CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

x11-servers/xorg-server 21.1.25,1

X.Org X server and related programs

Port info

Maintainer
x11@FreeBSD.org
Packages
latest: xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1
Upstream
up to date
Last update
to 21.1.25,1 · 55b667ca6c
Quarterly
2026Q4: xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1 · last MFH f09d699bf8
Formerly
x11-servers/xephyr until 2022-08-02, x11-servers/xorg-nestserver until 2022-08-02, x11-servers/xorg-vfbserver until 2022-08-02
WWW
https://gitlab.freedesktop.org/xorg/xserver
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install xephyr
# pkg install xorg-nestserver
# pkg install xorg-server
# pkg install xorg-vfbserver
installs xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1 from latest; from quarterly (2026Q4) xephyr 21.1.25,1, xorg-nestserver 21.1.25,2, xorg-server 21.1.25,1, xorg-vfbserver 21.1.25,1
Port
# cd /usr/ports/x11-servers/xorg-server && make install clean
Size
841 KiB download · 2.1 MiB installed
Depends on
devel/libunwind 20250904, graphics/libglvnd 1.7.0, graphics/mesa-dri 26.2.2_1, x11-fonts/libXfont2 2.0.9, x11/libXau 1.0.12, x11/libXdmcp 1.1.5, x11/libxcb 1.17.0, x11/libxkbfile 1.2.0, x11/libxshmfence 1.3.3, x11/pixman 0.46.4, x11/xcb-util 0.4.1,1, x11/xcb-util-image 0.4.1, x11/xcb-util-keysyms 0.4.1, x11/xcb-util-renderutil 0.3.10, x11/xcb-util-wm 0.4.2, x11/xkbcomp 1.5.0, x11/xkeyboard-config 2.48
License
MIT
Note
Size, dependencies, options and messages are those of xephyr.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1621.1.25,121.1.25,1–
FreeBSD 1521.1.25,121.1.25,1–
FreeBSD 1421.1.25,121.1.25,121.1.25,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1521.1.25,121.1.25,1–
FreeBSD 1421.1.25,121.1.25,121.1.25,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (3)

The CVE record lists the packaged version 21.1.25,1 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-560009.02026-07-08Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, …
CVE-2026-559998.52026-07-08Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow…
CVE-2023-55747.02023-10-25A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple prot…

VuXML only (0)

Listed in VuXML, the packaged version 21.1.25,1 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (33)

Show 33 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs whose record still lists this version although VuXML considers them fixed (usually a backported fix).
CVECVSSPublishedDescription
CVE-2026-560009.02026-07-08VuXML · Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, …
CVE-2026-559998.52026-07-08VuXML · Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow…

Problem reports (9) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
297584maintainer-feedback? x11-servers/xorg-server: Xorg does not automatically detect outputs/monitors on a USB hubNew2026-08-17
297517maintainer-feedback? x11-servers/xorg-server: server stops when started in the background of current VTNew2026-08-14
273369maintainer-feedback? x11-servers/xorg-server: "Cannot run in framebuffer mode" after updating to 21.1.8_4,1Open2026-05-12
273161needs-patch x11-servers/xorg-server: rootless without setuid bitNew2026-02-21
253278maintainer-feedback? x11-servers/xorg-server: Lock file: Various fixesIn Progress2025-10-26
Show all 9
PRSummaryStatusChanged
287456maintainer-feedback? x11-servers/xorg-server: backport TearFree page flipsNew2025-10-25
288636maintainer-feedback? x11-servers/xorg-server:unable to build- redefinition of typedef '__GLXscreen' is a C11 featureNew2025-08-03
282643maintainer-feedback? x11-servers/xorg-server:unable to build riscv64-ld: error: undefined symbol: xf86EnableIONew2025-04-12
280614maintainer-feedback? x11-servers/xorg-server: 'X -configure' does not delete /tmp/.X11-unix/X0 when doneNew2024-08-04

Commits (287)

Niclas Zeising (zeising)
Switch FreeBSD CURRENT to use the new xorg stack (WITH_NEW_XORG=) [0] If the old xorg stack is still needed, it is possible to add WITHOUT_NEW_XORG= to /etc/make.conf to get the old version.

