CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

graphics/vips 8.18.7_1

Free image processing system

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 8.18.6, update to 8.18.7_1 not built yet
Upstream
up to date
Last update
to 8.18.7_1 · ed4c5e5da5
Quarterly
2026Q4: 8.18.6 · last MFH 7ccb703566
WWW
https://www.libvips.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install vips
installs 8.18.6 from latest; from quarterly (2026Q4) 8.18.6
Port
# cd /usr/ports/graphics/vips && make install clean
# make -C /usr/ports/graphics/vips config  # change options first
Size
3.8 MiB download · 38 MiB installed
Depends on
archivers/libarchive 3.8.8,1, astro/cfitsio 4.7.0, devel/gettext-runtime 1.0_1, devel/glib20 2.88.3,2, devel/highway 1.4.0, graphics/ImageMagick7 7.1.2.25_2, graphics/cairo 1.18.2,3, graphics/cgif 0.5.4, graphics/gdk-pixbuf2 2.44.1, graphics/jpeg-turbo 3.1.4.1, graphics/lcms2 2.19.1, graphics/libexif 0.6.26, graphics/libheif 1.23.6, graphics/libjxl 0.12.0, graphics/libraw 0.22.2, graphics/librsvg2-rust 2.62.3_3, graphics/libspng 0.7.4, graphics/libultrahdr 2.0.2, graphics/openexr 3.4.16, graphics/openjpeg 2.5.4_2, graphics/png 1.6.59_1, graphics/poppler-glib 26.04.0_1, graphics/tiff 4.7.2, graphics/webp 1.6.0, lang/python312 3.12.15, math/fftw3 3.3.11, math/matio 1.6.0, print/freetype2 2.14.3, print/harfbuzz 14.6.0, shells/bash 5.3.20, textproc/expat2 2.9.0, x11-fonts/fontconfig 2.18.3,1, x11-toolkits/pango 1.57.1
License
LGPL21
Options
24 of 27 on in the package: CFITSIO DOCS FFTW FONTCONFIG GIF HEIF HIGHWAY IMAGEMAGICK JPEG JXL LCMS2 LIBARCHIVE LIBEXIF LIBRSVG2 MATIO OPENEXR PANGO PNG POPPLER RAW SPNG TIFF UHDR WEBP
Show the 3 options that are off
GRAPHICSMAGICK IMAGEQUANT ORC

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 168.18.68.18.6–
FreeBSD 158.18.68.18.6–
FreeBSD 148.18.68.18.68.18.6

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 158.18.68.18.6–
FreeBSD 148.18.68.18.68.18.6

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 8.18.6.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
290191maintainer-feedback? graphics/vips patch to support nox11 flavorizationNew2025-10-13

Commits (285)

Gerald Pfeifer (gerald) · 8.7.4_5
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.

PR:		238330
ea8c8ec7da
Tobias C. Berner (tcberner) · 8.7.4_4
graphics/poppler: update to 0.78.0

Release 0.78.0:
        core:
         * Fix line annotation arrows for usage in dimensioning
         * Handle Ink annots without an InkList but with an AP
         * Fix typos preventing parsing of Movie start and duration
         * Fix crash on malformed files

        glib:
         * Add poppler_document_create_dests_tree()
         * Don't use the deprecated g_type_class_add_private()
         * Document the differences between render() and render_for_printing()
         * Fix introspection for poppler_document_new_from_data
         * Don't create PopplerInputStream with length 0. Issue #414
         * Document G_IO_ERROR as a possible error condition
         * docs: Add index for API new in 0.78

        build system:
         * Fixes cross compilation of gir in Void Linux
         * Add -Wshadow to the default warning flags
         * install pkg-config pc files if pkg-config is found

PR:		238857
Exp-run by:	antoine
Approved by:	gnome (kwm, implicit)
4d160bfcf5
Tobias C. Berner (tcberner) · 8.7.4_3
graphics/poppler: update to 0.77.0

Release 0.77.0:
        core:
         * Fix crash on signature handling. Issue #766
         * Fix small memory leak in SignatureHandler::getCertificateInfo
         * Splash: Restrict filling of overlapping boxes. Issue #750
         * Fix crash on malformed files

        qt5:
         * Fix optional content handling with exclusive layers

        cpp:
         * Make render_page thread-safe

        utils:
         * pdfsig: Fix small memory leak
         * pdftotext: Fix typo in manpage

