Update to 1.18.4700675f6de
CVE-2026-88812, CVE-2026-93515, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536
X.Org X server and related programs
# pkg install xephyr# pkg install xorg-nestserver# pkg install xorg-server# pkg install xorg-vfbserverinstalls xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1 from latest; from quarterly (2026Q4) xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1# cd /usr/ports/x11-servers/xorg-server && make install clean| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 21.1.25,1 | 21.1.25,1 | – |
| FreeBSD 15 | 21.1.25,1 | 21.1.25,1 | – |
| FreeBSD 14 | 21.1.25,1 | 21.1.25,1 | 21.1.25,1 |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 21.1.25,1 | 21.1.25,1 | – |
| FreeBSD 14 | 21.1.25,1 | 21.1.25,1 | 21.1.25,1 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
The CVE record lists the packaged version 21.1.25,1 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-56000 | 9.0 | 2026-07-08 | Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, … |
| CVE-2026-55999 | 8.5 | 2026-07-08 | Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow… |
| CVE-2023-5574 | 7.0 | 2023-10-25 | A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple prot… |
Listed in VuXML, the packaged version 21.1.25,1 is still in the affected range; pkg audit reports it. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-56000 | 9.0 | 2026-07-08 | VuXML · Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, … |
| CVE-2026-55999 | 8.5 | 2026-07-08 | VuXML · Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow… |
CVE-2026-88812, CVE-2026-93515, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536
CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263, CVE-2026-50264
CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003
CVE-2025-49175, CVE-2025-49177, CVE-2025-49178, CVE-2025-49179, CVE-2025-49180
CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601
CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886
CVE-2022-4283, CVE-2022-46340, CVE-2022-46341, CVE-2022-46342, CVE-2022-46343, CVE-2022-46344
no CVE referenced
CVE-2020-14345, CVE-2020-14346, CVE-2020-14361, CVE-2020-14362
CVE-2017-12176, CVE-2017-12177, CVE-2017-12178, CVE-2017-12179, CVE-2017-12180, CVE-2017-12181, CVE-2017-12182, CVE-2017-12183, CVE-2017-12184, CVE-2017-12185, CVE-2017-12186, CVE-2017-12187
CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102
CVE-2008-1377, CVE-2008-1379, CVE-2008-2360, CVE-2008-2361, CVE-2008-2362
CVE-2007-5760, CVE-2007-5958, CVE-2007-6427, CVE-2007-6428, CVE-2007-6429, CVE-2008-0006
| PR | Summary | Status | Changed |
|---|---|---|---|
| 297584 | maintainer-feedback? x11-servers/xorg-server: Xorg does not automatically detect outputs/monitors on a USB hub | New | 2026-08-17 |
| 297517 | maintainer-feedback? x11-servers/xorg-server: server stops when started in the background of current VT | New | 2026-08-14 |
| 273369 | maintainer-feedback? x11-servers/xorg-server: "Cannot run in framebuffer mode" after updating to 21.1.8_4,1 | Open | 2026-05-12 |
| 273161 | needs-patch x11-servers/xorg-server: rootless without setuid bit | New | 2026-02-21 |
| 253278 | maintainer-feedback? x11-servers/xorg-server: Lock file: Various fixes | In Progress | 2025-10-26 |
| PR | Summary | Status | Changed |
|---|---|---|---|
| 287456 | maintainer-feedback? x11-servers/xorg-server: backport TearFree page flips | New | 2025-10-25 |
| 288636 | maintainer-feedback? x11-servers/xorg-server:unable to build- redefinition of typedef '__GLXscreen' is a C11 feature | New | 2025-08-03 |
| 282643 | maintainer-feedback? x11-servers/xorg-server:unable to build riscv64-ld: error: undefined symbol: xf86EnableIO | New | 2025-04-12 |
| 280614 | maintainer-feedback? x11-servers/xorg-server: 'X -configure' does not delete /tmp/.X11-unix/X0 when done | New | 2024-08-04 |
Update to 1.18.4700675f6de
Update to 1.18.44b02f15b0f
x11-servers/xorg-nestservdr: document SSL requirement Approved by: SSL blanketaf14198731
x11-servers/xorg-vfbserver: document SSL requirement Approved by: SSL blanket12e8d047ee
Update to 1.18.3 Use INSTALL_WRKSRC instead of home made equivalente629e9048b
Use INSTALL_WRKSRC instead of home made equivalentb6876340ee
Update to 1.18.312f5f23eeb
Fix usage of WITH_OPENSSL_BASE, WITH_OPENSSL_PORT and OPENSSL_PORT. WITH_OPENSSL_* can't be set after bsd.port.pre.mk. Fold all other usage into using SSL_DEFAULT == foo PR: 210149 Submitted by: mat Exp-run by: antoine Sponsored by: The FreeBSD Foundation, Absolight Differential Revision: https://reviews.freebsd.org/D65775b55a8a53e
Remove ${PORTSDIR}/ from dependencies, categories v, w, x, y, and z.
