Another case of `why isn't this in testing yet'

[Peter S Galbraith <GalbraithP@dfo-mpo.gc.ca>]

I wish I understood this.  jazip-0.33-2 fixes a root exploit, so
it would be nice to get it into testing:

jazip 0.33-2 (currently 0.32-2) (extra) (high) 
         Maintainer: Peter S Galbraith <psg@debian.org> 
         jazip uploaded 16 days ago, out of date by 14 days! 
         valid candidate (will be installed unless it's dependent
          upon other buggy pkgs) 

Depends: libc6 (>= 2.2.1), libforms0.89, xlibs (>= 4.0.1-11)

 testing has: libc6         2.2.2-1
              libforms0.89  0.89-9 
              xlibs         4.0.2-7

So what can be keeping the package from getting installed?

Thanks,
Peter