
Use the new Apache bits from bsd.port.mk.

Submitted by:	dinoex
f4d7c801f8
Yen-Ming Lee (leeym) · 0.3.1
Update to 0.3.1

PR:		57681
Submitted by:	Clement Laforet <sheepkiller@cultdeadsheep.org>
Release
6bd1e92fc3
Edwin Groothuis (edwin) · 0.3
[update] www/suphp: update to 0.3 and fix a security leak introduced with previous patch

- update to 0.3
	- add a workaround to don't use getpwuid to performs check for apache user (since 4.x
	  doesn't support getpwuid_r).
	- use %%DOCSDIR%%

PR:		ports/55952
Submitted by:	Clement Laforet <sheepkiller@cultdeadsheep.org>
ba63502f38
Daichi GOTO (daichi) · 0.2.3_1
fix www/suphp:   - fix critical problem, due to wrong dependency.     lang/php4-cli -> www/php4-cgi

PR:		54558
Submitted by:	Clement Laforet <sheepkiller@cultdeadsheep.org> (maintainer)
b8e000988a
Daichi GOTO (daichi) · 0.2.3
update www/suphp: 0.2.2 --> 0.2.3     * update suphp to 0.2.3     * fix bento build (apxs related problem)     * Separate build/install stages for mod_suphp

PR:		53873
Submitted by:	Clement Laforet <sheepkiller@cultdeadsheep.org>
Pointed out by:	bento via kris
527c7deb74
Daichi GOTO (daichi) · 0.2.2_1
Add suphp 0.2.2, suPHP is a combination which provides a wrapper for PHP.

PR:		42790
Submitted by:	Clement Laforet <sheepkiller@cultdeadsheep.org>
3b92dfd33d
« newest← newerpage 2 of 2