From owner-freebsd-ports@freebsd.org Sat May 6 08:43:40 2017 Return-Path: Delivered-To: freebsd-ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7B1A2D5FDAA for ; Sat, 6 May 2017 08:43:40 +0000 (UTC) (envelope-from bsdports@cloudzeeland.nl) Received: from ares.cloudzeeland.nl (cloudzeeland.xs4all.nl [83.161.133.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "cloudzeeland.nl", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 15BEE1DCC for ; Sat, 6 May 2017 08:43:38 +0000 (UTC) (envelope-from bsdports@cloudzeeland.nl) Received: from ares.cloudzeeland.nl (unknown [10.10.10.32]) by ares.cloudzeeland.nl (Postfix) with ESMTP id 612C24FE7E0C for ; Sat, 6 May 2017 10:43:34 +0200 (CEST) Received: from [10.10.10.40] (styx.zeeland24.nl [82.176.127.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by ares.cloudzeeland.nl (Postfix) with ESMTPSA id 252114FE7E05 for ; Sat, 6 May 2017 10:43:34 +0200 (CEST) To: FreeBSD Ports ML From: Jos Chrispijn Subject: Keeping VuXML DB updated Message-ID: Date: Sat, 6 May 2017 10:43:37 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV using ClamSMTP on ares.cloudzeeland.nl X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 May 2017 08:43:40 -0000 Due to a vulnerability issue earlier with a port, I received some kind emails of using the command below to update the VuXML DB (which is not a part of the ports tree). I did so on my server and got the following output: --- cut --- > pkg audit -F vulnxml file up-to-date tiff-4.0.7_1 is vulnerable: tiff -- multiple vulnerabilities CVE: CVE-2017-7602 CVE: CVE-2017-7601 CVE: CVE-2017-7600 CVE: CVE-2017-7599 CVE: CVE-2017-7598 CVE: CVE-2017-7597 CVE: CVE-2017-7596 CVE: CVE-2017-7595 CVE: CVE-2017-7594 CVE: CVE-2017-7593 CVE: CVE-2017-7592 CVE: CVE-2017-5225 WWW: https://vuxml.FreeBSD.org/freebsd/2a96e498-3234-4950-a9ad-419bc84a839d.html 1 problem(s) in the installed packages found. --- cut --- What is the next procedure to follow; should I inform the port maintainer of the reported port ((ports are a user group effort) ) or should I update this port with "DISABLE_VULNERABILITIES=yes" ? Happy to contribute, Jos Chrispijn