Update several xorg related ports, including:
x11/libxcb 1.9.1 -> 1.9.3
graphics/libdrm 2.4.46 -> 2.4.50
x11/pixman 0.30.2 -> 0.32.4
x11/xkeyboard-config 2.9 -> 2.10.1
x11-drivers/xf86-input-keyboard 1.7.0 -> 1.8.0

Fix dissapearing cursor in xf86-video-vmware [2]

Stagify all x11@-owned ports

Bump portrevisions for xf86-* ports due to xserver version change.

Fix fallout from updates where needed.

Thanks to:	all testersi, bdrewery and the FreeBSD x11@ team
exp-run by:	bdrewery [1]
PR:		ports/184684 [1], ports/181385 [2]
Submitted by:	Douglas Carmichael <dcarmich@dcarmichael.net> [2]
Approved by:	portmgr (bdrewery), core (jhb) [0]
47be7a61c9
Koop Mast (kwm)
Fix typo.

Submitted by:	Herbert J. Skuhra <h.skuhra@gmail.com>
61f7258c32
Koop Mast (kwm)
Document xorg-server use after free CVE.

Reviewed by:	zeising@
785722b1cf
Niclas Zeising (zeising)
Fix patches.  Remove two unneeded ones, and add new patches to fix sparc64. This was missed in the mesa update.

This syncs x11-server/xorg-server with the xorg development repo

Bump portrevision again in case.
Apologies for the churn!

Obtained from:	xorg development repo
6456a79045
Niclas Zeising (zeising)
Fix perl dependency.

Submitted by: Barbara Guida <bar@FreeBSD.org>
23f2e96944
Niclas Zeising (zeising)
The FreeBSD graphics/x11 team proudly presents a kwm, zeising production:

MESA 9.1.6

Starring:
Mesa 9.1.6, including libGL, libGLU and dri (new xorg only)
Addition of libEGL and libglesv2
KMS support for ATI graphics cards in 10-current (new xorg only)
Improved sparc64 support for new xorg. [1]
pixman 0.30.2, including shlib bump and portrevision bumps
libX11 1.6.2
Make absolute pointing devices work with x11-drivers/xf86-input-mouse
x11-drivers/xf86-video-ati 7.2.0 for 10-current (KMS aware ati driver)

Also starring:
Updates to drivers and other libraries and utilities

Additional notes:
When updating MESA related ports (libGL, dri) you need to remove old versions
first.  See UPDATING for details.

PR:		ports/181962 [2]
Submitted by:	marius [1]
		zeising [2]
Exp-run by:	bdrewery
Approved by:	portmgr (bdrewery)

Thanks to all who helped testing!
5a4c543c2b
Baptiste Daroussin (bapt)
Add NO_STAGE all over the place in preparation for the staging support (cat: x11-servers)
eea5b447da
Niclas Zeising (zeising)
Plug two more use before initialized with the new x server.

Noted by:	clang
Obtained from:	xorg development repo
c17dedd527
Andrej Zverev (az)
- Convert to new perl framework

Approved by:	bapt@ (x11@)
2e118d08ae
Niclas Zeising (zeising)
Enable AIGLX by default on xorg-server 1.12. (WITH_NEW_XORG) Bump portrevision for 1.12

Obtained from:	xorg development repo
927cfacb14
Niclas Zeising (zeising)
Readd the dix_events.c patch that was removed with the xorg update. There have been some reports of problems with pointer focus and other related issues in Mwm and open-motif without this patch. Bump portrevision for old xorg.

PR:		ports/179397
Submitted by:	William Bulley <web@umich.edu>
c20d929bcc
Jung-uk Kim (jkim)
Add a patch to fix upstream bug 18451 for 1.7.7.

https://bugs.freedesktop.org/show_bug.cgi?id=18451
http://cgit.freedesktop.org/xorg/xserver/patch/?id=6dae7f3

Analyzed by:	dim
PR:		ports/179625
95f49b08d0
Koop Mast (kwm)
Don't install the README.compiled file, it got installed in a directory not owned by xorg-server. This will fix poudriere -t

Submitted by:	miwi
ddb2e5e6a1
Niclas Zeising (zeising)
Fix patching on powerpc with new xorg.