With hat: portmgr
Sponsored by: Absolight72ea7e696bUpdate to 1.18.0379ce5b305
Update to 1.18.0013b8cdd3c
Update xorg-server to 1.17.4.52f474c7cb
Unbreak the build of xorg-server 1.17.2 on arm. Apparently the 1.17 update broke this. Submitted by: sbruno@76da779716
Add missing dependancies so xephyr can be build again. [1] Reported by: Piotr Kubaj <pkubaj@riseup.net>4c670c9a31
unbreak index.dbcb36987b
Unbreak INDEX3ad2ea6e69
Xorg-server update to 1.17.2 with related driver updates and bumps. Update fontproto to 2.1.3. Update libXfont to 1.5.1. Update xf86-input-keyboard 1.8.1. Update xf86-input-vmmouse to 13.1.0. Update xf86-input-void to 1.4.1. Update xf86-video-chips to 1.2.6. Update xf86-video-cirrus to 1.5.3. Update xf86-video-mach64 to 6.9.5. Update xf86-video-neomagic to 1.2.9. Update xf86-video-r128 to 6.10.0. Update xf86-video-s3virge to 1.10.7. Update xf86-video-savage to 2.3.8. Update xf86-video-siliconmotion to 1.7.8. Update xf86-video-sis to 0.10.8. Update xf86-video-trident to 1.3.7. Update xf86-video-vesa to 2.3.4. * All other xf86-* drivers where bump and/or patched to allow them to compile and work with the new xorg-server. * The ATI-ums driver is removed because the API it depends on was removed from the xorg-server. * Add patch to sunffb to make the lack of XAA non-fatal (not build/run tested due to lack of hardware). * Remove the extra patches in xorg-server for arm. The code seems to support it now natively. Please file a bug if this is not the case. * Update the xorg-server support in virtualbox-ose-additions for vboxmouse. [1] Submitted by: jkim@ [1] Obtained from: Graphics devel repo1742c4fbee
Disable use of SSE instructions in Xorg's xf86SlowBcopy() function. When such instructions are used to copy data from/to mapped video memory, some hypervisors (e.g. KVM, Microsoft Hyper-V) can generate SIGILL or SIGBUS exceptions, causing Xorg to crash. Reported by: nogcjx@fastmail.fm Approved by: x11 (bapt) PR: 202643 MFH: 2015Q36edde2ba50
Automatically load mouse integration support for VirtualBox guest.6fce017bdf
MASTER_SITES cleanup.
- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.
While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.
Also, replace some EXTRACT_SUFX occurences with USES=tar:*.
