My personal experience is that using the Debian packages for anything is always questionable. I use Debian as my OS, but everything from gcc up is built into /usr/local.
We use the packaged versions where they work well enough, but custom builds for quite a few other things.
However, I would hope Debian would have included those patches.
As far as I can tell from the changelog, they have got at least three of them, they probably have the Java stuff (not using Java with it anyway) but they may have missed the one relating to the btree bug. Could that have caused a problem? Could it have fooled the consumers into deleting and re-creating all their records? Because I *think* that's what happened.
Lesley W