CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

graphics/lcms 1.19_9,1

Light Color Management System -- a color management library

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 1.19_9,1
Upstream
up to date
Last update
to 1.19_9,1 · 0c54251b79
Quarterly
2026Q4: 1.19_9,1
WWW
https://www.littlecms.com/
Links
cgit · VuXML

Install

Package
# pkg install lcms
installs 1.19_9,1 from latest; from quarterly (2026Q4) 1.19_9,1
Port
# cd /usr/ports/graphics/lcms && make install clean
# make -C /usr/ports/graphics/lcms config  # change options first
Size
251 KiB download · 1.1 MiB installed
Depends on
graphics/jpeg-turbo 3.1.4.1, graphics/tiff 4.7.2
License
MIT
Options
3 of 3 on in the package: DOCS JPEGICC TIFFICC

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.19_9,11.19_9,1–
FreeBSD 151.19_9,11.19_9,1–
FreeBSD 141.19_9,11.19_9,11.19_9,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.19_9,11.19_9,1–
FreeBSD 141.19_9,11.19_9,11.19_9,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (4)

The CVE record lists the packaged version 1.19_9,1 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2016-101657.12017-02-03The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with…
CVE-2013-41605.02014-01-21Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash…
CVE-2013-42764.32013-09-28Multiple stack-based buffer overflows in LittleCMS (aka lcms or liblcms) 1.19 and earlier allow remote attackers to cause a denial of service (crash) via a crafted (1) I…
CVE-2026-412544.02026-04-18Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

VuXML only (0)

Listed in VuXML, the packaged version 1.19_9,1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (86)

Stanislav Sedov (stas) · 1.15_1,1
- Add KNOBS to build supplimentary utilities - Change my email

PR:		ports/76116 (based on)
Suggested by:	Raphael Langerhorst <raphael-langerhorst@gmx.at>
Approved by:	sem (mentor)
e5bed1ffa3
Martin Wilke (miwi) · 1.15,1
- Update to 1.15 - Pass maintainership to submitter

Short changelog:
- Black preservation on CMYK-> CMYK transforms
- Ability to set adaptation state of observer on absolute colorimetric
  transforms.
- A rather advanced feature. Actually it only allows No adaptation (d=0) and
  observer fully adapted (d=1)
- lcms can now "fix" some broken 8-bit profiles that have gray axes misplaced.
- icctrans can now read CGATS/IT8 files.
- improved tifficc with tiff Lab8 support

PR:		ports/101603
Submitted by:	Stanislav Sedov <ssedov(at)mbsd.msk.ru>
Approved by:	krion (mentor)
18fc3eccb1
Edwin Groothuis (edwin) · 1.14_1,1
Remove USE_REINPLACE for categories starting with a G
ff21f59f9f
Ade Lovett (ade) · 1.14_1,1
Conversion to a single libtool environment.

Approved by:	portmgr (kris)
8503536d38
Pav Lucistnik (pav) · 1.14,1
- Add SHA256
792b758ef4
Ade Lovett (ade) · 1.14,1
Mass-conversion to the USE_AUTOTOOLS New World Order.  The code present in bsd.autotools.mk essentially makes this a no-op given that all the old variables set a USE_AUTOTOOLS_COMPAT variable, which is parsed in exactly the same way as USE_AUTOTOOLS itself.

Moreover, USE_AUTOTOOLS has already been extensively tested by the GNOME
team -- all GNOME 2.12.x ports use it.

Preliminary documentation can be found at:
	http://people.FreeBSD.org/~ade/autotools.txt

which is in the process of being SGMLized before introduction into the
Porters Handbook.

Light blue touch-paper.  Run.
54a0b86543
Pav Lucistnik (pav) · 1.14,1
- libdata/pkgconfig is now included in mtree

Approved by:	marcus (portmgr hat)
a7679d4fab
Kirill Ponomarev (krion) · 1.14,1
Handle libtool version more properly to prevent leftovers.
3327b5c15d
Volker Stolz (vs) · 1.14,1
Update to 1.14

PR:		ports/76116
Submitted by:	Raphael Langerhorst
84b837c153
Joe Marcus Clarke (marcus) · 1.13_1,1
The previous commit should have bumped PORTREVISION since it changed the runtime dependency list.

Noticed by:	GNOME Tinderbox
dc7fcbf2eb
Mikhail Teterin (mi) · 1.13,1
Remove the bogus dependency on -ltiff (--without-tiff was always in there). Make the testcms link the new -lcms statically to avoid possible conflicts with the already installed library (probably of a different version).

PR:	ports/68610
62a3a103b8
Oliver Lehmann (oliver) · 1.13,1
take care of $PREFIX/libdata/pkgconfig
ef866e788f
Joe Marcus Clarke (marcus) · 1.13,1
Apply a big libtool patch to allow porters to use the libtool installed by the libtoolX ports instead of the one included with each port.  Ports that set USE_LIBTOOL_VER=X will now use the ports version of libtool instead of the included version.  To restore previous behavior, use the new macro, USE_INC_LIBTOOL_VER.  Both macros accept the same argument: a libtool version.

For example, to use the ports version of libtool-1.5, add the following to
your Makefile:

USE_LIBTOOL_VER=        15

To use the included version of libtool with extra hacks provided by
libtool-1.5, add the following to your Makefile:

USE_INC_LIBTOOL_VER=    15

With this change, ports that had to add additional libtool hacks to prevent
.la files from being installed or to fix certain threading issues can now
delete those hacks (after appropriate testing, of course).

