xorg-server - Debian Package Tracker

general

source: xorg-server (main)
version: 2:21.1.16-1.2
maintainer: Debian X Strike Force (archive) (DMD)
arch: all any
std-ver: 3.9.8
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:1.20.4-1+deb10u4
o-o-sec: 2:1.20.4-1+deb10u14
oldstable: 2:1.20.11-1+deb11u13
old-sec: 2:1.20.11-1+deb11u15
stable: 2:21.1.7-3+deb12u9
stable-sec: 2:21.1.7-3+deb12u9
testing: 2:21.1.16-1.1
unstable: 2:21.1.16-1.2

versioned links

2:1.20.4-1+deb10u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:1.20.4-1+deb10u14: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:1.20.11-1+deb11u13: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:1.20.11-1+deb11u15: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.7-3+deb12u9: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.16-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.16-1.2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

xnest (1 bugs: 0, 1, 0, 0)
xorg-server-source (2 bugs: 2, 0, 0, 0)
xserver-common (5 bugs: 0, 1, 4, 0)
xserver-xephyr (19 bugs: 0, 15, 4, 0)
xserver-xorg-core (237 bugs: 0, 201, 36, 0)
xserver-xorg-core-udeb
xserver-xorg-dev (3 bugs: 0, 2, 1, 0)
xserver-xorg-legacy (4 bugs: 0, 1, 3, 0)
xvfb (13 bugs: 2, 9, 2, 0)

action needed

A new upstream version is available: 21.1.17 high

A new upstream version 21.1.17 is available, you should consider packaging it.

Created: 2025-06-17 Last update: 2025-06-20 06:31

7 security issues in trixie high

There are 7 open security issues in trixie.

6 important issues:

CVE-2025-49175: A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
CVE-2025-49176: A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
CVE-2025-49177: A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.
CVE-2025-49178: A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
CVE-2025-49179: A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
CVE-2025-49180: A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

1 issue postponed or untriaged:

CVE-2023-5574: (postponed; to be fixed through a stable update) A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Created: 2025-06-17 Last update: 2025-06-20 05:27

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2023-5574: A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
CVE-2025-49176: A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.

Created: 2023-10-25 Last update: 2025-06-20 05:27

8 security issues in bullseye high

There are 8 open security issues in bullseye.

6 important issues:

CVE-2025-49175: A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
CVE-2025-49176: A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
CVE-2025-49177: A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.
CVE-2025-49178: A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
CVE-2025-49179: A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
CVE-2025-49180: A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

2 issues postponed or untriaged:

CVE-2023-5574: (needs triaging) A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
CVE-2022-49737: (postponed; to be fixed through a stable update) In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

Created: 2025-06-17 Last update: 2025-06-20 05:27

8 security issues in bookworm high

There are 8 open security issues in bookworm.

6 important issues:

CVE-2025-49175: A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
CVE-2025-49176: A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
CVE-2025-49177: A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.
CVE-2025-49178: A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
CVE-2025-49179: A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
CVE-2025-49180: A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

2 issues left for the package maintainer to handle:

CVE-2023-5574: (postponed; to be fixed through a stable update) A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
CVE-2022-49737: (postponed; to be fixed through a stable update) In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-10-25 Last update: 2025-06-20 05:27

lintian reports 10 errors and 12 warnings high

Lintian reports 10 errors and 12 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-06-17 Last update: 2025-06-18 08:34

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 3.9.8).

Created: 2017-07-07 Last update: 2025-06-17 18:57

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2025-03-27 Last update: 2025-06-17 16:32

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2025-06-19 Last update: 2025-06-20 10:35

40 bugs tagged patch in the BTS normal

The BTS contains patches fixing 40 bugs (41 if counting merged bugs), consider including or untagging them.

Created: 2025-01-06 Last update: 2025-06-20 10:32

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

xorg-server-source could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2025-06-20 09:53

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2017-10-26 Last update: 2017-10-26 07:23

