Hi,

when fixing Vcs fields in libjgroups-java I realised that the Debian packaged
version is lagging behind several major upstream versions.  It has an open
CVE-2016-2141 and the according bug is unanswered by the maintainers of the
package.  The issue is fixed in upstream version 4.0 while the latest version
at the time of reporting this bug is 5.0.0.

Kind regards
    Andreas.