CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

x11-servers/xorg-server 21.1.25,1

X.Org X server and related programs

Port info

Maintainer
x11@FreeBSD.org
Packages
latest: xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1
Upstream
up to date
Last update
to 21.1.25,1 · 55b667ca6c
Quarterly
2026Q4: xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1 · last MFH f09d699bf8
Formerly
x11-servers/xephyr until 2022-08-02, x11-servers/xorg-nestserver until 2022-08-02, x11-servers/xorg-vfbserver until 2022-08-02
WWW
https://gitlab.freedesktop.org/xorg/xserver
Links
cgit · VuXML

Install

Package
# pkg install xephyr
# pkg install xorg-nestserver
# pkg install xorg-server
# pkg install xorg-vfbserver
installs xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1 from latest; from quarterly (2026Q4) xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1
Port
# cd /usr/ports/x11-servers/xorg-server && make install clean
Size
841 KiB download · 2.1 MiB installed
Depends on
devel/libunwind 20250904, graphics/libglvnd 1.7.0, graphics/mesa-dri 26.2.2_1, x11-fonts/libXfont2 2.0.9, x11/libXau 1.0.12, x11/libXdmcp 1.1.5, x11/libxcb 1.17.0, x11/libxkbfile 1.2.0, x11/libxshmfence 1.3.3, x11/pixman 0.46.4, x11/xcb-util 0.4.1,1, x11/xcb-util-image 0.4.1, x11/xcb-util-keysyms 0.4.1, x11/xcb-util-renderutil 0.3.10, x11/xcb-util-wm 0.4.2, x11/xkbcomp 1.5.0, x11/xkeyboard-config 2.48
License
MIT
Note
Size, dependencies, options and messages are those of xephyr.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1621.1.25,121.1.25,1–
FreeBSD 1521.1.25,121.1.25,1–
FreeBSD 1421.1.25,121.1.25,121.1.25,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1521.1.25,121.1.25,1–
FreeBSD 1421.1.25,121.1.25,121.1.25,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (3)

The CVE record lists the packaged version 21.1.25,1 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-560009.02026-07-08Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, …
CVE-2026-559998.52026-07-08Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow…
CVE-2023-55747.02023-10-25A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple prot…

VuXML only (0)

Listed in VuXML, the packaged version 21.1.25,1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (33)

Show 33 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVECVSSPublishedDescription
CVE-2026-560009.02026-07-08VuXML · Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, …
CVE-2026-559998.52026-07-08VuXML · Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow…

Problem reports (9) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
297584maintainer-feedback? x11-servers/xorg-server: Xorg does not automatically detect outputs/monitors on a USB hubNew2026-08-17
297517maintainer-feedback? x11-servers/xorg-server: server stops when started in the background of current VTNew2026-08-14
273369maintainer-feedback? x11-servers/xorg-server: "Cannot run in framebuffer mode" after updating to 21.1.8_4,1Open2026-05-12
273161needs-patch x11-servers/xorg-server: rootless without setuid bitNew2026-02-21
253278maintainer-feedback? x11-servers/xorg-server: Lock file: Various fixesIn Progress2025-10-26
Show all 9
PRSummaryStatusChanged
287456maintainer-feedback? x11-servers/xorg-server: backport TearFree page flipsNew2025-10-25
288636maintainer-feedback? x11-servers/xorg-server:unable to build- redefinition of typedef '__GLXscreen' is a C11 featureNew2025-08-03
282643maintainer-feedback? x11-servers/xorg-server:unable to build riscv64-ld: error: undefined symbol: xf86EnableIONew2025-04-12
280614maintainer-feedback? x11-servers/xorg-server: 'X -configure' does not delete /tmp/.X11-unix/X0 when doneNew2024-08-04

Commits (287)

Mathieu Arnold (mat) · 1.20.9_3,1
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 1.20.9_3,1
Remove # $FreeBSD$ from Makefiles.
305f148f48
Jan Beich (jbeich) · 1.20.9_3,1
x11/libxcvt: avoid conflict with xorg-server

Nowadays, kde5 depends on both xorg-server and xwayland-devel.
Once upstream of both switches to libxcvt and xwayland-devel is
updated it'd make kde5 uninstallable. Backporting to xorg-server
is complicated by numerious patch conflicts and autotools.

