pipewire - Debian Package Tracker

general

source: pipewire (main)
version: 1.6.9-2
maintainer: Utopia Maintenance Team (archive) (DMD)
uploaders: Jeremy Bicha [DMD] – Dylan Aïssi [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.3.19-4
oldstable: 0.3.65-3+deb12u1
old-bpo: 1.4.2-1~bpo12+1
stable: 1.4.2-1
stable-bpo: 1.6.9-2~bpo13+1
testing: 1.6.9-2
unstable: 1.6.9-2

versioned links

0.3.19-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.3.65-3+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.2-1~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.9-1~bpo13+2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6.9-2~bpo13+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6.9-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gstreamer1.0-pipewire (1 bugs: 0, 1, 0, 0)
libpipewire-0.3-0t64
libpipewire-0.3-common
libpipewire-0.3-dev
libpipewire-0.3-modules
libpipewire-0.3-modules-x11 (1 bugs: 0, 1, 0, 0)
libspa-0.2-bluetooth (2 bugs: 0, 2, 0, 0)
libspa-0.2-dev
libspa-0.2-jack
libspa-0.2-libcamera
libspa-0.2-modules
pipewire (42 bugs: 0, 37, 5, 0)
pipewire-alsa (1 bugs: 0, 1, 0, 0)
pipewire-audio (3 bugs: 0, 3, 0, 0)
pipewire-audio-client-libraries
pipewire-bin (2 bugs: 0, 2, 0, 0)
pipewire-doc
pipewire-jack (3 bugs: 0, 2, 1, 0)
pipewire-libcamera
pipewire-pulse (13 bugs: 0, 10, 3, 0)
pipewire-system-services (3 bugs: 0, 3, 0, 0)
pipewire-tests
pipewire-v4l2

action needed

3 security issues in bookworm high

There are 3 open security issues in bookworm.

1 important issue:

CVE-2026-5674: A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

2 issues postponed or untriaged:

CVE-2026-14324: (postponed; to be fixed through a stable update) RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.
CVE-2026-14330: (postponed; to be fixed through a stable update) Multiple unbounded alloca() calls in the PulseAudio protocol server.

Created: 2026-07-02 Last update: 2026-10-01 15:01

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-5674: A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.

Created: 2026-07-18 Last update: 2026-08-09 22:31

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-15 07:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.6.9-3, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit e556cbb0bf2564bfbf2688373ee8a66b4fce0fc5
Author: Dylan Aïssi <dylan.aissi@collabora.com>
Date:   Thu Oct 1 14:34:36 2026 +0200

    Update debian/changelog
    
    Signed-off-by: Dylan Aïssi <dylan.aissi@collabora.com>

commit eb69ae0c69da4b208767a7f3d8dd441418339926
Author: Dylan Aïssi <dylan.aissi@collabora.com>
Date:   Tue May 19 18:30:45 2026 +0200

    Disable onnxruntime on i386
    
    Signed-off-by: Dylan Aïssi <dylan.aissi@collabora.com>

commit a924d7ece70afaf07022bab4dfc4dbae07569906
Author: Dylan Aïssi <dylan.aissi@collabora.com>
Date:   Tue May 19 18:35:43 2026 +0200

    Move some modules into optional packages (Closes: #1130264)
    
    This will reduce the size of the dependency chain which is starting to get big.
    For instance, enabling the onnxruntime support adds 50MB+ of additional dependencies.
    
    Signed-off-by: default avatarDylan Aïssi <dylan.aissi@collabora.com>

Created: 2026-10-12 Last update: 2026-10-12 07:33

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-09-18 Last update: 2026-09-18 04:01

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-5674: (needs triaging) A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system.
CVE-2026-14324: (needs triaging) RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return.

You can find information about how to handle these issues in the security team's documentation.

1 issue that should be fixed with the next stable update:

CVE-2026-14330: Multiple unbounded alloca() calls in the PulseAudio protocol server.

Created: 2026-07-02 Last update: 2026-10-01 15:01

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 1.6.9-2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-09-21 Last update: 2026-09-21 22:31

testing migrations

This package will soon be part of the auto-onnxruntime transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-09-28] Accepted pipewire 1.6.9-2~bpo13+1 (source) into stable-backports (Agathe Porte)
[2026-09-25] pipewire 1.6.9-2 MIGRATED to testing (Debian testing watch)
[2026-09-21] Accepted pipewire 1.6.9-2 (source) into unstable (Dylan Aïssi)
[2026-09-20] pipewire 1.6.9-1 MIGRATED to testing (Debian testing watch)
[2026-09-17] Accepted pipewire 1.6.9-1 (source) into unstable (Dylan Aïssi)
[2026-07-11] pipewire 1.6.8-1 MIGRATED to testing (Debian testing watch)
[2026-07-09] Accepted pipewire 1.6.8-1 (source) into unstable (Dylan Aïssi)
[2026-06-26] pipewire 1.6.7-1 MIGRATED to testing (Debian testing watch)
[2026-06-23] Accepted pipewire 1.6.7-1 (source) into unstable (Dylan Aïssi)
[2026-05-30] pipewire 1.6.6-1 MIGRATED to testing (Debian testing watch)
[2026-05-27] Accepted pipewire 1.6.6-1 (source) into unstable (Dylan Aïssi)
[2026-05-25] pipewire 1.6.5-1 MIGRATED to testing (Debian testing watch)
[2026-05-19] Accepted pipewire 1.4.9-1~bpo13+2 (source) into stable-backports (Loïc Minier) (signed by: Dylan Aïssi)
[2026-05-13] Accepted pipewire 1.6.5-1 (source) into unstable (Dylan Aïssi)
[2026-04-25] pipewire 1.6.4-1 MIGRATED to testing (Debian testing watch)
[2026-04-23] Accepted pipewire 1.6.4-1 (source) into unstable (Dylan Aïssi)
[2026-04-13] pipewire 1.6.3-1 MIGRATED to testing (Debian testing watch)
[2026-04-09] Accepted pipewire 1.6.3-1 (source) into unstable (Dylan Aïssi)
[2026-03-20] pipewire 1.6.2-1 MIGRATED to testing (Debian testing watch)
[2026-03-17] Accepted pipewire 1.6.2-1 (source) into unstable (Dylan Aïssi)
[2026-03-09] Accepted pipewire 1.6.1-1 (source) into unstable (Dylan Aïssi)
[2026-02-19] Accepted pipewire 1.6.0-1 (source) into experimental (Dylan Aïssi)
[2026-01-21] pipewire 1.4.10-1 MIGRATED to testing (Debian testing watch)
[2026-01-19] Accepted pipewire 1.5.85-1 (source) into experimental (Dylan Aïssi)
[2026-01-19] Accepted pipewire 1.4.10-1 (source) into unstable (Dylan Aïssi)
[2025-12-01] Accepted pipewire 1.5.84-1 (source) into experimental (Dylan Aïssi)
[2025-11-06] Accepted pipewire 1.5.83-1 (source) into experimental (Dylan Aïssi)
[2025-10-16] Accepted pipewire 1.5.81-1 (source) into experimental (Dylan Aïssi)
[2025-10-14] Accepted pipewire 1.4.9-1~bpo13+1 (source) into stable-backports (Dylan Aïssi)
[2025-10-12] pipewire 1.4.9-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 75
RC: 0
I&N: 64
M&W: 10
F&P: 1
patch: 3

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 76)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.6.8-1ubuntu4
59 bugs (1 patch)
patches for 1.6.8-1ubuntu4