testing migrations

excuses:
- Migration status for xorg-server (2:21.1.16-1.1 to 2:21.1.16-1.2): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating xorg-server would introduce bugs in testing: #1108073
- ∙ ∙ autopkgtest for openjdk-21/21.0.7+6-1: amd64: Pass, arm64: Test in progress, armel: Test in progress (will not be considered a regression), armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test in progress (will not be considered a regression), s390x: Pass
- ∙ ∙ autopkgtest for openjdk-25/25~22ea-1: amd64: Pass, arm64: Test in progress, armel: Test in progress (will not be considered a regression), armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test in progress (will not be considered a regression), s390x: Pass
- ∙ ∙ autopkgtest for python-qtconsole/5.6.1-4: amd64: Pass, arm64: Pass, armel: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Test in progress, s390x: Pass
- ∙ ∙ autopkgtest for silx/2.2.1+dfsg-3: amd64: Pass, arm64: Pass, armel: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: Pass, s390x: Regression or new test ♻ (reference ♻)
- ∙ ∙ autopkgtest for xorg-server/2:21.1.16-1.2: amd64: No tests, superficial or marked flaky ♻ (reference ♻), arm64: No tests, superficial or marked flaky ♻ (reference ♻), armel: No tests, superficial or marked flaky ♻ (reference ♻), armhf: No tests, superficial or marked flaky ♻ (reference ♻), i386: No tests, superficial or marked flaky ♻ (reference ♻), ppc64el: No tests, superficial or marked flaky ♻ (reference ♻), riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/x/xorg-server.html
- ∙ ∙ Reproducible on amd64 - info ♻
- ∙ ∙ Reproducible on arm64 - info ♻
- ∙ ∙ Waiting for reproducibility test results on armhf - info ♻
- ∙ ∙ Overriding age needed from 2 days to 2 by sramacher
- ∙ ∙ 3 days old (needed 2 days)
- ∙ ∙ Ignoring block request by freeze, due to unblock request by sramacher
- Not considered

news

[rss feed]

[2025-06-17] Accepted xorg-server 2:21.1.16-1.2 (source) into unstable (Salvatore Bonaccorso)
[2025-05-14] xorg-server 2:21.1.16-1.1 MIGRATED to testing (Debian testing watch)
[2025-05-07] Accepted xorg-server 2:21.1.16-1.1 (source) into unstable (Salvatore Bonaccorso)
[2025-03-11] xorg-server 2:21.1.16-1 MIGRATED to testing (Debian testing watch)
[2025-03-01] Accepted xorg-server 2:21.1.7-3+deb12u9 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-02-28] Accepted xorg-server 2:21.1.7-3+deb12u9 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-02-28] Accepted xorg-server 2:1.20.11-1+deb11u15 (source) into oldstable-security (Thorsten Alteholz)
[2025-02-26] Accepted xorg-server 2:21.1.16-1 (source) into unstable (Emilio Pozuelo Monfort)
[2025-02-19] xorg-server 2:21.1.15-3 MIGRATED to testing (Debian testing watch)
[2025-02-13] Accepted xorg-server 2:21.1.15-3 (source) into unstable (Emilio Pozuelo Monfort)
[2024-12-26] xorg-server 2:21.1.15-2 MIGRATED to testing (Debian testing watch)
[2024-12-20] Accepted xorg-server 2:21.1.15-2 (source) into unstable (Timo Aaltonen)
[2024-12-20] Accepted xorg-server 2:21.1.15-1 (source) into unstable (Timo Aaltonen)
[2024-11-22] xorg-server 2:21.1.14-2 MIGRATED to testing (Debian testing watch)
[2024-11-12] Accepted xorg-server 2:21.1.14-2 (source) into unstable (Timo Aaltonen)
[2024-11-01] xorg-server 2:21.1.14-1 MIGRATED to testing (Debian testing watch)
[2024-10-30] Accepted xorg-server 2:21.1.7-3+deb12u8 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-10-29] Accepted xorg-server 2:21.1.14-1 (source) into unstable (Julien Cristau)
[2024-10-29] Accepted xorg-server 2:21.1.13-3.1 (source) into unstable (Salvatore Bonaccorso)
[2024-10-29] Accepted xorg-server 2:21.1.7-3+deb12u8 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-10-29] Accepted xorg-server 2:1.20.11-1+deb11u14 (source) into oldstable-security (Thorsten Alteholz)
[2024-10-23] Accepted xorg-server 2:21.1.13-3 (source) into unstable (Emilio Pozuelo Monfort)
[2024-09-03] xorg-server 2:21.1.13-2 MIGRATED to testing (Debian testing watch)
[2024-08-29] Accepted xorg-server 2:21.1.13-2 (source) into unstable (Timo Aaltonen)
[2024-08-29] Accepted xorg-server 2:21.1.13-1 (source) into unstable (Timo Aaltonen)
[2024-04-20] Accepted xorg-server 2:1.20.11-1+deb11u13 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Julien Cristau)
[2024-04-20] Accepted xorg-server 2:1.20.11-1+deb11u12 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Julien Cristau)
[2024-04-19] xorg-server 2:21.1.12-1 MIGRATED to testing (Debian testing watch)
[2024-04-15] Accepted xorg-server 2:21.1.7-3+deb12u7 (source) into proposed-updates (Debian FTP Masters) (signed by: Julien Cristau)
[2024-04-15] Accepted xorg-server 2:21.1.7-3+deb12u6 (source) into proposed-updates (Debian FTP Masters) (signed by: Julien Cristau)

bugs [bug history graph]

all: 308 316
RC: 2 4
I&N: 245 251
M&W: 59
F&P: 2
patch: 40 41

links

homepage
lintian (10, 12)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
l10n (99, -)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:21.1.16-1ubuntu1
285 bugs (10 patches)
patches for 2:21.1.16-1ubuntu1