PR:		ports/179229
Submitted by:	jhibbits (PR), zeising (patch)
5f84f960af
Niclas Zeising (zeising)
The FreeBSD x11 team proudly presents an zeising, kwm, miwi, bapt, eadler production:

Xorg 7.7

Starring:
xserver 1.12.4 (new xorg only)
Mesa 8.0.4, including libGL, libGLU and dri (new xorg only)
libX11 1.5.0
libxcb 1.9
libdrm 2.4.42 (new xorg only)
freeglut 2.8.1
Also starring:
Updates to drivers and other libraries and utilities

Additional notes:
Change pkgconf to be a build dependency.
Add a new USE_XORG, xcb, to depend on libxcb and update all ports to use
this.
Trim makefile headers.
Take maintanership of x11/xcb-proto, ok'd by ashish.
If you are running WITH_NEW_XORG=, you need to rebuild all installed
drivers, see UPDATING for more information.
Various fixes to make ports compile.

PR:		ports/177942
Exp-run by:	miwi
Approved by:	portmgr (miwi)

Thanks to all who helped testing!
92ea0d614b
Niclas Zeising (zeising)
Add a new xorg module, to use with USE_XORG: xorg-macros.  This  module pulls in devel/xorg-macros. Convert all ports that depends on xorg-macros to use this USE_XORG. Split up the long XORG_MODULES= list in bsd.xorg.mk to have only one module on each line. Add xorg-macros dependency to xorg-server.

Reviewed by:	kwm, bapt
Obtained from:	xorg development repo (partly)
8ed49557f8
Niclas Zeising (zeising)
Fix the patch used to make xorg-server build with clang on i386.

Noticed by:	Barbara Guida <barbara.freebsd@gmail.com>
PR:		ports/175776 [1]
Submitted by:	Tsurutani Naoki <turutani@scphys.kyoto-u.ac.jp> [1]
Approved by:	kwm, miwi (mentors, implicit)
83d33b71ca
Niclas Zeising (zeising)
Fix build on i386 when building with clang.

PR:		ports/174286 (inspired by)
Submitted by:	deeptech71 <deeptech71@gmail.com>
Tested by:	crees, kwm
Approved by:	kwm, miwi (mentors, implicit)
Obtained from:	xorg-dev repo
b1d186d5f3
Niclas Zeising (zeising)
Add a patch to fix a couple of cases of use before initialized in the new xorg-server.  Without this patch, xorg-server compiled with clang segfaults. Bump portrevision since clang is default compiler on current.

Reviewed by:	kwm
Approved by:	kwm, miwi (mentors, implicit)
fa8e223204
Alberto Villa (avilla)
- Add missing "defined".

Approved by:	eadler, kwm (x11@)
Feature safe:	yes
bf0a5354d3
Koop Mast (kwm)
Solve libGL.so and libglx.so conflict situation between libGL, xorg-server and the nvidia-driver. Install the libraries in port specific directories. Use pkg-install and pkg-deinstall scripts to update the hardlinks to the default locations of these files.

While here clean up some @dirrmtry lines in xorg-server plist for directories
that aren.t created by xorg-server.

Motivator:	pkgng
Inspiration:	irc, freebsd-x11@ mailinglist discussion (sorry can't find it
		anymore to give credit the people)
Reviewed by:	danfe@ (for nvidia parts), bapt@
Approved by:	danfe@ (for nvidia parts)
With hat:	x11@
04a589dee4
Koop Mast (kwm)
Replace some spaces with tabs, and remove double defined variables in PLIST_SUB.
2c361035bb
Niclas Zeising (zeising)
Fix the build of xorg related ports when the base system is compiled with clang as system compiler and cpp is clang cpp (as opposed to GNU cpp). This is done by removing the configure test for cpp completely.  Using clang cpp will make some manual pages as well as some scripts get slightly wierd whitespace formatting.  However, it does not affect the function of the scripts or the instructions in 

