If there's a severe security issue, Debian will quickly push an update containing a backported version of the fix, assuming you have the debian-security reposit

If there's a severe security issue, Debian will quickly push an update containing a backported version of the fix, assuming you have the debian-security repository enabled (which you should). Just because the version number on the package is old doesn't mean it's insecure. https://www.debian.org/security/faq#oldversion https://www.debian.org/security/faq#oldversion