CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

x11-wm/fvwm3 1.1.5_6

F? Virtual Window Manager

Port info

Maintainer
nyan@FreeBSD.org
Packages
latest: 1.1.5_6
Upstream
up to date
Last update
to 1.1.5_6 · d81b7ba3c3
Quarterly
2026Q4: 1.1.5_6 · last MFH 60647eff54
WWW
https://www.fvwm.org/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install fvwm3
installs 1.1.5_6 from latest; from quarterly (2026Q4) 1.1.5_6
Port
# cd /usr/ports/x11-wm/fvwm3 && make install clean
# make -C /usr/ports/x11-wm/fvwm3 config  # change options first
Size
3.7 MiB download · 8.8 MiB installed
Depends on
converters/fribidi 1.0.17, converters/libiconv 1.18_1, devel/gettext-runtime 1.0_1, devel/libevent 2.1.13, graphics/png 1.6.59_1, lang/perl5.42 5.42.3, lang/python312 3.12.15, print/freetype2 2.14.3, x11-fonts/fontconfig 2.18.3,1, x11-fonts/libXft 2.3.9, x11-toolkits/libXt 1.3.1,1, x11/libICE 1.1.2,1, x11/libSM 1.2.6,1, x11/libX11 1.8.14,1, x11/libXcursor 1.2.3, x11/libXext 1.3.7,1, x11/libXfixes 6.0.2, x11/libXrandr 1.5.5, x11/libXrender 0.9.13, x11/libxkbcommon 1.13.2
License
GPLv2
Options
7 of 10 on in the package: FRIBIDI GO ICONV MANPAGES NLS PNG XCURSOR
Show the 3 options that are off
ICONS SVG XPM

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.1.5_61.1.5_5–
FreeBSD 151.1.5_61.1.5_5–
FreeBSD 141.1.5_61.1.5_51.1.5_6

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.1.5_61.1.5_5–
FreeBSD 141.1.5_61.1.5_51.1.5_6

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.1.5_6 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2006-59694.62006-11-17CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directo…
CVE-2003-13084.62003-12-31CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage re…

VuXML only (0)

Listed in VuXML, the packaged version 1.1.5_6 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
282779maintainer-feedback? x11-wm/fvwm3 remove x11-wm/nscdeOpen2025-10-15

Commits (68)

Dmitri Goutnik (dmgk) · 1.0.4_8
all: Bump PORTREVISION after lang/go{118,119} update
f05c98fffb
Stefan Eßer (se) · 1.0.4_7
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.0.4_7
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Dmitri Goutnik (dmgk) · 1.0.4_7
all: Bump PORTREVISION after Go update

Bump Go ports PORTREVISION after GO_DEFAULT and lang/go118 update.
4476f89764
Felix Palmen (zirias) · 1.0.4_6
maintainer: Update to FreeBSD address

Change all MAINTAINER entries with <felix@palmen-it.de> to
<zirias@FreeBSD.org>.

Approved by:		tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D36029
0ac86ecea3
Cy Schubert (cy) · 1.0.4_6
x11-wm/fvwm3: Avoid crash in FvwmIconMan

Add a patch working around the crash by initializing some struct member
to NULL that's otherwise used uninitialized and backporting some code
from upstream's main branch to correctly handle that case.

PR:		265291
MFH:		2022Q3
1b4b3e9ce1
Tobias C. Berner (tcberner) · 1.0.4_5
x11-wm: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Adam Weinberger
  *  Alejandro Pulver <alepulver@FreeBSD.org>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Alexey Dokuchaev <danfe@regency.nsu.ru>
  *  Andreas Kohn <andreas@syndrom23.de>
  *  Anton Tornqvist <antont@inbox.lv>
  *  Aragon Gouveia <aragon@phat.za.net>
  *  Babak Farrokhi <babak@farrokhi.net>
  *  Brett Taylor <brett@peloton.physics.montana.edu>
  *  Brian Handy <handy@physics.montana.edu>
  *  Bruce A. Mah <bmah@ca.sandia.gov>
  *  Dennis Herrmann <adox@mcx2.org>
  *  Dennis Herrmann <dhn@FreeBSD.org>
  *  Dima Sivachenko <dima@chg.ru>
  *  Dominik Rothert <dr@domix.de>
  *  Douglas Carmichael <dcarmich@mcs.com>
  *  Eric Anholt <anholt@FreeBSD.org>
  *  Felix Palmen <felix@palmen-it.de>
  *  Florent Thoumie <flz@xbsd.org>
  *  Garrett Rooney <rooneg@electricjellyfish.net>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Gergely Nagy <8@free.bsd.hu>
  *  Gustau Perez i Querol <gustau.perez@gmail.com>
  *  J Han <hjh@photino.com>
  *  Jakub Lach <jakub_lach@mailplus.pl>
  *  James Earl <jdearl@telus.net>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Jeroen Schot <schot@a-eskwadraat.nl>
  *  Jim Mock <jim@FreeBSD.org>
  *  Matt Lancereau <matt@rimasec.net>
  *  Matthieu Guegan <matt.guegan@free.fr>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Michael Ebert <ebert@informatik.unibw-muenchen.de>
  *  Michael Johnson <ahze@ahze.net>
  *  Neil Blakey-Milner
  *  Nikos Ntarmos <ntarmos@ceid.upatras.gr>
  *  Olivier Duchateau
  *  Patrick Seal <patseal@hyperhost.net>
  *  Pawel Worach <pawel.worach@gmail.com>
  *  Peter Pentchev <roam@FreeBSD.org>
  *  Robert Noland <rnoland@FreeBSD.org>
  *  Roman Bogorodskiy <bogorodskiy@inbox.ru>
  *  Rudolf Polzer <freebsd-dr@durchnull.de>
  *  Rusmir Dusko <nemysis@FreeBSD.org>
  *  Stefan Zehl <sec@42.org>
  *  Tommy Scheunemann <net@arrishq.org>
  *  V. Jahns <vj562001@yahoo.de>
  *  Will Andrews <andrews@technologist.com>
  *  William Grzybowski <wg@FreeBSD.org>
  *  William Grzybowski <william88@gmail.com>
  *  Yukihiro Nakai <Nakai@Mlab.t.u-tokyo.ac.jp>
  *  Yukihiro Nakai <nakai@FreeBSD.org>
  *  alepulver
  *  anders@hack.org
  *  asami
  *  chinsan
  *  gahr
  *  gpalmer
  *  hrkfrd@gmail.com
  *  jfitz@FreeBSD.org
  *  lab@fnurt.net
  *  peter
  *  spn
  *  torstenb
  *  trevor
  *  vanilla