PR:             ports/166373
Submitted by:   Jakub Lach <jakub_lach@mailplus.pl> (PR)
Patch by:       me (with ideas from PR and mailing list)
Tested by:      Jakub Lach <jakub_lach@mailplus.pl>, me
Approved by:    kwm (mentor)
Obtained from:  xorg staging area
7761aefad2
Baptiste Daroussin (bapt)
Add new OPTIONS_EXCLUSE_${ARCH} to be able to exclude an option on the given arch Fix xorg-server on sparc64 by excluing the HAL option on sparc64 has it used to be before convertion to new options framework [1]

Reported by:	marius@
Tested by:	marius@
Approved by:	kwm [1]
abb421178b
Baptiste Daroussin (bapt)
Convert to new options framework while here remove the NO_SUID_XSERVER which was redundant with the options and fix a bug[1] (defining an option after bsd.port.pre.mk) which was a workaround of limitations of the old framework

Reported by:	ak@ [1]
Reviewed by:	kwm@, miwi@
Approved by:	kwm@, miwi@
43c93c7817
Christian Weisgerber (naddy)
Revert "dix: use the event mask of the grab for TryClientEvents." http://cgit.freedesktop.org/xorg/xserver/commit/?id=018c878e9495b21146c8f38617fdd1bf6d8cc73b

This fixes delivery of button press events to clients.
In particular, it fixes irrecoverable focus loss in mwm(1).

Approved by:	miwi
Obtained from:	Xorg upstream
ca030a712f
Martin Wilke (miwi)
- Please welcome Xorg 7.5.2

The Xorg Team is pleased to announce the next round of Xorg updates.
       The team created a new flag called WITH_NEW_XORG that users can include
       in /etc/make.conf. This was created for the intel KMS work being done
       althouthough It probably works for other chips. Unfortunately, the intel
       KMS driver will only work on FreeBSD 9(RELENG|STABLE) or 10/HEAD users.
       Older version of FreeBSD will not be supported. Intel users will need
       to patch their source manually with Konstantin?s KMS kernel patch to get
       the newer chips to work. Please carefully read UPDATING entry.

Changes:

        - libdrm 2.4.31 (including KMS support)
        - mesa 7.11.2
        - xorg-server 1.10.6
        - a lot of new Graphic Drivers.

    I would like to thank:

         Koop Mast
         Eitan Adler
         Niclas Zeising
         and all helpers and testers from x11@.
29e347e197
Eitan Adler (eadler) · 1.7.7 · as x11-servers/xephyr
Repeated words are are hard to to find sometimes.

Approved by:	portmgr (itetcu)
c5d811a37d
Martin Wilke (miwi) · 1.7.7_3,1
- Remove WITH_FBSD10_FIX, is no longer needed
e1c6649edf
Martin Wilke (miwi) · 1.7.7_3,1
- Fix build on FreeBSD 10.0

Notes: all x11@ ports fixed for FreeBSD 10
690535e580
Koop Mast (kwm) · 1.7.7_3,1
Fix CVE-2011-4028 and CVE-2011-4029.

Obtained from:	upstream xorg-server
Security:	8441957c-f9b4-11e0-a78a-bcaec565249c
185fd9100b
Koop Mast (kwm) · 1.7.7_2,1
Fix the "exaGetPixmapFirstPixel called for invalid bpp" problem. This bug is more visible with XFCE.

PR:		ports/156721
Submitted by:	Alexey Shuvaev <shuvaev@physik.uni-wuerzburg.de>
Obtained from:	xorg-server upstream
With hat:	x11@
28a3558f38
Christian Weisgerber (naddy) · 1.7.7_1,1
Revert "dix: use the event mask of the grab for TryClientEvents." http://cgit.freedesktop.org/xorg/xserver/commit/?id=018c878e9495b21146c8f38617fdd1bf6d8cc73b

This fixes delivery of button press events to clients.
In particular, it fixes irrecoverable focus loss in mwm(1).

Approved by:	miwi
Obtained from:	Xorg upstream
336870fe10
Martin Wilke (miwi) · 1.7.7,1
- Please welcome Xorg 7.5.1

The X-Server has been patched to the latest 1.7.X series, drivers
and fonts have been updated to the latest versions. This update includes
some components from Xorg 7.6 with a lot of improvements, and it seems
that the performance is much better than the old version. Also this
Update fix build issues with clang and binutils 2.17.50 in current,
remove 6.X gruft and de-author pkg-descr.

