The bug is known and still open:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=362246
If you have an "old" installation then you will still have the
SecurityPolicy file which came from the xserver-common package. This
package is currently only in Sarge. Etch and Sid systems had this
package removed when the transition to Xorg happened; the SecurityPolicy
file was left in place because it is marked as a configuration file.
Etch systems which were newly installed after the Xorg transition do not
have the file and you cannot install xserver-common anymore on Etch
without causing trouble.