VuXML (the Vulnerability and eXposure Markup Language) is an XML
application for documenting security bugs and corrections within
a software package collection such as the FreeBSD Ports Collection.
This port installs the DTDs required for validating VuXML documents.
security/vuxml: more cleanup
Remove duplicate cvename and url entries, and add the missing PORTEPOCH
to three ranges so pkg audit matches the affected packages at all.
Sponsored by: Netzkommune GmbH
security/vuxml: Validate url elements and blockquote cite attributes
make validate now rejects values that are not an http or https URL:
placeholders, empty values, a missing scheme, and typos such as ihttps.
Sponsored by: Netzkommune GmbH
security/vuxml: Replace ftp and mailto references with http URLs
Ten entries pointed at ftp sites or a mailing list address, which no
browser follows any more. Use the project's own http source, or the
advisory the entry already lists where the ftp host is gone.
Also repair two broken url values, a leftover "HERE" and an empty
element.
Sponsored by: Netzkommune GmbH
security/vuxml: Fix malformed URLs and misplaced CVE IDs
Repair 23 url, cite and href values that cannot work as a URL, and move
49 CVE IDs from url elements to cvename.
PR: 300379
Sponsored by: Netzkommune GmbH
security/vuxml: Fix malformed blockquote cite URLs
Thirteen entries carried a cite attribute that is not a URL: six were
empty or the string "null", three had lost their scheme and start with
"://", and four have no scheme at all. Use the URL from the references
of the same entry. One entry has no url at all, drop its empty
attribute there.
PR: 300379
Sponsored by: Netzkommune GmbH
security/vuxml: Fill in missing blockquote cite URLs
Six entries kept the "INSERT URL HERE" placeholder that newentry.sh puts
into the cite attribute, which ends up verbatim in the generated pages.
Each of them quotes a source that is already linked in its own references
block, so use that URL.
PR: 300379
Reported by: dvl
Sponsored by: Netzkommune GmbH
security/vuxml: Fix whitespace issues breaking the validate target
Drop a whitespace-only line before the amule entry and replace space
indentation with a tab in the uriparser entry.
PR: 300377
Sponsored by: Netzkommune GmbH
security/vuxml: Fix invalid range in py-setuptools entry
A stray greater-than sign in front of the lt element made the range
invalid against the DTD, which broke the validate target for everyone.
PR: 300377
Sponsored by: Netzkommune GmbH
security/vuxml: Document sqlite3 vulnerabilities fixed in 3.54.0
Ten issues were published on 2026-10-30, with VulnCheck as the
assigning CNA. Four of them corrupt the heap, in FTS5, in the session
extension and in the R-Tree module, and all of them need an attacker
supplied database file or SQL text.
Sponsored by: Netzkommune GmbH
security/vuxml: Document phpMyAdmin vulnerabilities
Seven issues in phpMyAdmin up to and including 5.2.3 were published on
2026-10-30, with VulnCheck as the assigning CNA. The worst of them is
an authentication bypass in the WebAuthn second factor, and the
request forgery in setup/validate.php needs no authentication at all.
There is no fixed release and no announcement from the project, so the
entry carries an open range for both ports.
Sponsored by: Netzkommune GmbH
security/vuxml: Document MySQL vulnerabilities of October 2026
Four entries: 8.4 and 9.7, fixed in 8.4.13 and 9.7.4; 26.7, which is
end of life and has no fix, with an open range; and the connectors,
fixed in 26.10.0. mysql-shell is listed with 9.7, it bundles and
statically links the MySQL client code.
The two issues in the bundled curl and OpenSSL copies are left out,
these ports build against the libraries of the system.
Sponsored by: Netzkommune GmbH
security/vuxml: fix markup of p5-GD entry
This fixes "make validate" and the vuxml build.
Fixes: f5bd9f0e379f ("security/vuxml: Document p5-GD security issues")
Pointy hat to: rodrigo
security/vuxml: fix build
Correct the <dates/> sections of two recently updated vulnerabilities
from 2025. These errors were caught by "make validate".
Fixes: c943f0b840f2 ("security/vuxml: adjust linux-rl9-libxslt package for
b0a3466f-5efc-11f0-ae84-99047d0a6bcc (+)")
Fixes: ec5bfc412d3c ("security/vuxml: adjust linux-rl9-libxml2 package version
for abbc8912-5efa-11f0-ae84-99047d0a6bcc (+)")
Pointy hat to: fluffy
security/vuxml: adjust linux-rl9-libxslt package for
b0a3466f-5efc-11f0-ae84-99047d0a6bcc (+)
Rerolled linux-rl9-libxslt-1.1.34_5 now includes fixes for mentioned CVEs
security/vuxml: Fix PHP entry d8e16d08-cd2f-11f1-8135-8447094a420f
- php85: the fixed version is 8.5.12, not 8.5.13
- Quote the security advisory instead of the pre-announcement
- Add references to the advisory and both GHSAs
Reported by: Dan Langille <dan@langille.org>
Sponsored by: Netzkommune GmbH
security/vuxml: Document multiple Erlang/OTP vulnerabilities
OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix CVE-2026-105236 and
CVE-2026-94200 in ssl, and complete the earlier incomplete fixes for
CVE-2026-42789 (public_key), CVE-2026-48856 (inets) and
CVE-2026-70405 (snmp); upstream revised all three advisories on
2026-10-14 to name these releases as the first patched ones.
CVE-2026-96596 in erl_tar gets its own entry: it affects OTP 29 only
and is fixed in 29.1.2.
security/vuxml: adjust linux-rl9-libxml2 package version for
abbc8912-5efa-11f0-ae84-99047d0a6bcc (+)
Rerolled linux-rl9-libxml2-2.9.13_10 now includes fixes for mentioned CVEs