PR:		238115
Exp-run by:	antoine
Approved by:	gnome (kwm, implicit)
d163307e80
Tobias C. Berner (tcberner) · 8.7.4_2
graphics/poppler: update to 0.76.1

From Changelog at https://poppler.freedesktop.org/releases.html :

Release 0.76.1:
        core:
         * Make the mul tables be calculated at compile time with constexpr.
         * splash: Fix compile with SPLASH_CMYK enabled
         * Some typo fixing in error messages

        qt5:
         * Fix regression in annotation handling

        build system:
         * Fix some typos in build system output and comments

Release 0.76.0:

        core:
         * Fix regression on case-insensitive search. Issue #743
         * Remove GooList, use std::vector instead
         * Fix radiobutton reporting wrong state. Issue #159
         * Handle UTF16-LE strings
         * Don't error out if there's no DA in FreeText annotation
         * cairo: Compute correct coverage values for box filter.
         * cairo: Constrain number of cycles in rescale filter.
         * Read more fields from ViewerPreferences
         * Introduce and use Ref::INVALID
         * Fix crashes in broken files
         * Fix mismatched free/delete
         * Add missing include guards

        utils:
         * pdftohtml: Properly initialize HtmlOutputDev::page to avoid SIGSEGV upon error exit. Issue #742

All the required patches have been obtained via gentoo.

PR:		237846
Exp-run by:	antoine
Approved by:	kwm
753388101e
Max Brazhnikov (makc) · 8.7.4_1
- bump PORTREVISION after math/matio update
d15cc92143
Danilo Egea Gondolfo (danilo) · 8.7.4
- Update to 8.7.4
c10a9c7948
Sunpoet Po-Chuan Hsieh (sunpoet) · 8.7.1_2
Update science/hdf5 to 1.10.4

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://portal.hdfgroup.org/display/support/HDF5%201.10.4#releasenotes
PR:		233070
Submitted by:	wen
91c3078096
Gerald Pfeifer (gerald) · 8.7.1_1
Bump PORTREVISION for ports depending on the canonical version of GCC defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t GCC 8.2 under most circumstances.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.

PR:		231590
a9f015d155
Danilo Egea Gondolfo (danilo) · 8.7.1
- Update to 8.7.1 - Back to MASTER_SITES to download the tarball created by the project [1]

Reported by:	mat [1]
5b6babf90a
Danilo Egea Gondolfo (danilo) · 8.7.0
- Update graphics/vips and graphics/nip2 to 8.7.0 - Use GITHUB instead of MASTER_SITES
cfadd9ea3f
Antoine Brodin (antoine) · 8.6.5_3
Cleanup plists
b8796f0d82
Matthias Andree (mandree) · 8.6.5_3
Update ilmbase and openexr to 2.3.0, rename OpenEXR to openexr.

Release notes: <https://github.com/openexr/openexr/releases/tag/v2.3.0>

Adjust LIB_DEPENDS of all ports that require ilmbase or openexr to chase
the new lower-case spelling of the name, and to omit the version from the
library name to ease future maintenance.

Bump PORTREVISION of all ports that depend on ilmbase or openexr directly,
so that they all get rebuilt on upgrades.

Add patches to graphics/ampasCTL to keep it alive, with (a) ilmbase now
that its Iex::BaseExc class is no longer derived from std::string,
details were given upstream through https://github.com/ampas/CTL/issues/71
and (b) to unwind semicolon/;-lists in cmake that stem from openexr/
ilmbase pkg-config variables.
(Note ampasCTL is unmaintained as FreeBSD port, and upstream,
and I cannot run-time test it.)

Poudriere build tests on 11.2-RELEASE-p1 amd64 of ALL ports depending
directly or indirectly on ilmbase and/or openexr have passed without
regressions.  Thus invoking due diligence, I believe I have done the
equivalent of an -exp run, and do not require approval for the dependency
chases to third-party ports.
d1cfeab07e
Sunpoet Po-Chuan Hsieh (sunpoet) · 8.6.5_2
Update science/hdf5 to 1.10.2

- Bump PORTREVISION of dependent ports for shlib change

Changes:	https://portal.hdfgroup.org/display/support/HDF5%201.10.2#releasenotes
		https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-1.10/hdf5-1.10.2/src/hdf5-1.10.2-RELEASE.txt
PR:		231009
Exp-run by:	antoine
c548cd43e8
Gerald Pfeifer (gerald) · 8.6.5_1
Bump PORTREVISION for ports depending on the canonical version of GCC in the ports tree (via Mk/bsd.default-versions.mk and lang/gcc) which has now moved from GCC 6 to GCC 7 by default.

