A DSA is needed for the following source packages in old/stable. The specific
CVE IDs do not need to be listed, they can be gathered in an up-to-date manner from
https://security-tracker.debian.org/tracker/source-package/SOURCEPACKAGE
when working on an update.

Some packages are not tracked here:
- Linux kernel (tracking in kernel-sec repo)
- Embargoed issues continue to be tracked in separate file.

To pick an issue, simply add your uid behind it.

If needed, specify the release by adding a slash after the name of the source package.

--
389-ds-base (fw)
  Thorsten Alteholz proposed an update
--
ansible
  Maintainer is preparing updates
--
faad2
  not yet fixed upstream
--
glusterfs
--
graphicsmagick
  waiting for proper fix for CVE-2018-20185
--
libidn
  santiago proposed debdiffs for jessie and stretch
--
libspring-java
--
libvncserver (jmm)
--
linux
  Wait until more issues have piled up
--
mbedtls
--
mercurial
--
openjpeg2 (luciano)
--
passenger
--
simplesamlphp
--
smarty3
--
sssd
  Maintainer prepared an update and proposed debdiff, acked for upload, but update needs further testing before release.
--
vlc (jmm)
  Maintainer proposed to wait for 3.0.5 and release a DSA based on 3.0.5
--
xen
--