From owner-freebsd-ports@freebsd.org Thu Aug 11 18:45:32 2016 Return-Path: Delivered-To: freebsd-ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1740EBB6B20 for ; Thu, 11 Aug 2016 18:45:32 +0000 (UTC) (envelope-from bsdports@cloudzeeland.nl) Received: from ares.cloudzeeland.nl (cloudzeeland.xs4all.nl [83.161.133.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "cloudzeeland.nl", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id ABEB71F73 for ; Thu, 11 Aug 2016 18:45:31 +0000 (UTC) (envelope-from bsdports@cloudzeeland.nl) Received: from ares.cloudzeeland.nl (ares.cloudzeeland.nl [10.10.10.32]) by ares.cloudzeeland.nl (Postfix) with ESMTP id 00E504FAD4D1 for ; Thu, 11 Aug 2016 20:45:28 +0200 (CEST) Received: from [10.10.10.34] (daedalus.cloudzeeland.nl [10.10.10.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by ares.cloudzeeland.nl (Postfix) with ESMTPSA id DAAAE4FAD4D0 for ; Thu, 11 Aug 2016 20:45:27 +0200 (CEST) To: FreeBSD Ports ML From: JosC Subject: Perl upgrade - 5.20.x vulnerable Message-ID: <3f8f41ff-3262-1021-2e28-2aaae89849b6@cloudzeeland.nl> Date: Thu, 11 Aug 2016 20:45:30 +0200 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP on ares.cloudzeeland.nl Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.22 X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Aug 2016 18:45:32 -0000 Can someone tell me how to best upgrade from Perl5.20.x to the latest stable version? Tried to upgrade to Perl5.22 but got (also) the same issue while doing so: ===> Cleaning for perl5-5.20.3_14 ===> perl5-5.20.3_14 has known vulnerabilities: perl5-5.20.3_14 is vulnerable: p5-XSLoader -- local arbitrary code execution CVE: CVE-2016-6185 WWW: https://vuxml.FreeBSD.org/freebsd/3e08047f-5a6c-11e6-a6c3-14dae9d210b8.html perl5-5.20.3_14 is vulnerable: perl -- local arbitrary code execution CVE: CVE-2016-1238 WWW: https://vuxml.FreeBSD.org/freebsd/72bfbb09-5a6a-11e6-a6c3-14dae9d210b8.html 1 problem(s) in the installed packages found. => Please update your ports tree and try again. => Note: Vulnerable ports are marked as such even if there is no update available. => If you wish to ignore this vulnerability rebuild with 'make DISABLE_VULNERABILITIES=yes' *** Error code 1 Stop. make[1]: stopped in /usr/ports/lang/perl5.20 *** Error code 1 Stop. make: stopped in /usr/ports/lang/perl5.20 --- cut --- Thanks, Jos Chrispijn