CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

graphics/libfpx 1.3.1.10_1

Library routines for working with Flashpix images

Port info

Maintainer
ports@virtual-estates.net
Packages
latest: 1.3.1.10_1
Upstream
up to date
Last update
to 1.3.1.10_1 · 001d07373b
Quarterly
2026Q4: 1.3.1.10_1
WWW
https://github.com/ImageMagick/libfpx
Links
cgit · VuXML

Install

Package
# pkg install libfpx
installs 1.3.1.10_1 from latest; from quarterly (2026Q4) 1.3.1.10_1
Port
# cd /usr/ports/graphics/libfpx && make install clean
Size
422 KiB download · 2.0 MiB installed
Depends on
nothing

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.3.1.10_11.3.1.10_1–
FreeBSD 151.3.1.10_11.3.1.10_1–
FreeBSD 141.3.1.10_11.3.1.10_11.3.1.10_1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.3.1.10_11.3.1.10_1–
FreeBSD 141.3.1.10_11.3.1.10_11.3.1.10_1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 1.3.1.10_1 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2018-68766.52018-02-09The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial of service…

VuXML only (0)

Listed in VuXML, the packaged version 1.3.1.10_1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (70)

Mikhail Teterin (mi) · 1.2.0.9
Upgrade to 1.2.0.9. All our patches are in now...

PR:		53595
Submitted by:	Melvyn Sopacua
dcc15d3af6
Mikhail Teterin (mi) · 1.2.0.8
Upgrade to 1.2.0.8, which contains some of our patches. Add two more, which should solve some crashes and allow to compile with a non-GCC compiler (Re: zero-sized arrays).

Unfortunately, this still crashes on some images, but the vendor has
already pulled the 1.2.0.7 from the mirrors, so this upgrade will, at
least, keep things downloadable.
f9063e87bf
Mikhail Teterin (mi) · 1.2.0.7
Upgrade from 1.2.0.4 to 1.2.0.7 released on April 12th. May need careful testing on other architectures, though...

Compelled by: Chris P.
703b7fae0f
Dirk Meyer (dinoex) · 1.2.0.4_1
- honor NO_WERROR Approved by:	mi@corbulon.video-collage.com
034cbdb998
Ade Lovett (ade) · 1.2.0.4_1
Clear moonlight beckons. Requiem mors pacem pkg-comment, And be calm ports tree.

E Nomini Patri, E Fili, E Spiritu Sancti.
7e52725f2a
Mikhail Teterin (mi) · 1.2.0.4_1
Make sure warnings are not fatal when compiling the C++ parts of this package by explicitly appending -Wno-error to CXXFLAGS. This assumes, the compiler is from the gcc family, but the assumption was already there -- in the explicit -Werror appended to CFLAGS.

Reported by:	Dirk Meyer
1275b2e250
Mikhail Teterin (mi) · 1.2.0.4_1
Add two more little patches to fix warnings. One of the warnings was causing build failure on Alpha-stable -- but not on any other platform...

When I added this big patch, I though all of the problems were fixed, and
closed the corresponding PR. Turned out, Alpha-stable remained broken, even
though the -current started to build.

Just as before, no PORTREVISION bump because no changes are expected on
the platforms were this built before.

Tested on: panther, bento, axp0, beast
PR:	ports/40444
08e0602bc7
Mikhail Teterin (mi) · 1.2.0.4_1
Add the patch which lets this port compile on Alphas without evident breakage on i386 or Sparc64. Tested on: beast, panther, an x86 -current (aldan.algebra.com) and x86 -stable (corbulon.video-collage.com).

The patch puts a bunch of casting and type-changing band-aids, but this
software package desperately needs a good maintainer -- to properly fix
it -- int32s are mixed with longs, etc.

Unfortunately, the package is lacking any self-testing facilities, so
it may well not work properly, even though it compiles. This is true even
for x86, BTW, although less likely, because that's where it was developed.

