xorg-server - Debian Package Tracker

general

source: xorg-server (main)
version: 2:21.1.25-1
maintainer: Debian X Strike Force (archive) (DMD)
arch: all any
std-ver: 3.9.8
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2:1.20.11-1+deb11u13
o-o-sec: 2:1.20.11-1+deb11u18
oldstable: 2:21.1.7-3+deb12u12
old-sec: 2:21.1.7-3+deb12u13
stable: 2:21.1.16-1.3+deb13u3
stable-sec: 2:21.1.16-1.3+deb13u4
stable-p-u: 2:21.1.16-1.3+deb13u4
testing: 2:21.1.24-1
unstable: 2:21.1.25-1

versioned links

2:1.20.11-1+deb11u13: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:1.20.11-1+deb11u18: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.7-3+deb12u12: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.7-3+deb12u13: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.16-1.3+deb13u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.16-1.3+deb13u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.24-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2:21.1.25-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

xnest (1 bugs: 0, 1, 0, 0)
xorg-server-source
xserver-common (6 bugs: 0, 1, 5, 0)
xserver-xephyr (18 bugs: 0, 14, 4, 0)
xserver-xorg-core (243 bugs: 1, 206, 36, 0)
xserver-xorg-core-udeb
xserver-xorg-dev (3 bugs: 0, 2, 1, 0)
xserver-xorg-legacy (4 bugs: 0, 1, 3, 0)
xvfb (13 bugs: 1, 10, 2, 0)

action needed

lintian reports 8 errors and 22 warnings high

Lintian reports 8 errors and 22 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-06 Last update: 2026-10-08 00:01

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 3.9.8).

Created: 2017-07-07 Last update: 2026-10-07 18:20

12 security issues in trixie high

There are 12 open security issues in trixie.

11 important issues:

CVE-2026-88812:
CVE-2026-93515:
CVE-2026-93516:
CVE-2026-93517:
CVE-2026-93518:
CVE-2026-93519:
CVE-2026-93520:
CVE-2026-93521:
CVE-2026-93523:
CVE-2026-93524:
CVE-2026-93536:

1 issue left for the package maintainer to handle:

CVE-2023-5574: (postponed; to be fixed through a stable update) A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-08-09 Last update: 2026-10-07 18:19

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2023-5574: A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Created: 2023-10-25 Last update: 2026-10-07 18:19

12 security issues in forky high

There are 12 open security issues in forky.

12 important issues:

CVE-2023-5574: A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
CVE-2026-88812:
CVE-2026-93515:
CVE-2026-93516:
CVE-2026-93517:
CVE-2026-93518:
CVE-2026-93519:
CVE-2026-93520:
CVE-2026-93521:
CVE-2026-93523:
CVE-2026-93524:
CVE-2026-93536:

Created: 2025-08-09 Last update: 2026-10-07 18:19

14 security issues in bookworm high

There are 14 open security issues in bookworm.

13 important issues:

CVE-2026-55999: Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
CVE-2026-56000: Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.
CVE-2026-88812:
CVE-2026-93515:
CVE-2026-93516:
CVE-2026-93517:
CVE-2026-93518:
CVE-2026-93519:
CVE-2026-93520:
CVE-2026-93521:
CVE-2026-93523:
CVE-2026-93524:
CVE-2026-93536:

1 issue postponed or untriaged:

CVE-2023-5574: (postponed; to be fixed through a stable update) A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Created: 2023-10-25 Last update: 2026-10-07 18:19

3 security issues in bullseye high

There are 3 open security issues in bullseye.

2 important issues:

CVE-2026-55999: Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks.
CVE-2026-56000: Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.

1 issue postponed or untriaged:

CVE-2023-5574: (needs triaging) A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Created: 2026-06-02 Last update: 2026-08-13 06:00

41 bugs tagged patch in the BTS normal

The BTS contains patches fixing 41 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-12 03:30

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2025-11-04 Last update: 2026-10-12 02:02

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-10-06 Last update: 2026-10-06 16:33

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

xorg-server-source could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2026-10-12 02:02