I would like to thank:

	Beat Gaetzi
	Dima Panov
	Koop Mast
	Eitan Adler
	and all Testers.

PR:		ports/147646
		ports/148035
		ports/148744
		ports/150223
		ports/152889
		ports/154457
d594ccc94f
Stanislav Sedov (stas) · 1.7.5,1
- There's no nv(4x) manpage in xorg-server distribution anymore.

Reported by:	nathanw
Feature safe:	yes
24aa2a2676
Stanislav Sedov (stas) · 1.7.5,1
- Fix build on powerpc64.

PR:		ports/147568, ports/153644
Submitted by:	nwhitehorn, Matthew Rezny <mrezny@hexaneinc.com>
Feature safe:	yes
3c334f3c81
Martin Wilke (miwi) · 1.7.5,1
- Fix build on ppc

Submitted by:	Andreas Tobler
0040fcc0b6
Martin Wilke (miwi) · 1.7.5,1
- Update to Xorg 7.5

The Intel drivers was patched to work with
the new server. The drivers for Vesa, NV,NVIDIA and
ATI have been tested thoroughfully and seem to work fine.
A complete changelog of Xorg 7.5 can you read here:

http://www.x.org/releases/X11R7.5/

A note to FreeBSD 6.X users: We strongly recommend you
to update your system to 7.x or above.

For updating try

portupgrade -af \*

or:

portmaster -af

Please report any problems and issus to x11 (at) FreeBSD.org.

Thanks to beat@, rnoland@, fluffy@, stas@ and all testers for their help
and Feeback.

Tested by:	Community and 2x exp-runs
f4936121f9
Marius Strobl (marius) · 1.6.5_1,1
Given that HAL doesn't work on sparc64 and always needs to be disabled there anyway change the default to off for that architecture.

Approved by:	rnoland
5286f4f791
Robert Noland (rnoland) · 1.6.5,1
Update xorg-server and friends to 1.6.5.
4aabe04a2e
Marcel Moolenaar (marcel) · 1.6.1,1
Allow building on ia64. This does not make it functional, because ia64 doesn't have any non-serial console. It does allow xorg to build though and in particular xorg-drivers. The latter depends on xorg-server.

Ok'd: rnoland@
7220595e7c
Robert Noland (rnoland) · 1.6.1,1
Update Xserver and friends to 1.6.1
a588a7ab6e
Robert Noland (rnoland) · 1.6.0,1
Update Xorg server to 1.6.0

o Update randrproto, libXrandr and xrandr to 1.3.0
	o Update xf86-video-intel to 2.6.3
	o Update other less common drivers as needed
	o Mark a bunch of un-maintained input drivers ignored
	o Update the various slave X server ports as well
fd559155d1
Marius Strobl (marius) · 1.5.3_8,1
Given that the x86-centric approach of mmap(2)'ing PCI memory via mem(4) doesn't work on sparc64, revert to the pre-libpciaccess approach of using the tty(4) device opened by the X server there. Hopefully we have proper MI means of doing so one day.

Approved by:	flz
38c027f72e
Robert Noland (rnoland) · 1.5.3_7,1
Add the patch that I missed in the last commit.
ffca734ac6
Robert Noland (rnoland) · 1.5.3_7,1
Add a patch from git to fix issues with gnome-2.25.

Requested by:	marcus
e8bb983dff
Robert Noland (rnoland) · 1.5.3_6,1
Add a patch to handle memory barriers on amd64 the same as linux.

This is reported to prevent some lockups with the nv driver on amd64.

http://bugs.freedesktop.org/show_bug.cgi?id=3168
7841a19b63
Robert Noland (rnoland) · 1.5.3_5,1
Add a patch to deal with the hald/xorg startup race.  With this patch it should be safe for hald to start even after the Xserver.

Obtained from:	xorg-devel
212fd061b1
Jung-uk Kim (jkim) · 1.5.3_4,1
- Replace open(2)/close(2) pairs with stat(2).  Closing mouse device has a side effect of changing current operation level and sysmouse(4) lets you open /dev/sysmouse multiple times unlike other mouse drivers. - Check if /dev/mouse is linked to /dev/psm0 or /dev/ums0. - Simplify the patches a little while I am here.
68bcf49d36