Package: exif Severity: grave Tags: security CVE-2012-2845 (please see #681454 for the initial report) needs to be fixed in exif rather than libexif. This doesn't warrant a DSA, but you could still fix it through a stable point update. Cheers, Moritz