testing migrations

excuses:
- Migration status for xorg-server (2:21.1.24-1 to 2:21.1.25-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating xorg-server would introduce bugs in testing: #1150321
- ∙ ∙ Autopkgtest for aevol/9.4.0-2: amd64: Pass, arm64: Pass, ppc64el: Pass, s390x: Test triggered (failure will be ignored)
- ∙ ∙ Autopkgtest for coyote/2022.04.12-3: amd64: Pass, arm64: Pass, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for deskflow/1.26.0+dfsg-5: amd64: Pass ♻, arm64: Pass ♻, armhf: Pass ♻, ppc64el: Pass ♻, s390x: Pass ♻ (reference ♻)
- ∙ ∙ Autopkgtest for dogtail2/2.1.0-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Test triggered, ppc64el: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for king/2.24+dfsg2-4: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: Failed (not a regression) ♻ (reference ♻), i386: Reference test triggered, but real test failed already ♻, ppc64el: No tests, superficial or marked flaky ♻, s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for kodi/2:21.3+dfsg-1.2: amd64: Pass ♻, arm64: Pass ♻, armhf: Pass ♻, i386: Pass ♻, ppc64el: Pass ♻, s390x: Pass ♻ (reference ♻)
- ∙ ∙ Autopkgtest for libreoffice/4:26.8.1.1-3: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Test triggered (failure will be ignored), i386: Test triggered (failure will be ignored), ppc64el: Failed (not a regression) ♻ (reference ♻), s390x: Pass
- ∙ ∙ Autopkgtest for nfoview/2.1-1: i386: Pass ♻
- ∙ ∙ Autopkgtest for openjdk-21/21.0.12.1+1-1: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Pass, i386: Pass, ppc64el: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for openjdk-25/25.0.5~7ea-1: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Pass, i386: Pass, ppc64el: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for openjdk-26/26.0.2.1+1-1: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Pass, i386: Pass, ppc64el: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for openjdk-27/27~34ea-1: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Pass, i386: Pass, ppc64el: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for openjdk-28/28~13ea-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Test triggered (failure will be ignored), s390x: Test triggered (failure will be ignored)
- ∙ ∙ Autopkgtest for pandas/2.3.3+dfsg-5: amd64: Pass, arm64: Regression ♻ (reference ♻), armhf: Failed (not a regression) ♻ (reference ♻), i386: Failed (not a regression) ♻ (reference ♻), ppc64el: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for scilab/2024.1.0+dfsg1-4: amd64: Pass, arm64: Pass, armhf: Failed (not a regression) ♻ (reference ♻), i386: Reference test triggered, but real test failed already ♻, ppc64el: Pass, s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for sfepy/2026.2-2: amd64: Pass, arm64: Pass, armhf: Failed (not a regression) ♻ (reference ♻), i386: Reference test triggered, but real test failed already ♻, ppc64el: Pass, s390x: Failed (not a regression) ♻ (reference ♻)
- ∙ ∙ Autopkgtest for silx/2.2.2-6: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Test triggered (failure will be ignored), s390x: Pass
- ∙ ∙ Autopkgtest for thunderbird/1:153.4.0esr-1: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Failed (not a regression) ♻ (reference ♻), i386: Pass, ppc64el: No tests, superficial or marked flaky ♻, s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Autopkgtest for ttkthemes/3.3.0-2: i386: Pass ♻
- ∙ ∙ Autopkgtest for xorg-server/2:21.1.25-1: amd64: No tests, superficial or marked flaky ♻, arm64: No tests, superficial or marked flaky ♻, armhf: No tests, superficial or marked flaky ♻, i386: No tests, superficial or marked flaky ♻, ppc64el: No tests, superficial or marked flaky ♻, s390x: No tests, superficial or marked flaky ♻ (reference ♻)
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Lintian check waiting for test results on riscv64 - info
- Additional info (not blocking):
- ∙ ∙ Updating xorg-server will fix bugs in testing: #1150214
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/x/xorg-server.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 5 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-10-07] Accepted xorg-server 2:21.1.25-1 (source) into unstable (Timo Aaltonen)
[2026-09-12] Accepted xorg-server 2:21.1.16-1.3+deb13u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-09-12] Accepted xorg-server 2:21.1.16-1.3+deb13u4 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-08-13] Accepted xorg-server 2:1.20.11-1+deb11u18 (source) into oldoldstable-security (Arnaud Rebillout)
[2026-08-13] Accepted xorg-server 2:21.1.7-3+deb12u13 (source) into oldstable-security (Arnaud Rebillout)
[2026-08-12] xorg-server 2:21.1.24-1 MIGRATED to testing (Debian testing watch)
[2026-08-05] Accepted xorg-server 2:21.1.24-1 (source) into unstable (Emilio Pozuelo Monfort)
[2026-07-04] Accepted xorg-server 2:21.1.16-1.3+deb13u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-06-27] Accepted xorg-server 2:21.1.16-1.3+deb13u3 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-06-16] xorg-server 2:21.1.23-1 MIGRATED to testing (Debian testing watch)
[2026-06-02] Accepted xorg-server 2:21.1.23-1 (source) into unstable (Timo Aaltonen)
[2026-05-02] Accepted xorg-server 2:21.1.7-3+deb12u12 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-04-30] Accepted xorg-server 2:21.1.16-1.3+deb13u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-04-30] xorg-server 2:21.1.22-1 MIGRATED to testing (Debian testing watch)
[2026-04-14] Accepted xorg-server 2:21.1.22-1 (source) into unstable (Timo Aaltonen)
[2025-11-30] xorg-server 2:21.1.21-1 MIGRATED to testing (Debian testing watch)
[2025-11-25] Accepted xorg-server 2:21.1.21-1 (source) into unstable (Timo Aaltonen)
[2025-11-04] xorg-server 2:21.1.20-1 MIGRATED to testing (Debian testing watch)
[2025-11-01] Accepted xorg-server 2:21.1.7-3+deb12u11 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-10-29] Accepted xorg-server 2:21.1.16-1.3+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-10-29] Accepted xorg-server 2:21.1.20-1 (source) into unstable (Emilio Pozuelo Monfort)
[2025-10-29] Accepted xorg-server 2:1.20.11-1+deb11u17 (source) into oldoldstable-security (Thorsten Alteholz)
[2025-10-29] Accepted xorg-server 2:21.1.7-3+deb12u11 (source) into oldstable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-10-29] Accepted xorg-server 2:21.1.16-1.3+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2025-09-10] xorg-server 2:21.1.18-2 MIGRATED to testing (Debian testing watch)
[2025-08-27] Accepted xorg-server 2:21.1.18-2 (source) into unstable (Timo Aaltonen)
[2025-06-30] xorg-server 2:21.1.16-1.3 MIGRATED to testing (Debian testing watch)
[2025-06-27] Accepted xorg-server 2:21.1.18-1 (source) into experimental (Timo Aaltonen)
[2025-06-25] Accepted xorg-server 2:1.20.11-1+deb11u16 (source) into oldstable-security (Emilio Pozuelo Monfort)
[2025-06-23] Accepted xorg-server 2:21.1.7-3+deb12u10 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)

bugs [bug history graph]

all: 311 317
RC: 2
I&N: 249 255
M&W: 60
F&P: 0
patch: 41

links

homepage
lintian (8, 22)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (99, -)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2:21.1.24-1ubuntu1
288 bugs (10 patches)
patches for 2:21.1.24-1ubuntu1