Checked by: make fetch-urlall-list
With hat: portmgr
Sponsored by: Absolight60d1a83c2aDo not include bsd.port.pre.mk twicee2c9e4fad3
Duplicate svn revision 368293 and fix compilation on armv6. PR: 197092 Submitted by: mikael.urankar@gmail.com03d3126212
Disable fontpath.d support as it overwrites the default fontrootdir making non fontconfig application like xcalc not to find their fonts Reported by: Jakub Lach <jakub_lach@mailplus.pl>, Stefan Thurner <stthur@gmail.com>66d439f626
Make fonts repecting XDG
Xorg is now looking in ${LOCALBASE}/share/fonts by default
Xorg now accepts symlinks in etc/X11/fontpath.d (as decribed in Xserver(1))
Large cleanup on lots of font ports
All fonts are now properly dynamically generating fonts.dir and fonts.scale
instead of sometime overwriting existing ones)
All fonts are generating fontconfig's cache
Improve consistency in fonts portsa5da770e67Fix CVE-2015-0255. Information leak in the XkbSetGeometry request of X servers. Submitted by: http://lists.freedesktop.org/archives/xorg/2015-February/057158.html Obtained from: upstream MFH: 2015Q1e8e22ed74d
- Fix AutoAddDevices option when config/devd backend is used Reported by: Jonathan Chen <jonc@chen.org.nz>, lightside@gmx.com, many others Approved by: x11 (dumbbell, kwm)b7088112c0
Final removal of WITH_NEW_XORG This knob was turned on for all version of FreeBSD in r369875 (2014-10-03) and officially deprecated. Since then, it was gradually removed from many ports when they needed an update. x11-servers/xorg-server was the last major user of this knob. The port was updated to xserver 1.14 in r374982 (2014-12-19). The update got rid of the knob, clearing the path to the final removal. This commit changes ports who were checking for WITH_NEW_XORG and remove its handling from bsd.port.mk. While here, two sanity checks are added to warn user about WITH_KMS and WITH_NEW_XORG which have no effect now. Differential Revision: https://reviews.freebsd.org/D1351 Reviewed by: antoine, bapt, kwm Approved by: portmgr (antoine, bapt), kwm3c9a1d11c2
x11-servers/xorg-server: Update to 1.14
The X.Org server has been updated to 1.14. The changes it brings are described
in a post on the Graphics team blog:
http://blogs.freebsdish.org/graphics/2014/11/19/xserver-1-14-update-ready/
The most noticable change is the DEVD input device autodetection backend
which is enabled by default, replacing the HAL backend. The keyboard
layout configuration must be migrated from HAL's .fdi files to X.Org
files. The procedure is explained in the post mentionned above.
Several ports were removed with this update, mainly because they are not
compatible with the X.Org server anymore:
o nvidia-driver-71
o nvidia-driver-96
o xf86-input-egalax
o xf86-video-newport
o xf86-video-tga
PR: 155696, 181660, 183478 (partially fixed), 188640, 191331
Differential Revision: https://reviews.freebsd.org/D1337
Submitted by: ak (most of the work on the DEVD backend), dumbbell, kwm,
zeising
Tested by: Many people on freebsd-x11@ and IRC
Reviewed by: kwm, portmgr (antoine)
Approved by: kwm, portmgr (antoine)91293a3505Fix multiple xserver security advisories in the 1.12.4 xserver. The patches where not ported to 1.7.7 so mark it forbidden. This version is not default anymore and will be removed in the 1.14 update that currently being tested. Obtained from: xserver upstream MFH: 2014Q4 Security: 27b9b2f0-8081-11e4-b4ca-bcaec565249c1ef33079b3
- Fix various distinfo errors - Remove unused USE_* knobs - Fix typos in USE_* knobs - Remove empty lines after .include <bsd.port.mk> Approved by: portmgr (bapt) Differential Revision: https://reviews.freebsd.org/D91143a22bb0dd
Add some bits to the armv6 build to get a successful build/run on the RPi. Not bumping the PORTREVISION as this is only applied to ARM builds. Phabric: https://reviews.freebsd.org/D756 PR: 181318 Submitted by: mikael.urankar@gmail.com Reviewed by: kwm@ Approved by: bdrewery (mentor)d7a36e69db
Fix the PORTREVISION bump for the lang/gcc update that went badly for ports (x11-drivers plus graphics/libGL plus x11-servers/xorg-server) that handle PORTREVISION in a creative manner hardly lending itself to any form of automated bumping. PR: 192025 Reported by: Scott Allendorf <scott-allendorf@uiowa.edu>0abc164359
Update the default version of GCC in the Ports Collection from GCC 4.7.4 to GCC 4.8.3. Part II, Bump PORTREVISIONs. PR: 192025 Tested by: antoine (-exp runs) Approved by: portmgr (implicit)15945f8122
Update to 1.14.7 - changes: * Do not make it a slave of xorg-server anymore so it doesn't change depending on NEW_XORG * Update to the highest version able to deal with dependencies of the oldest xorg supported9b179c3549
Readd PORTEPOCH removed by accident94b7c21eb0
Prefer explicit activation of xvfb0c40a887bd
Update to 1.14.7 - Changes: * Do not make it a slave of xorg-server anymore so it doesn't change depending on NEW_XORG * Update to the highest version able to deal with dependencies of the oldest xorg supported35185537aa
Properly reset ownership remove now useless @execac725ce224
Because this is a slave port, it cannot load bsd.port.pre.mk before defining the do-install target. This means that the test for .if defined(WITH_NEW_XORG) will always be false unless it's actually set in make.conf. WITH_NEW_XORG is automatically set for OSVERSION > 100704, but the port can't access that. Apply a really inelegant kludge that simply tries to install the manpage from both possible places. One will fail, and one will succeed.c9bf57300d
Bump XORG_REVISION to reflect changed behavior on PowerPC. Approved by: kwm8ac3b545c9
mmap() /dev/mem instead of /dev/console on PowerPC. Mostly this was already being done in libpciaccess, so this is functionally a no-op in most cases and unifies behavior. Besides aesthetic appeal, the ability to directly mmap() all of physical memory through /dev/console on PowerPC is about to go away on -CURRENT, which means everything should converge on /dev/mem. Approved by: kwmc3246c7f70
x11-drivers/xf86-video-ati: On other ARCH then i386/amd64 keep the old version. Since 7.x is KMS which is not available on the other ARCHS.
