FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2026-03-03 16:31:49 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
e5cf9f44-9a64-11f0-8241-93c889bb8de1openvpn-devel -- script injection vulnerability from trusted but malicious server

Gert Doering reports:

Notable changes beta1 -> beta2 are: [...] add proper input sanitation to DNS strings to prevent an attack coming from a trusted-but-malicous OpenVPN server (CVE: 2025-10680, affects unixoid systems with --dns-updown scripts and windows using the built-in powershell call)

Lev Stipakov writes:

On Linux (and similar platforms), those options are written to a tmp file, which is later sourced by a script running as root. Since options are controlled by the server, it is possible for a malicious server to execute script injection attack [...].

The original report is credited to Stanislav Fort .


Discovery 2025-09-24
Entry 2025-09-25
openvpn-devel
>= g20250629,1 lt g20250925,1

CVE-2025-10680
https://github.com/OpenVPN/openvpn/commit/0fb5a00549be6b065f9a4d61940ee06786d9fa61
https://github.com/OpenVPN/openvpn/commit/3a66045b407321c9d1c096227db164df3955ab40