This includes ports
 - featuring USE_GCC=yes or USE_GCC=any,
 - featuring USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and those
 - with USES=compiler specifying one of openmp, nestedfct, c11, c++0x,
   c++11-lib, c++11-lang, c++14-lang, c++17-lang, or gcc-c++11-lib.

PR:		222542
09f9633cb6
Danilo Egea Gondolfo (danilo) · 8.6.5
- Update to 8.6.5

Fix a buffer overflow in the tiff reader.

MFH:		2018Q3
c19fb308cf
Danilo Egea Gondolfo (danilo) · 8.6.4
- Update to 8.6.4
fe8e91ba7d
Mark Linimon (linimon) · 8.6.1_1
Adjust USES to fix builds on gcc-based architectures.

While here, pet portlint.

Tested for no regression on amd64.

Approved by:	portmgr (tier-2 blanket)
efc62e6bcd
Gerald Pfeifer (gerald) · 8.6.1_1
Bump PORTREVISIONs of all users of math/mpc that we just updated to version 1.1.0 (via revision 464079).
c2a92a1aea
Danilo Egea Gondolfo (danilo) · 8.6.1
- Update to 8.6.1 - Change MASTER_SITES to github - Move python to USES due bin/vipsprofile - Update WWW
3c40da4dd1
Matthias Andree (mandree) · 8.4.5_5
Security update OpenEXR and ilmbase to 2.2.1.

While here, fix libIlmImfUtil_la_LDFLAGp so that when linking libIlmImfUtil,
the locally built libIlmImf gets precedence over the one in /usr/local,
to permit upgrades in a running system with the older version installed.

This changes the library's SONAME, so bump PORTREVISION of all dependees.

Unfortunately, this looks a bit too intrusive for an MFH to 2017Q4.

Security:	CVE-2017-9110
Security:	CVE-2017-9111
Security:	CVE-2017-9112
Security:	CVE-2017-9113
Security:	CVE-2017-9114
Security:	CVE-2017-9115
Security:	CVE-2017-9116
Security:	803879e9-4195-11e7-9b08-080027ef73ec
1fb0ae7cf9
Mathieu Arnold (mat) · 8.4.5_4
Convert Python ports to FLAVORS.

Ports using USE_PYTHON=distutils are now flavored.  They will
  automatically get flavors (py27, py34, py35, py36) depending on what
  versions they support.

  There is also a USE_PYTHON=flavors for ports that do not use distutils
  but need FLAVORS to be set.  A USE_PYTHON=noflavors can be set if
  using distutils but flavors are not wanted.

  A new USE_PYTHON=optsuffix that will add PYTHON_PKGNAMESUFFIX has been
  added to cope with Python ports that did not have the Python
  PKGNAMEPREFIX but are flavored.

  USES=python now also exports a PY_FLAVOR variable that contains the
  current python flavor.  It can be used in dependency lines when the
  port itself is not python flavored.  For example, deskutils/calibre.

  By default, all the flavors are generated.  To only generate flavors
  for the versions in PYTHON2_DEFAULT and PYTHON3_DEFAULT, define
  BUILD_DEFAULT_PYTHON_FLAVORS in your make.conf.

  In all the ports with Python dependencies, the *_DEPENDS entries MUST
  end with the flavor so that the framework knows which to build/use.
  This is done by appending '@${PY_FLAVOR}' after the origin (or
  @${FLAVOR} if in a Python module with Python flavors, as the content
  will be the same).  For example:

    RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}

PR:		223071
Reviewed by:	portmgr, python
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D12464
551be3c723
Steve Wills (swills) · 8.4.5_4
Add missed PORTREVISION bumps after recent poppler update
40db78cf06
Sunpoet Po-Chuan Hsieh (sunpoet) · 8.4.5_3
Update science/hdf5 to 1.10.1

- Bump PORTREVISION for shlib change

Changes:	https://support.hdfgroup.org/ftp/HDF5/releases/hdf5-1.10/hdf5-1.10.1/src/hdf5-1.10.1-RELEASE.txt
8b1d897ff6
Sunpoet Po-Chuan Hsieh (sunpoet) · 8.4.5_2
Update to 0.6.0