Since the patch is not expected to change the result on x86, there is no
PORTREVISION bump.

PR:		ports/40444
Submitted by:	Jan Lentfer
The problem also reported directly to this maintainer by: Jun Ushida
8c483f0763
Ying-Chieh Liao (ijliao) · 1.2.0.4_1
remove ftp.yggdrasil.com it's offline for a long time

PR:		38191
Submitted by:	Tom Rissman <trissman@mrdlaw.com>
d2b241ba32
Mikhail Teterin (mi) · 1.2.0.4_1
Add the HAVE_* defines to CXXFLAGS as well as CFLAGS. Add -lstdc++ to LDADD, which lead to the unfortunate PORTREVISION bump.

PR:		ports/40874
Submitted by:	Jan Stocker
59425510d5
Ruslan Ermilov (ru) · 1.2.0.4
Fixed install on bsd.incs.mk aware systems.
c155b6a8ff
Mikhail Teterin (mi) · 1.2.0.4
Add some defines to CFLAGS to avoid clashing with the newer system headers. While here, change PERL to RE_INPLACE and lock things down with -Werror (in CFLAGS only, the C++ files generate some warnings, fixing which is in the domain of the authors).

Submitted by:	Naoya Nishimura
7d5b879c90
Mikhail Teterin (mi) · 1.2.0.4
The ImageMagick crew took this library over and released the 1.2.0.4. The changes:

. our patch-gcc3 (provided to me by Alex Vasylenko) is
	  incorporated;
	. the library uses its own implementation of wchar; they
	  say, it can only work if sizeof(wchar_t) is 2 bytes, so
	  they can not rely on the OS provided wchar...

The port changed:

	. the package is installed as libfpx-version rather than
	  fpx-version;
	. make is passed `-j2', which is very efficient even for
	  non-SMP machines, since each file is compiled twice --
	  for .o and .So object -- with -j2 they are compiled at
	  the same time, utilizing the cache;
	. don't insist on any particular version of -ljpeg;
	. ftp.imagemagick.org added to the MASTER_SITES (time for
	  MASTER_SITE_IMAGEMAGICK);
	. the ABI and API did not change, so, the installed library's
	  version remains the same.
c74bdc61c8
Mikhail Teterin (mi) · 1.2.0.3
As  a result  of  my last  commit, upgrading  this  to 1.2.0-3,  the package name became fpx-1.2.0-3 --  the extra dash problem... It was quickly pointed out to me by  KATO Tsuguru and Lev Serebryakov, with the former providing  the simple patch I commit now.  The package is now fpx-1.2.0.3.

Fortunately, dot follows  dash in the sorting order, so  there is no
need to mess with the PORTREVISION.

Submitted by:	KATO Tsuguru
144a297f06
Mikhail Teterin (mi) · 1.2.0-3
Upgrade to 1.2.0-3. Minor improvements. One of our patches got incorporated.  Hey!

Submitted by:	alfred (very laconicly)
8c1545f235
Mikhail Teterin (mi) · 1.2.0
Reorder the  include (-I) path  to end, rather than  start, with ${LOCALBASE}/include.  The  old  behaviour  was  working  almost always, because  the package's own header  files are well-named, except for the common.h, which caused build failure for at least one person.

PR:		ports/32247
33cd6f536a
Mikhail Teterin (mi) · 1.2.0
Add new distsites -- all ImageMagick's mirrors carry the distfile in the delegates subdirectory.
532be2231d
Mikhail Teterin (mi) · 1.2.0
Add a patch, which, according to the submitter, allows to compile libfpx with g++ 3.0.x. It does not hurt compilations with the 2.x compiler.

Submitted by:	Alex Vasylenko
4952a349c0
FUJISHIMA Satsuki (sf) · 1.2.0
This file should not belong to repository.
a946ae6688
Will Andrews (will) · 1.2.0
Add libfpx 1.2.0, library routines for working with Flashpix images.

PR:		24313
Submitted by:	mi
e76e22afb6