You are confused. You say that you didn't get any updates on Debian, yet you say that it looks like Debian may have applied something. As I explained above, th

You are confused. You say that you didn't get any updates on Debian, yet you say that it looks like Debian may have applied something. As I explained above, the patch for CVE-7169 by Florian Weimer made bash invulnerable to code injection by arbitrary environment variables. The underlying bugs CVE-6277 and CVE-6278 therefore have no known attack vector from outside bash, though they can still be triggered from a shell script or the command line if they are not patched. Theoretically, they could become part of a different attack, so it's wise to patch them, but there's no hurry, since as long as you or Debian have applied the abovementioned patch for CVE-7169, it means there's currently no publicly-known exploit. Also, Debian uses dash as its version of sh, so the problem can only occur if bash is called explicitly.