Assist getting more ports working on AMD64 by obeying the Ports Collection documentation and use 'ARCH' rather than 'MACHINE_ARCH'.f2fc2d60ae
libXfont -- permission bypass when opening files through symlinksentered 2017-12-17
Port details
x11-fonts/libXfont 1.5.4_3,2
X font library
Port info
- Maintainer
- x11@FreeBSD.org
- Packages
- latest: 1.5.4_3,2
- Upstream
- up to date
- Last update
- to 1.5.4_3,2 · a4c421c50a
- Quarterly
- 2026Q4: 1.5.4_3,2
- Formerly
- x11/libXfont until 2007-05-19
- WWW
- https://www.freedesktop.org/wiki/Software/xlibs/
- Links
- cgit · VuXML
Install
- Package
# pkg install libXfontinstalls 1.5.4_3,2 fromlatest; fromquarterly(2026Q4) 1.5.4_3,2- Port
# cd /usr/ports/x11-fonts/libXfont && make install clean- Size
- 171 KiB download · 766 KiB installed
- Depends on
- print/freetype2 2.14.3, x11-fonts/libfontenc 1.1.9
- License
- BSD2CLAUSE and BSD3CLAUSE and MIT
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 1.5.4_3,2 | 1.5.4_3,2 | – |
| FreeBSD 15 | 1.5.4_3,2 | 1.5.4_3,2 | – |
| FreeBSD 14 | 1.5.4_3,2 | 1.5.4_3,2 | 1.5.4_3,2 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 1.5.4_3,2 | 1.5.4_3,2 | – |
| FreeBSD 14 | 1.5.4_3,2 | 1.5.4_3,2 | 1.5.4_3,2 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (1)
The CVE record lists the packaged version 1.5.4_3,2 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-56002 | 8.5 | 2026-07-08 | A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the … |
VuXML only (0)
Listed in VuXML, the packaged version 1.5.4_3,2 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (7)
Show 7 fixed
VuXML entries whose affected range the packaged version has left.
libXfont -- multiple memory leaksentered 2017-12-17
libXfont -- BDF parsing issuesentered 2015-03-18
libXfont -- possible local privilege escalationentered 2011-08-11
xorg -- multiple vulnerabilitiesentered 2008-01-23
CVE-2007-5760, CVE-2007-5958, CVE-2007-6427, CVE-2007-6428, CVE-2007-6429, CVE-2008-0006
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (63)
Generate proper package listing when using new mtree from xorg-server port.a28953dc2d
Remove hardcoding of MTREE_FILE. This is handled in bsd.port.mk since rev. 1.503 for ${PREFIX} == ${XPREFIX} cases.62e90b299cFix MASTER_SITES.19fae4d1f7
Register missing CONFLICTS, mostly on xorg-libraries-* Reported by: Kent Stewart <kstewart@owt.com>cf80d22f0c
Update to 1.4.2, fixing a buffer overflow in dirfile.c.ebf9c0dd5b
Use the right MTREE_FILE Reported by: kriseea2b2f9ca
SIZEify (maintainer timeout)8232e82f85
Declare CONFLICTS between freedesktop.org X extension/library ports and XFree86-libraries.d5f131c7fd
Fix build with freetype2-2.1.7.bad0c4eb0f
Bump PORTREVISION on all ports that depend on gettext to aid with upgrading. (Part 1)73f7c91b5d
Update to 1.4.1db5e858f54
New port: Prerelease version of libXfont from freedesktop.org: X font libary Testing is encouraged, but please do not use these ports as dependencies until they are updated to release tarballs and the XFree86 ports have been updated to depend on them.efa1a6e57e