Stop installing cvt(1) as Xwayland doesn't use xorg.conf(5).
862a720c83
Jan Beich (jbeich) · 1.20.9_3,1
x11/libxcvt: add new port

libxcvt is a library providing a standalone version of the X server
implementation of the VESA CVT standard timing modelines generator.

libxcvt also provides a standalone version of the command line tool
cvt copied from the Xorg implementation and is meant to be a direct
replacement to the version provided by the Xorg server.

https://gitlab.freedesktop.org/ofourdan/libxcvt
b10c84f924
Piotr Kubaj (pkubaj) · 1.20.9_3,1
x11-servers/xorg-server: use libunwind on all architectures that are supported
a83fa2839b
Michael Gmelin (grembo) · 1.20.9_2,1
Use UDEV by default on 14

PR:		253020
Reported by:	Jakob Alvermark <jakob@alvermark.net>
Approved by:	manu
3e2b3b9112
Niclas Zeising (zeising) · 1.20.9_1,1
xorg-server: Add patches to fix security issues

Patch xorg-server (and sub ports) to fix recently discovered security isses:
CVE-2020-14360 and CVE-2020-25712.

These issues can lead to privileges elevations for authorized clients
on systems where the X server is running privileged.

Tested by:	adridg, tcberner, mikael
MFH:		2020Q4
Security:	76c8b690-340b-11eb-a2b7-54e1ad3d6335
21256cd6f4
Niclas Zeising (zeising) · 1.20.9,1
x11-servers/xorg-server: Update to 1.20.9

Update x11-servers/xorg-server to 1.20.9
This is a maintenance release

Changelog and announcement:
https://lists.x.org/archives/xorg-announce/2020-August/003059.html
f2049865e3
Niclas Zeising (zeising) · 1.20.8_4,1
x11-servers/xorg-server: Fix several security issues

Fix several security issues in x11-servers/xorg-server and slave ports which
ultimately can lead to local privilege escalations if xorg-server is running
privileged.

More info:
https://lists.x.org/archives/xorg-announce/2020-August/003058.html

MFH:		2020Q3 (implicit, security update)
Security:	ffa15b3b-e6f6-11ea-8cbf-54e1ad3d6335
773ea8038a
Niclas Zeising (zeising) · 1.20.8_3,1
x11-servers/xorg-server: Fix CVE-2020-14347

Add upstream patch to fix CVE-2020-14347, Pixel Data Uninitialized Memory
Information Disclosure.
Announcement:
https://lists.x.org/archives/xorg-announce/2020-July/003051.html

PR:		248410 (based on)
Submitted by:	VVD
MFH:		2020Q3 (implicit, security update)
Security:	3c7ba82a-d3fb-11ea-9aba-0c9d925bbbc0
cdbf3c2bb2
Michael Gmelin (grembo) · 1.20.8_2,1
Add information for users of devices that don't support evdev to pkg-message (e.g., serial mice).

PR:		246956
Approved by:	zeising (x11)
0d797c2b7a
Niclas Zeising (zeising) · 1.20.8_2,1
xserver: default to libinput if no driver is found

Make xorg-server default to try the xf86-input-libinput driver if a
configured driver can't be found.  This only applies if a specific driver
for an input device has been configured manually in xorg, but that driver
can't be found when starting xorg.

Discussed with:	manu, jbeich
MFH:		2020Q2
b3c1dc5172
Jan Beich (jbeich) · 1.20.8_1,1
Chase GitLab redirect in PATCH_SITES

https://about.gitlab.com/releases/2020/05/06/gitlab-com-13-0-breaking-changes/#removal-of-deprecated-project-paths
64c25a7c48
Niclas Zeising (zeising) · 1.20.8_1,1
xorg-server: Do not send spurious focus events

Apply an upstream patch to avoid sending focus evens when grab actually does
not change.  This fixes certain full screen applications. [1]

Ensure that we actually don't try to find and link against HAL even if it's
around on the system we're compiling on [2]

Add CPE information [3]

PR:		245854 [1] (with changes), 245604 [2], 197712 [3]
Submitted by:	naddy@ [1], mi@ [2], arrowd [3]
Reported by:	shun [3]
MFH:		2020Q2
827d3f086e
Jan Beich (jbeich) · 1.20.8,1
x11-servers/xwayland: expose x11/nvidia-driver support

Disabled for now as runtime wasn't tested. EGLStreams is supported by
x11-wm/mutter and x11-wm/plasma5-kwin.

