Hacker News Reader

Stretch is supposed to keep getting security fixes until June 2022 but this particular library doesn't have the fix backported yet: https://security-tracker.debian.org/tracker/CVE-2019-13615

Does anybody know why libebml wasn't fixed yet in Stretch?

There was never a CVE for it (until the CVE for VLC) so I'm guessing the Debian Security Team never found out about it.