PR:		63944
Based on work by:eik and marcus
Approved by:	ade (autotools maintainer)
Tested by:	kris on pointyhat
Bound to be hidden problems:	You bet
9e5632dd66
Marcel Moolenaar (marcel) · 1.13,1
Fix 64-bit platforms: the ALIGNLONG macro aligned on an 32-bit word boundary, which on 64-bit platforms is not the proper alignment for longs. The patch replaces the hardcoding of 3 with sizeof(long)-1.

Tested on: ia64
64cef1cadf
Kirill Ponomarev (krion) · 1.13,1
Update to version 1.13
b76e9b7622
Kirill Ponomarev (krion) · 1.12,1
- Update to version 1.12

PR:		ports/67083
Submitted by:	Ports Fury
56f284e728
Alexander Nedotsukov (bland) · 1.09_1,1
Better way to resolve ldscripts issue.

Pointed by:	marcus
631f740941
Alexander Nedotsukov (bland) · 1.09_1,1
Quick workaround to unbroke build on -STABLE. ${LD} can't found libm.so in standard search path.

Reported by:	Mike Harding <mvh@ix.netcom.com>
94a778271c
Alexander Nedotsukov (bland) · 1.09_1,1
Shared library make use of -lm symbols therefore must be linked against it. Otherwise we get unresolved references error at the time linking this library into objects w/o -lm dependency. This was the reason why color proof module in gimp-devel was not built.
9b88285b3a
Trevor Johnson (trevor) · 1.09,1
SIZEify.
0c881ba59c
Kris Kennaway (kris) · 1.09,1
Drop maintainership; I have no interest in this port beyond wanting KDE to build on our supported architectures.
897d8a455f
Mikhail Teterin (mi) · 1.09,1
Transfer maintainership to kris. This port proved too difficult to maintain without access to machines of various architectures. Kris has such access, but would not share it and gets tired too quickly.
92c06a896a
Kris Kennaway (kris) · 1.09,1
With my portmgr hat on, revert this port to 1.09 and bump PORTEPOCH. The port fails to pass the internal self-tests on 64-bit platforms running very recent 5.1 systems, but it is required to build KDE and therefore critical for the release.
68144000b6
Mikhail Teterin (mi) · 1.10
Upgrade 1.10 to 1.09
9fa28b0c2c
Ade Lovett (ade) · 1.09
Clear moonlight beckons. Requiem mors pacem pkg-comment, And be calm ports tree.

E Nomini Patri, E Fili, E Spiritu Sancti.
7e52725f2a
Mikhail Teterin (mi) · 1.09
Use BYTE_ORDER, BIG_ and LITTLE_ENDIAN instead of their underscore-prefixed aliases, which are not available on -stable. There I was proud of myself for testing on i386, alpha, and panther, and still missing a -stable incompatibility :-\

Submitted by:	Voodai, Lars Erik Gullerud, Ivajlo Nikolov (so far)
6ef5c2e707
Mikhail Teterin (mi) · 1.09
Fix build on Sparc64 by automating the endianness detection. (Thanks, once again, to the "test" target.)
0d72096af5
Mikhail Teterin (mi) · 1.09
Upgrade to 1.09. Prepend SourceForge's list of mirrors to MASTER_SITES. Install JPEG-related sample files in addition to the TIFF sample. All this samples can be built by the port, BTW, but would require lib-dependency on libtiff and libjpeg.
7e205eb59a
Kris Kennaway (kris) · 1.08
Fix build on current
12c2625d31
Mikhail Teterin (mi) · 1.08
Upgrade to 1.08. The tests report success on Alpha too (beast), even though there are plenty of messages about unalligned access...

(Notably, the author  incorporated almost all of  our 32-bit related
patches).

PR:		ports/33528
Submitted by:	Lev A. Serebryakov
100babe355
Mikhail Teterin (mi) · 1.07_1
Uh, actually commit the patches described in my previous commit. The primary purpose is to fix the port on Alphas.
e61d8fd851
Mikhail Teterin (mi) · 1.07_1
Teach it to try int32_t and friends  on all Unixes, not just SGI's Irix. A whole  bunch of  little 32-bit  related hunks was  needed, but  now it passes its  own bundled tests (which  also needed a little  patch for an unitialized variable) on Alpha. Bump PORTREVISION.

Submitted by:	Andrew Gallatin, Doug Rabson
Tested on:	beast
c4c453cbc5
Mikhail Teterin (mi) · 1.07
Ooops, this should've been part of my yesterday's commit... 	Thanks to: Jaroshenko at mailru dot com
0ab420e05e
Mikhail Teterin (mi) · 1.07
Upgrade to 1.07. Use the official PORTDOCS instead of the pre-PORTDOCS homegrown DOCS variable. Do not install the test-executable, but run it after build. Change the mastersite and WWW.

Thanks to: KATO Tsuguru

who sent me the cleaning up and WWW changing patch, which made me look
and notice, the new version is also available.

I will submit the fix for ImageMagick -- lcms.h is now <lcms.h>, not
<lcms/lcms.h>.
1c8c0c892b
Maxim Sobolev (sobomax) · 1.06
- Use USE_LIBTOOL; - move variable definition from rules section of Makefile; - sort pkg-plist.
66ccdf8cbc
Trevor Johnson (trevor) · 1.06
Add new port of LCMS 1.06, the Little Color Management System, a graphics library.  Color management is the process of keeping "profiles" which describe the response of scanners, cameras, monitors, printers and such to light, and compensating for the different response curves as images are transferred from one device to another.

PR:		22420
Submitted by:	Mikhail Teterin <mi@aldan.algebra.com>
1aae05025c