I think this requires both a desktop environment to be installed, and local access to the server to be exploited (in most cases: X server is configured not to a

I think this requires both a desktop environment to be installed, and local access to the server to be exploited (in most cases: X server is configured not to allow remote access by default in Ubuntu afaik). The core vulnerability is in gdm which means that you have to have that running as a system service. Though on second thought, if one can easily set up X forwarding as an unprivileged user, it might still be trivially exploitable. Anyway, the announcement means that Ubuntu has fixes in affected (desktop) packages. If they are installed on a server, they'd be fixed with next apt update/upgrade too: they use the same package repositories.