x11-drivers/xf86-video-nv:
Fix nv driver on ppc.
x11-servers/xorg-server:
In the powerpc case of NEW_XORG don't overwrite EXTRA_PATCHES.
Patch update:
< nathanw> it works around the change in behavior in libpciaccess that
the PR mentions
< nathanw> by porting the relevant code from the Linux backend
PR: ports/188278
Submitted by: jmmv@, nwhitehorn@eeabcd7024Revert accident commit in -r351411. This should stop the option dialog from spamming the user. Submitted by: marino@f4fc5055dc
Fix BadImplemented errors that happen with gdk 3.12.x and GNOME 3. [1] Use INSTALL_TARGET=install-strip for stripping. Allow user to package xorg-server again. Obtained from: debian [1]62378ea793
When linking a library libA with a library libB using libtool, if libB.la exists, libtool will add all libraries libB.la refers to (dependency_libs field) to the linker command line and store them in the dependency_libs field of libA.la. So everything that subsequently links with libA will also link to these extra libraries. This causes too much overlinking. This commit modifies Mk/Uses/libtool.mk so it empties the dependency_libs field in .la libraries during staging. However, because .la libraries have very limited use when dependency_libs is empty it makes sense to completely remove them during staging. So with this commit USES=libtool is modified to remove .la libraries and a new form (USES=libtool:keepla) is introduced in case they need to be kept (dependency_libs is still emptied). PORTREVISION is bumped on all ports with USES=libtool that install .la libraries. Most ports are also changed to add :keepla because .la libraries have to be kept around as long as there are dependent ports with .la libraries that refer to them in their dependency_libs field. In most cases :keepla can be removed again as soon as all dependent ports that install .la libraries have some form of USES=libtool added to their Makefile. PR: ports/188759 Exp-run: bdrewery Approved by: portmgr (bdrewery)aad09bc5e2
The FreeBSD x11@ and graphics team proudly presents a zeising, kwm production, with help from dumbbell, bdrewery: NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE This update switches over to use the new xorg stack by default on FreeBSD 9 and 10 stable, on osversions where vt(9) is available. It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in /etc/make.conf . FreeBSD 8-STABLE and released versions of FreeBSD still use the old version. A package repository with binary packages for new xorg will be available soon. This patch also contains updates of libxcb and related ports, pixman, as well as some drivers and utilities. Bump portrevisions for xf86-* ports, as well as virtualbox-ose-additions due to xserver version change. Apart from these updates, the way shared libraries are handled has been changed for all xorg ports, as well as libxml2 and freetype, which means ltverhack is gone and as a consequence shared libraries have been bumped. The plan is that this change will make library bumps less likely in the future. All affected ports have had their portrevisions bumped as a consequence of this. Fix some issues where WITH_NEW_XORG weren't detected properly on CURRENT. Update instructions, hardware support, and more notes can be found on https://wiki.freebsd.org/Graphics Thanks to: all testers, bdrewery and the FreeBSD x11@ team exp-run by: bdrewery [1] PR: ports/187602 [1] Approved by: portmgr (bdrewery), core (jhb)39fc32e828
Fix packaging on FreeBSD 11 when WITH_NEW_XORG is defined by bsd.port.mkf7ee036117
Remove extra bsd.port.options.mk, it already defined in the master port. PR: ports/184952 Submitted by: marino@171e2bd11b
Remove extra bsd.port.options.mk, it already defined in the master port. Fix typo in vfbserver port. Obtained from: xorg-dev repof396dfff5b
Fix PLIST_SUB (add a space after @comment) for non-default option. Reported and tested by: Andrea Venturoli <ml@netfence.it> Approved by: x11 (kwm)6e0bf304bd