With hat:	portmgr
f65f20b278
Cy Schubert (cy) · 1.0.4_5
Revert "x11/fvwm3: Fix FvwmIconMan module segfault"

The maintainer misunderstood the meaning of the maintainer-feedback
flag in bugzilla.

PR:		265291

This reverts commit 1d7c23d087f79fa348a421cc4129e613f7086402.
c112b84fd8
Cy Schubert (cy) · 1.0.4_4
x11/fvwm3: Fix FvwmIconMan module segfault

Initialize the offending field in the fscreen_scr_arg struct to NULL,
fixing the segfault.

PR:		265291
Submitted by:	Felix Palmen <felix@palmen-it.de> (Maintainer)
Reported by:	anubhav.x61+freebsd@gmail.com
Approved by:	Felix Palmen <felix@palmen-it.de> (Maintainer)
1d7c23d087
Dmitri Goutnik (dmgk) · 1.0.4_3
all: Bump PORTREVISION after lang/go{117,118} update
153cb65ac8
Dmitri Goutnik (dmgk) · 1.0.4_2
*/*: Bump port revisons after lang/go{117,118} update
309cdeccd8
Tobias Kortkamp (tobik) · 1.0.4_1
*: Fix up PORTREVISION

Mostly just typos and assigning PORTREVISION multiple times.

This commit doesn't fix up PORTREVISION between master-slave
ports where the master port often overwrites PORTREVISION from
the slaves which means the slaves don't actually get bumped.
These probably just need PORTREVISION?= but care must be taken
to not decrease the package versions of all the master-slave
packages and to actually bump PORTREVISION as intended. For the
record the currently visible broken master ports are:

databases/libgda5
emulators/virtualbox-ose
emulators/virtualbox-ose-legacy
graphics/atril
multimedia/mlt7
textproc/uim

But all master ports should be looked at here and get an explicit
PORTREVISION?= where it's currently missing to prevent this.

Reported by:	portscan
fa6c86d281
Guangyuan Yang (ygy) · 1.0.4_1
*/*: Bump PORTREVISION after lang/go 1.18 update
d690b5102f
Stefan Eßer (se) · 1.0.4
Fix CONFLICTS entries of multiple ports

There have been lots of missing CONFLICTS_INSTALL entries, either
because conflicting ports were added without updating existing ports,
due to name changes of generated packages, due to mis-understanding
the format and semantics of the conflicts entries, or just due to
typoes in package names.

This patch is the result of a comparison of all files contained in
the official packages with each other. This comparison was based on
packages built with default options and may therefore have missed
further conflicts with optionally installed files.

Where possible, version numbers in conflicts entries have been
generalized, some times taking advantage of the fact that a port
cannot conflict with itself (due to logic in bsd.port.mk that
supresses the pattern match result in that case).

A few ports that set the conflicts variables depending on complex
conditions (e.g. port options), have been left unmodified, despite
probably containing outdated package names.

These changes should only affect the installation of locally built
ports, not the package building with poudriere. They should give an
early indication of the install conflict in cases where currently
the pkg command aborts an installation when it detects that an
existing file would be overwritten,

Approved by:	portmgr (implicit)
bcaf25a8c8
Vanilla I. Shu (vanilla) · 1.0.4
x11-wm/fvwm3: update to 1.0.4.

ChangeLog: https://github.com/fvwmorg/fvwm3/blob/1.0.4/CHANGELOG.md

PR:		258716
Reported by:	maintainer
5895b52f8e
Bernhard Froehlich (decke) · 1.0.2
x11-wm/fvwm3: Add CPE information

Approved by:	portmgr (blanket)
1748e4223c
Mark Linimon (linimon) · 1.0.2
x11-wm/fvwm3: Add compiler:c11 to USES to fix build on GCC-based systems:

Colorset.h:57: error: redefinition of typedef 'colorset_t'
4c56dd3352
Cy Schubert (cy) · 1.0.2
New port: x11-wm/fvwm3: New FVWM window manager

FVWM is an old window manager based on twm. After a long pause FVWM
development appears to have been restarted. This new FVWM no longer
supports M4 however it does support GO. Unfortunately fetching
go:modules doesn't work and is disabled at the moment. The maintainer
intends to work on this and upstream it when it's finally working.

Submitted by:	Felix Palmen <felix@palmen-it.de>
Reviewed by:	cy
Differential Revision:	https://reviews.freebsd.org/D30159
d9ddaab20f