From nobody Wed Aug 5 13:40:39 2026 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hFWkw329Vz6nJ6K for ; Wed, 05 Aug 2026 13:40:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hFWkw1cN2z3gWl for ; Wed, 05 Aug 2026 13:40:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785937240; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jRV6N+exTuodxtz1e5nf1r3Zaq1kh+ABjYq6IGUq7x8=; b=j7We43WxSwPn6OttiB7YQo1lQZ17o8MlYZ4BsC0G6+Ib9bQhiRZpuj/6JZhgcwXUsyouyo eX8JmJ2jmdTwXt5/57w+wipAAj49lTuJ0dUUKgQ01H5Mh9yX016kwoqys/YxoaJTQx53w4 wyjfpFmn3xU5w21f09bhyCChBdtGibl28wu8+t7bMtVvhiEaf+7ITRZUUryX/reiZiP+n+ V0gs24rkIZXalcH23MBDS12c9JEyPjZ4YeoemtScID9N8ItE6Ad8/oHwSNhralRpGReVH5 KVoQxowhLlrE55cTDOG8W2JW74J6K35NVzdz5y1/eNh40BUMfzhUlhzvnkPo3w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785937240; a=rsa-sha256; cv=none; b=mpQ0IEF78D2NR6hzDplow1AMhAdOV1YiaQvjDJ6sEJTovUzDdA+0kGErawwXuvl+GpBSj2 4QzOP+djJOcItWbOFRDZbqDfAOEs+Qr2YGExfzRMzZut92OJGnbtVoKi0mbp9SDezg9YOj OuA7XvpHWVzOcHs/S7z3s+ZTJL2dt8xTvx2EvVZfNJV+wcHhTf9mA6rXdWY1m7MngX/QQB xJJohgnpFLfJuP3kPcnUQ47PxXnU3y67bO6ROYCSmEy6lG0sNC5MYnYWNXQlOH27is23br gRIMMUYsxr0p7yeD8bjjrE34ZMxZuRHJC4dseelHFS+e1IweAd4WRTv2yyGBdQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785937240; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=jRV6N+exTuodxtz1e5nf1r3Zaq1kh+ABjYq6IGUq7x8=; b=GrZbsA4e2O3SQcw3kPcbNWrmywpU54o3zKMwx/+S1S7t2/wnCuyKzUOg2XpfJddmuZ31lL eYAKsvWrgh7n5Yzn73C3TRQex+YSgz70Sou1m8EdCtCWiINo6UhtMsIfYicLwjgO9HDopf xl0SAj+YLy6ulinryB4KEU/Q1LlC33FTHgoru3ECKQjj3kj1sFPyKNz/VvgnaitJ4fCy1K cq52tGU4SHEzbcKjHvsLQsgIiVPK7X/HxIwEzXAg1UTAmpcQvMnjOIEWfVx/FHPqx35BgM 83B0qGDFOfQ5tICCRIQ5zjSmhLA4a/l9QMiWiXKAkxqpr/nQetCgfBY9mTx2YA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hFWkw076Qzcgs for ; Wed, 05 Aug 2026 13:40:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3bc70 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 05 Aug 2026 13:40:39 +0000 To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Jochen Neumeister Subject: git: 7f4a5b97c0d6 - main - security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: joneum X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7f4a5b97c0d65c00c22c8faf2cd89e47f38ecae4 Auto-Submitted: auto-generated Date: Wed, 05 Aug 2026 13:40:39 +0000 Message-Id: <6a733d57.3bc70.39d6d25d@gitrepo.freebsd.org> The branch main has been updated by joneum: URL: https://cgit.FreeBSD.org/ports/commit/?id=7f4a5b97c0d65c00c22c8faf2cd89e47f38ecae4 commit 7f4a5b97c0d65c00c22c8faf2cd89e47f38ecae4 Author: Jochen Neumeister AuthorDate: 2026-08-05 13:37:00 +0000 Commit: Jochen Neumeister CommitDate: 2026-08-05 13:40:30 +0000 security/vuxml: Document MySQL vulnerabilities from CPU Jul 2026 The Oracle Critical Patch Update of July 2026 fixes 54 issues in Oracle MySQL. 31 of them affect the 8.4 series, 43 the 9.7 series, including the MySQL Router shipped with the server ports. Three issues require no credentials: one in the X Plugin and two in MySQL Router, the latter of which allows unauthorized read and write access. The remaining ones mostly need a privileged account and lead to a denial of service. Fixed in 8.4.11 and 9.7.2 respectively. Sponsored by: Netzkommune GmbH --- security/vuxml/vuln/2026.xml | 168 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 168 insertions(+) diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index cbe34e1292b9..5c9a7117bf59 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,171 @@ + + MySQL 8.4 -- Multiple vulnerabilities + + + mysql84-client + 8.4.11 + + + mysql84-server + 8.4.11 + + + + +

The Oracle Critical Patch Update of July 2026 addresses 54 issues + in Oracle MySQL, 31 of which apply to the MySQL 8.4 series and to + the MySQL Router shipped with these ports.

