Control: severity -1 serious Rationale for making this serious. Moritz prepared an update targetting jessie-security, versioned 2.5.2-3+deb8u2 and a DSA will be released. Not fixing this issue in stretch would OTOH then mean a regression when updating to stretch.
I'm happy to prepare a corresponding NMU, will upload to a delayed queue and attach the debdiff here. Let me though know if I should cancel the upload, if you want to upload as maintainer. Regards Salvatore