FYI given a CVE or package name, you can view the state of a particular issue across all Debian versions using the Security Bug Tracker. For instance https://s

FYI given a CVE or package name, you can view the state of a particular issue across all Debian versions using the Security Bug Tracker. For instance https://security-tracker.debian.org/tracker/CVE-2019-13615 https://security-tracker.debian.org/tracker/CVE-2019-13615 In this case, this hasn't yet been updated with the info from the VLC team, I expect it'll be marked ignore or not-vulnerable once that happens. I don't know the real CVE for the libebml issue but it doesn't appear to be listed at https://security-tracker.debian.org/tracker/source-package/libebml https://security-tracker.debian.org/tracker/source-package/l... which means that the Debian security team aren't aware of it.