PR:		244242
Approved by:	zeising (x11)
fb0f11442f
Niclas Zeising (zeising) · 1.20.8,1
x11-servers/xorg-server: Update to 1.20.8

Update x11-servers/xorg-server to 1.20.8
This is a maintenance release
Most notably, fixes some issues with displayport MST
improves glamor in oom situations

Add a patch to make us more compatible with the linux evdev headers
we're using (devel/evdev-proto).  This is needed for xf86-video-qxl.

complete changelog:
https://lists.x.org/archives/xorg-announce/2020-March/003041.html

Obtained from:	https://github.com/FreeBSDDesktop/freebsd-ports/tree/feature/xserver-1.20
5f4b314629
Niclas Zeising (zeising) · 1.20.7_2,1
graphics/mesa-libs: Change default to use DRI3

Change the default mesa configuration to use DRI3 rather than the older DRI2
interface.  This should improve performance somewhat, and alleviates the need
for the FIXDRM option in x11-servers/xorg-server.

Remove the FIXDRM option from x11-servers/xorg-server.

Add an UPDATING entry for the change.

For users of graphics/drm-legacy-kmod or the base graphics drivers, this might
cause regressions.  If you experience problems when running OpenGL applications
please force the use of the DRI2 backend by setting the LIBGL_DRI3_DISABLE
environment variable to 1 before starting any OpenGL application.  This is
easiest done by adding it to your shell startup file or .xinitrc.

Add UPDATING entry for xorg-server, detailing the change of device
configuration backend.

PR:		196678, 244306 (for tracking)
121ae90af1
Joseph Mingrone (jrm) · 1.20.7_1,1
x11-servers/xorg-server: Restore FIXDRM as an off-by-default knob

This is a workaround for a problem with certain systems [1] after
x11-servers/xorg-server was upgraded to 1.20.7.  Other workarounds are
described in PR 244306.

[1]
These systems have been reported to have problems:
Sandy Bridge
Ivy Bridge
Broadwell
Kaby Lake
Whiskey Lake

PR:	244306
Submitted by:	wulf
Reported by:	philippe.michel7@free.fr
Approved by:	x11 (zeising)
Differential Revision:	https://reviews.freebsd.org/D23834
e8888f06e2
Piotr Kubaj (pkubaj) · 1.20.7,1
x11-servers/xorg-server: fix build on GCC architectures

Use C11 compiler:
In file included from glxserver.h:70,
                 from singlepix.c:35:
../include/glx_extinit.h:33: error: redefinition of typedef '__GLXscreen'
glxscreens.h:119: error: previous declaration of '__GLXscreen' was here
fc9e4ce57f
Niclas Zeising (zeising) · 1.20.7,1
Update xorg x11 servers to 1.20.7

Update xorg x11 servers to 1.20.7.  This updates x11-servers/xorg-server,
xephyr, xorg-dmx, xorg-nestserver, xorg-vbserver and xwayland.

Enable the UDEV backend by default, instead of the DEVD backend, for
autoconfiguration of input devices on FreeBSD 12 and later.
FreeBSD 11 lacks the needed support in base and will keep on using the DEVD
backend.
Support for the HAL backend is dropped completely, it has been deprecated
for a long time.
Update and improve the DEVD backend.
Add a pkg message about sysctl configuration that might be needed when using
UDEV.

Use the upstream fix for glamour issues.

Use evdev xkb rules by default in xwayland [2]

Add x11-drivers/xf86-input-libinput to the list installed by default by
x11-drivers/xorg-drivers.

Fix net/tigervnc-server and emulators/virtualbox-ose

Bump portrevision of all x11 drivers, as well as other ports dependent on
xorg-server.

This represents work by many people over a long period.  These include
wulf, ak, dumbbell, hselasky pete AT nomadlogic DOT org, jbeich, manu,
myself and possibly others (I tried to look through history, but might have
missed people. If so, I am sorry.)

PR:             196678 [1], 244129 [2]
Submitted by:   hselasky, wulf [1], jbeich [2]
Obtained from:	https://github.com/FreeBSDDesktop/freebsd-ports/tree/feature/xserver-1.20 (in part)
4b9c697c26
Jan Beich (jbeich) · 1.18.4_13,1
x11-servers/xorg-server: expose UDEV support for evdev hotplug

UDEV builds Xorg against libudev-devd, allowing automatic detection of
/dev/input/* (evdev) devices with xf86-input-libinput or xf86-input-evdev.

PR:		222609
Submitted by:	Greg V <greg@unrelenting.technology>
Tested by:	Ivan <bsd@abinet.ru>, manu
Approved by:	x11 (bapt via IRC)
78328a9895
Hiroki Sato (hrs) · 1.18.4_13,1
Add etc/X11/fontpath.d as a catalogue fontpath by default.

This allows a port/package to install a symlink pointing
the real font directory managed by core XLFD (aka fonts.dir).
Adding a new entry of "FontPath" into the system-wide
xorg.conf or "xset fp" by users manually is no longer needed.