- Bump PORTREVISION for dependent ports

Changes:	https://chromium.googlesource.com/webm/libwebp/+/master/NEWS
7d3a967cfb
Olivier Duchateau (olivierd) · 8.4.5_1
Chase update of graphics/poppler (and slaves ports) in revision r430777
47706eca19
Danilo Egea Gondolfo (danilo) · 8.4.5
- Update to 8.4.5
a784a228f1
Danilo Egea Gondolfo (danilo) · 8.4.4
- Update to 8.4.4
1b4aff4f9c
Max Brazhnikov (makc) · 8.4.2_1
Chase math/matio update
f34c3a8543
Danilo Egea Gondolfo (danilo) · 8.4.2
- Update to 8.4.2
eef25d6f02
Danilo Egea Gondolfo (danilo) · 8.4.1
- Update to 8.4.1
087acf61fa
Olivier Duchateau (olivierd) · 8.3.3_1
Chase update of Poppler after revision r421386
548adee57e
Danilo Egea Gondolfo (danilo) · 8.3.3
- Update to 8.3.3
5b44ad236d
Danilo Egea Gondolfo (danilo) · 8.3.2
- Add some dependencies explicitly to make QA happy
f4d6de544d
Danilo Egea Gondolfo (danilo) · 8.3.2
- Update to 8.3.2
f8f18202f1
Danilo Egea Gondolfo (danilo) · 8.3.1
- Update to 8.3.1
a4d96fbe5e
Danilo Egea Gondolfo (danilo) · 8.2.3
- Update to 8.2.3
a701656601
Mathieu Arnold (mat) · 8.2.2_1
Remove ${PORTSDIR}/ from dependencies, categories d, e, f, and g.

With hat:	portmgr
Sponsored by:	Absolight
4e1b79a0a6
Sunpoet Po-Chuan Hsieh (sunpoet) · 8.2.2_1
- Update to 0.5.0 - Bump PORTREVISION for graphics/webp shlib change

Changes:	https://chromium.googlesource.com/webm/libwebp/+/master/NEWS
1fc33e5d96
Danilo Egea Gondolfo (danilo) · 8.2.2
- Update to 8.2.2
7ac41b537a
Danilo Egea Gondolfo (danilo) · 8.2.1
- Update to 8.2.1
91a37de5e3
Danilo Egea Gondolfo (danilo) · 8.1.1
- Update to 8.1.1
bd7f4c317e
John Marino (marino) · 8.0.2_2
graphics/GraphicsMagick: Upgrade version 1.3.21 => 1.3.22

GraphicsMagick was just updated, but there was as newer, second
PR to upgrade it once more.  And again, the shared library version
has been bumped (haven't these guys heard of symbol versioning?)

While the INDEX references 114 users of GraphicksMagick, I'm going to
only bump the same 8 ports as yesterday.   The bump script appears to
be obsolete (still uses CVS!)

PR:		203547
Submitted by:	Walter Schwarzenfeld
d417455b24
John Marino (marino) · 8.0.2_1
graphics/GraphicsMagick: Upgrade version 1.3.20 => 1.3.21

The shared library versions changed, so bump all the ports that
depend on GraphicsMagick by default too.

PR:		200304
Submitted by:	ports fury
f6a13dc9de
Antoine Brodin (antoine) · 8.0.2
Convert to USES=jpeg
6e5719ca80
Danilo Egea Gondolfo (danilo) · 8.0.2
- Update to 8.0.2
fdd8d3d129
Danilo Egea Gondolfo (danilo) · 8.0.1
vips - Update to 8.0.1 nip2 - Update to 8.0 - Add LDFLAGS=-lm to fix build when math options are disabled
7e02f402b6
Dmitry Marakasov (amdmi3) · 7.42.3
- Add LICENSE_FILE - Add CPE info

Approved by:	portmgr blanket
6939533d44
Danilo Egea Gondolfo (danilo) · 7.42.3
- Update to 7.42.3
5c43601d8f
Danilo Egea Gondolfo (danilo) · 7.42.2
- Update to 7.42.2
a677ab08ee
Danilo Egea Gondolfo (danilo) · 7.42.1
- Fix a build dependency when using python
dd72649f41