git: 040b9e117023 - main - security/vuxml: Document textproc/p5-Text-CSV_XS vulnerabilities

The branch main has been updated by nxjoseph:

URL: https://cgit.FreeBSD.org/ports/commit/?id=040b9e1170230f765b114e9456ad776e76eaf9be

commit 040b9e1170230f765b114e9456ad776e76eaf9be
Author:     Yusuf Yaman <nxjoseph@FreeBSD.org>
AuthorDate: 2026-10-16 11:24:54 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-10-16 11:25:33 +0000

    security/vuxml: Document textproc/p5-Text-CSV_XS vulnerabilities
    
    PR:             299441
    Approved by:    osa, vvd (Mentors, implicit)
---
 security/vuxml/vuln/2026.xml | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index fe1406839ec9..b0db176eb4b2 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,46 @@
+  <vuln vid="dec22770-c953-11f1-bebb-3c7c3fba4204">
+    <topic>Text::CSV_XS -- multiple vulnerabilities</topic>
+    <affects>
+	<package>
+	  <name>p5-Text-CSV_XS</name>
+	  <range><lt>1.65</lt></range>
+	</package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>H.Merijn Brand - Tux &lt;linux@tux.freedom.nl&gt; reports:</p>
+	<blockquote cite="https://metacpan.org/dist/Text-CSV_XS/changes">
+	  <p>Text::CSV_XS versions before 1.65 have these vulnerabilities listed below.</p>
+	  <ul>
+	    <li>CVE-2026-110759: parse (): report trailing lone CR, do not store EOF as 0xFF</li>
+	    <li>CVE-2026-110758: Under allow_whitespace, do not strip beyond field start</li>
+	    <li>CVE-2026-110757: combine (): decide quoting from the bytes, not the NV flags</li>
+	    <li>CVE-2026-110756: Flush saved bytes in Combine ()</li>
+	    <li>CVE-2026-110755: Re-use AHEAD with \r instead of copying</li>
+	    <li>CVE-2026-110754: getline (): free the result array when the parse fails</li>
+	    <li>CVE-2026-110753: Do not free the bound column scalar in skip_empty_rows</li>
+	    <li>CVE-2026-110752: fragment (): do not size memory by the selector integers</li>
+	  </ul>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2026-110759</cvename>
+      <cvename>CVE-2026-110758</cvename>
+      <cvename>CVE-2026-110757</cvename>
+      <cvename>CVE-2026-110756</cvename>
+      <cvename>CVE-2026-110755</cvename>
+      <cvename>CVE-2026-110754</cvename>
+      <cvename>CVE-2026-110753</cvename>
+      <cvename>CVE-2026-110752</cvename>
+      <url>https://metacpan.org/dist/Text-CSV_XS/changes</url>
+    </references>
+    <dates>
+      <discovery>2026-10-15</discovery>
+      <entry>2026-10-16</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="bac88b3f-c8a1-11f1-866a-3c7c3fba4204">
     <topic>NSD -- multiple vulnerabilities</topic>
     <affects>