It got treated as security fix only after the article was published: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906585 https://bugs.debian.org/cgi-bin/b

It got treated as security fix only after the article was published: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906585 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906585 ..this means i386 and these sysadmins who apply only security updates were still affected at that time.