Control: fixed -1 2.4.7.1+dfsg-1 According to https://github.com/OpenImageIO/oiio/blob/dev-2.4/CHANGES.md, all the open CVEs are fixed with upstream version 2.4.6 or earlier.
Please note that the CHANGES.md docuemnt was edited after 2.4.7.1 to contain more CVE IDs.