The following libvorbis updates has been released for Debian GNU/Linux 8 and 9:
DSA 4140-1: libvorbis security updateLibvorbis Updates for Debian 8 and 9
DSA 4141-1: libvorbisidec security update