The plan to not release pspp-convert and friends did not stop the fuzzerfriends to file CVEs against libpspp-core. Today we have six new CVE bugs filed in debian. 5 are for pspp-convert or pspp-output and one is for pspp.
https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=pspp