When both USES=fonts and ${FONTPATHSPEC} are defined,
the post-install target will install ${FONTPATHSPEC} into
${FONTPATHD} directory as a symlink to ${FONTSDIR}.
The symlink name has the following syntax:

  <identifier>:[attribute:]pri=<priority>

Details can be found in xorg.conf(5).  A typical example
for a bitmap font is as follows:

  FONTPATHSPEC=	${PORTNAME}:unscaled:pri=60

No objection on:	x11
3593478fde
Niclas Zeising (zeising) · 1.18.4_12,1
Switch all ports to use USES=xorg-cat

Change all ports to use USES=xorg-cat instead of the old XORG_CAT
Add USES=xorg and USES=gl as needed to x11@ ports
c32f72e68d
Niclas Zeising (zeising) · 1.18.4_12,1
x11-servers/xorg-server: Packport intel PCI IDs

Backport PCI IDs for various intel graphics cards, to enable MESA with these
graphics cards.  According to upstream, it is safe to backport PCI IDs,
worst case is MESA fails to initialize and fall back to software rendering,
which would be the case without this patch anyway.

PR:		233221
Tested by:	Yuri Pankov
0ec2171cee
Niclas Zeising (zeising) · 1.18.4_11,1
Fix illegal instruction when running in kvm/qemu

Fix illegal instruction when running xserver in kvm or qemu (and possibly
others) virtualisation.  This is solved by disabling sse instructions while
compiling the xf86SlowBcopy (don't ask) function.

This fix was originally committed by dim as r396167 in 2015, and then most
likely accidentally removed in r433863 in 2017.

Bump portrevision

Original commit message:

> Disable use of SSE instructions in Xorg's xf86SlowBcopy() function.
>
> When such instructions are used to copy data from/to mapped video
> memory, some hypervisors (e.g. KVM, Microsoft Hyper-V) can generate
> SIGILL or SIGBUS exceptions, causing Xorg to crash.

PR:		202643
Reported by:	nogcjx@fastmail.fm
Requested by:	dim
Diagnose and fix by:	dim
MFH:		2019Q1
cad8743cbb
Niclas Zeising (zeising) · 1.19.1,2 · as x11-servers/xorg-nestserver
Remove portrevision, it's inherited from master

Remove portrevision, it's inherited from master.  Adding it here made it go
backwards.

Reported by:	Matthew D. Fuller
a40f7214fb
Niclas Zeising (zeising) · 1.18.4_10,1
Change x11/xorgproto to become a build dep

Change x11/xorgproto to become a build time dependency when added to
USE_XORG.  Change the dependency to be on the port, rather than a file the
port installs.
Fix fallout.
Bump portrevision on depending ports.

PR:		230909
Reviewed by:	eadler
Approved by:	portmgr (antoine)
Obtained from:	https://github.com/FreeBSDDesktop/freebsd-ports/tree/feature/xorgproto
exp-run:	antoine
Differential Revision:	https://reviews.freebsd.org/D16906
0fae2e9e0e
Niclas Zeising (zeising) · 1.18.4_9,1
Switch to xorgproto instead of individual packages

Upstream used to distribute protocol headers as separate packages, but has
decided to merge those to a common package, named xorgproto.  This update
tracks that change.

* Add a new port, x11/xorgproto, with are protocol headers for xorg.
* Hook the new protocol port to the build and to infrastructure in
  bsd.xorg.mk.
* Update all ports with a dependency on any of the old *proto packages to
  instead depend on xorgproto.  Bump portrevision.
* Delete the old *proto packages, update MOVED.

PR:		230023
Submitted by:	zeising
Approved by:	portmgr (antoine)
exp-run by:	antoine
15dac70c75
Niclas Zeising (zeising) · 1.18.4_8,1
x11-servers/xorg-server: Enable SECURITY extension

Enabling the SECURITY extension will make ssh -X work in most cases.
This extension is enabled in many Linux distros.

PR:		221984
Submitted by:	Anton Yuzhaninov
151096d9f3
Niclas Zeising (zeising) · 1.18.4_7,1
x11-servers/xorg-server: Backport security fixes

Backport security fixes for CVE-2017-10971 and CVE-2017-10972 (yes, 2017).
For some reason this was not done when the vulnerabilities were documented
in VuXML, and a typo in the version range in VuXML meant that the entries
never matched.

This fixes a memory disclosure and a couple of buffer overruns.

