git: 002cbfa7621b - main - security/vuxml: Document p5-YAML-Syck vulnerabilities

The branch main has been updated by rodrigo:

URL: https://cgit.FreeBSD.org/ports/commit/?id=002cbfa7621b41b00a355199996e43757dc23771

commit 002cbfa7621b41b00a355199996e43757dc23771
Author:     Rodrigo Osorio <rodrigo@FreeBSD.org>
AuthorDate: 2026-09-26 10:54:16 +0000
Commit:     Rodrigo Osorio <rodrigo@FreeBSD.org>
CommitDate: 2026-09-26 11:02:24 +0000

    security/vuxml: Document p5-YAML-Syck vulnerabilities
---
 security/vuxml/vuln/2026.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index 36591379b2f2..308814106043 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,49 @@
+  <vuln vid="501ff33c-b996-11f1-ad2b-40b034429ecf">
+    <topic>p5-YAML-Syck -- Multiple vulnerabilities</topic>
+    <affects>
+<package>
+<name>p5-YAML-Syck</name>
+<range><lt>1.47</lt></range>
+</package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>YAML-Syck project reports:</p>
+	<blockquote cite="https://metacpan.org/dist/YAML-Syck/changes">
+	  <p>YAML-Syck 1.47 fix the following issues:</p>
+      <ul>
+       <li>CVE-2026-57075 (CWE-125): out-of-bounds read in the base64 decoder
+       caused by signed-char indexing of the decode table on !!binary input</li>
+       <li>CVE-2026-57076 (CWE-416): use-after-free of an anchor key string
+       shared between the node and the anchors table</li>
+       <li>CVE-2026-57077 (CWE-125): one-byte out-of-bounds read in the lexer
+       newline scan during block-scalar parsing (incomplete-fix follow-on
+       to CVE-2025-11683)</li>
+       <li>CVE-2026-13713 (CWE-416/CWE-415): use-after-free / double-free of an
+       anchor node on anchor redefinition, a remote-crash DoS from a
+       7-byte input</li>
+      </ul>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2026-57075</cvename>
+      <cvename>CVE-2026-57076</cvename>
+      <cvename>CVE-2026-57077</cvename>
+      <cvename>CVE-2025-11683</cvename>
+      <cvename>CVE-2026-13713</cvename>
+      <url>https://nvd.nist.gov/vuln/detail/cve-2026-57075</url>
+      <url>https://nvd.nist.gov/vuln/detail/cve-2026-57076</url>
+      <url>https://nvd.nist.gov/vuln/detail/cve-2026-57077</url>
+      <url>https://nvd.nist.gov/vuln/detail/cve-2025-11683</url>
+      <url>https://nvd.nist.gov/vuln/detail/cve-2026-13713</url>
+    </references>
+    <dates>
+      <discovery>2026-07-16</discovery>
+      <entry>2026-09-26</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="023a3d0c-b987-11f1-ad2b-40b034429ecf">
     <topic>p5-Authen-SASL -- Replay attack in Authen::SASL::Perl::DIGEST_MD5</topic>
     <affects>