I'm still with lenny (now oldstable) but I was even told that not all
security flaws reached votatile, just some, depending of the nature of
the flaw...
And again, if this policy has recently changed is more than very welcome,
my clamav is also claiming for an update and oldstable is still supported.
* The update is urgent and not of a security nature. Security updates
will continue to be pushed through the security archive.