+

The affected server components are Optimizer, Replication, + Group Replication (plugin and GCS), X Plugin, Clone Plugin, + InnoDB, JSON, DDL, Performance Schema and Pluggable + Authentication.

+

Most of the issues require an authenticated account, in many + cases one with high privileges, and let an attacker hang or + repeatedly crash the server, resulting in a denial of service. + Three issues need no credentials at all: CVE-2026-60315 (CVSS + 8.2) is reachable over the X protocol and affects availability, + while CVE-2026-60314 and CVE-2026-60725 affect MySQL Router over + HTTP, the latter allowing unauthorized read and write access. + The highest rated issue for this branch is CVE-2026-60163 (CVSS + 8.4) in the Group Replication plugin, exploitable locally with + full impact on confidentiality, integrity and availability.

+

Please refer to the referenced CVE entries for the details of + each individual issue.

+ + + + CVE-2026-46936 + CVE-2026-47012 + CVE-2026-47023 + CVE-2026-47052 + CVE-2026-47064 + CVE-2026-60145 + CVE-2026-60163 + CVE-2026-60177 + CVE-2026-60178 + CVE-2026-60182 + CVE-2026-60183 + CVE-2026-60184 + CVE-2026-60185 + CVE-2026-60186 + CVE-2026-60187 + CVE-2026-60188 + CVE-2026-60189 + CVE-2026-60190 + CVE-2026-60191 + CVE-2026-60314 + CVE-2026-60315 + CVE-2026-60316 + CVE-2026-60331 + CVE-2026-60332 + CVE-2026-60585 + CVE-2026-60725 + CVE-2026-60747 + CVE-2026-61081 + CVE-2026-61094 + CVE-2026-61096 + CVE-2026-61109 + https://www.oracle.com/security-alerts/cpujul2026.html + https://dev.mysql.com/community/security/advisories/2026-07-21/ + + + 2026-07-21 + 2026-08-05 + + + + + MySQL 9.7 -- Multiple vulnerabilities + + + mysql97-client + 9.7.2 + + + mysql97-server + 9.7.2 + + + + +

The Oracle Critical Patch Update of July 2026 addresses 54 issues + in Oracle MySQL, 43 of which apply to the MySQL 9.7 series and to + the MySQL Router shipped with these ports. The 9.7 branch is + affected by every server issue of the 8.4 branch plus twelve + additional ones in code paths that only exist in 9.x.

+

The affected server components are Optimizer, Replication, + Group Replication (plugin and GCS), X Plugin, Clone Plugin, + InnoDB, JSON, JSON Duality, GIS, DDL, Configurator, Performance + Schema and Pluggable Authentication.

+

Most of the issues require an authenticated account, in many + cases one with high privileges, and let an attacker hang or + repeatedly crash the server, resulting in a denial of service. + Three issues need no credentials at all: CVE-2026-60315 (CVSS + 8.2) is reachable over the X protocol and affects availability, + while CVE-2026-60314 and CVE-2026-60725 affect MySQL Router over + HTTP, the latter allowing unauthorized read and write access. + The highest rated issue for this branch is CVE-2026-60163 (CVSS + 8.4) in the Group Replication plugin, exploitable locally with + full impact on confidentiality, integrity and availability. + CVE-2026-60181 in the Configurator component requires user + interaction and is specific to the 9.7 branch.

+

Please refer to the referenced CVE entries for the details of + each individual issue.

+ + + + CVE-2026-46936 + CVE-2026-47008 + CVE-2026-47012 + CVE-2026-47023 + CVE-2026-47052 + CVE-2026-47064 + CVE-2026-60145 + CVE-2026-60163 + CVE-2026-60174 + CVE-2026-60177 + CVE-2026-60178 + CVE-2026-60181 + CVE-2026-60182 + CVE-2026-60183 + CVE-2026-60184 + CVE-2026-60185 + CVE-2026-60186 + CVE-2026-60187 + CVE-2026-60188 + CVE-2026-60189 + CVE-2026-60190 + CVE-2026-60191 + CVE-2026-60194 + CVE-2026-60195 + CVE-2026-60311 + CVE-2026-60314 + CVE-2026-60315 + CVE-2026-60316 + CVE-2026-60324 + CVE-2026-60331 + CVE-2026-60332 + CVE-2026-60585 + CVE-2026-60718 + CVE-2026-60725 + CVE-2026-60747 + CVE-2026-61081 + CVE-2026-61093 + CVE-2026-61094 + CVE-2026-61096 + CVE-2026-61108 + CVE-2026-61109 + CVE-2026-61128 + CVE-2026-61144 + https://www.oracle.com/security-alerts/cpujul2026.html + https://dev.mysql.com/community/security/advisories/2026-07-21/ + + + 2026-07-21 + 2026-08-05 + + + PowerDNS Recursor -- multiple vulnerabilities