how to fix app vulnerable ?

[fff2024g]

Dear all :
when i running "pkg audit -F " command in shell. output was below .

xorg-server-21.1.11_1,1 is vulnerable:
xorg server -- Multiple vulnerabilities
CVE: CVE-2024-31083
CVE: CVE-2024-31081
CVE: CVE-2024-31080
WWW: https://vuxml.freebsd.org/freebsd/57561cfc-f24b-11ee-9730-001fc69cd6dc.html

xorg-server is vulnerable. how to fix this issue ? thanks.

 

[cracauer@]

The x server port is at 21.1.12.

So a simple update should do.

 

[fff2024g]

The x server port is at 21.1.12.

So a simple update should do.

dear cracauer :
i have run "pkg upgrade xorg-server" , no new version is ready to update . could you show to me how to upgrade this app ? thanks.

 

[richardtoohey2]

pkg update
pkg upgrade

Should update all your packages.

 

[shkhln]

The current turnaround time for updates to the latest amd64 package repo is 1-2 weeks. Quarterly might be slightly faster, but only if somebody bothered to backport those fixes and not at the branching time.

 

[cracauer@]

dear cracauer :
i have run "pkg upgrade xorg-server" , no new version is ready to update . could you show to me how to upgrade this app ? thanks.

Hm. It seems that you have to build the port until the packages are upgraded.

 

[richardtoohey2]

Should update all your packages.

... but you might have to wait a while

 

[SirDice]

Quarterly might be slightly faster, but only if somebody bothered to backport those fixes and not at the branching time.

Nothing is getting backported. The quarterly branch of the ports tree is simply updated with the new version.

But it looks like 2014Q2 hasn't been made yet (should be done around this time). I think that's why it hasn't been added to 2014Q1.

 

[shkhln]

Nothing is getting backported. The quarterly branch of the ports tree is simply updated with the new version.

Backporting is the term for the practice of applying commits from the more active branch to the less active branch: https://github.com/freebsd/freebsd-ports/commit/77f72c463b90237feeba97e05b597101cc407ebd.

 

[SirDice]

Backporting is the term for the practice of applying commits from the more active branch to the less active branch

That seems to be the case in the commit you posted. But the ports tree has a new version, 21.1.12, that doesn't seem related to this commit. Mentioned commit is also for x11-servers/xwayland-devel but the audit output talks about x11-servers/xorg-server? There's nothing being backported here as far as I can see.

ports - FreeBSD ports tree

cgit.freebsd.org

 

[shkhln]

You can think whatever you want, but I know the terms very well and I don't misuse them. 2024Q1 can be considered a version of the ports tree in this case.