PR:		220584
Reported by:	Vladimir Krstulja
MFH:		2018Q2
Security:	ab881a74-c016-4e6d-9f7d-68c8e7cedafb
ea806daee2
Alexey Dokuchaev (danfe) · 1.18.4_6,1
x11-servers/xorg-server: Fix dashed/dotted line rendering with GLAMOR.

When drawing dashed lines with GLAMOR, they were drawn partially or as
a regular (solid) line, depending on the OpenGL backend.  It behaved
so because screen pixmap was bound as the dash and sampling its alpha,
which is usually just 1.0 (no dashing at all).

Upstream bug:	https://bugs.freedesktop.org/show_bug.cgi?id=99708
Fixed by:	Eric Anholt (it's a pity that anholt@ no longer works
		on FreeBSD)
Silence from:	x11@
4438a3336a
Matthew Rezny (rezny) · 1.19.1,2 · as x11-servers/xorg-nestserver
Drop POTREVISION form slaves so they go forward with xorg-server. Adding PORTREVISION to explicitly bump them after the recent CVE patches actually caused the revision to go backwards instead of forwards.

PR:		223049
Reported by:	mandree
02a6064fc6
Koop Mast (kwm) · 1.18.4_5,1
Fix security issues: CVE-2017-12176 through CVE-2017-12187 in xorg-server. Bump all the slaves due to not being sure where the shared code is used.

MFH:		2017Q4
Security:	7274e0cc-575f-41bc-8619-14a41b3c2ad0
05d144d761
Koop Mast (kwm) · 1.18.4_4,1
Fix security issues: CVE-2017-13721 and CVE-2017-13723 in xorg-server. Bump all the slaves due to not being sure where the shared code is used. MFH:		2017Q4 Security:	4f8ffb9c-f388-4fbd-b90f-b3131559d888
22f6dd2eed
Jan Beich (jbeich) · 1.18.4_3,1
x11-servers/xorg-server: back out r445076

Requested by:	x11 (rezny)
49e8c0410b
Jan Beich (jbeich) · 1.18.4_2,1
x11-servers/xorg-server: close-on-exec for MIT-SHM (like Linux)

This is similar to what x11/libxshmfence already does.

MFH:		2017Q3
86dbaa26e4
Matthew Rezny (rezny) · 1.18.4_1,1
Revision bump of all ports with USE_GL after consolidation of mesa-libs

Approved by:	swills (mentor)
Differential Revision:	https://reviews.freebsd.org/D10845
b760897dde
Matthew Rezny (rezny) · 1.18.4,1
Explicitly disable use of udev to fix build with libudev-devd present.

Approved by:	swills (mentor)
Differential Revision:	https://reviews.freebsd.org/D9719
42622059b2
Baptiste Daroussin (bapt) · 1.18.4,1
XWayland is an X Server running as a Wayland client, thus capable of displaying native X11 client applications in a Wayland compositor environment.

WWW: https://wayland.freedesktop.org/xserver.html
d70b127b51
Matthew Rezny (rezny) · 1.18.4,1
Remove post-patch cruft accidentally introduced into patch-configure files with the previous commit. Thanks to tijl for noticing what I overlooked.

Approved by:	swills (mentor)
Differential Revision:	https://reviews.freebsd.org/D9544
acdcc605d9
Matthew Rezny (rezny) · 1.18.4,1
Xorg-servers update to 1.18.4 with driver updates and revision bumps.

Update xf86-video-ati to 7.8.0
Update xf86-video-intel to 2.99.917.20170103
Update xf86-input-synaptics to 1.9.0
Update xf86-input-evdev to 2.10.5
Update xf86-video-r128 to 6.10.2
Update xf86-video-rendition to 4.2.6
New port: xf86-video-geode

PR:		214591,216269,214687,214593,214715,216276,216277,216278,216287,
		216288,216292,216298,214560,216299,216300,216301,216302
Approved by:	swills (mentor, portmgr)
Differential Revision:	https://reviews.freebsd.org/D9436
3f87b5cb51
Baptiste Daroussin (bapt) · 1.19.0_1,1 · as x11-servers/xorg-vfbserver
Add missing run dependency on xkeyboardconfig

PR:		196653
Reported by:	rsimmons0@gmail.com
5bd1e953c8
Baptiste Daroussin (bapt) · 1.19.0,2 · as x11-servers/xorg-nestserver
Add missing run dependency on xkeyboardconfig

PR:		196653
Reported by:	rsimmons0@gmail.com
f2455b6867
Brad Davis (brd) · 1.17.4,1
Fix xorg-server build on arm64.

Submitted by:	andrew
Approved by:	bapt, kwm (x11)
Differential Revision:	https://reviews.freebsd.org/D8465
9f5f43fcf8