According to the CVE descriptions, these bugs belongs to libutils. Since Android 5.1.1, libutils has been moved to src:android-platform-system-core (See <http://anonscm.debian.org/cgit/android-tools/android-platform-system-core.git>), so after the next upload (6.0.0_r24) I will reassign this bug to android-libutils or src:android-platform-system-core.
However this bug can't be closed yet. This bug refers to 3 CVEs, one of them (CVE-2015-6609) belongs to "libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01". Currently the latest version in Alioth is 6.0.0_r26 which is on 2015-09-24. Even the latest 6.0.1_r3 is on 2015-10-13 (See <https://android.googlesource.com/platform/system/core/+/android-6.0.1_r3>). Maybe Android 6.1 solves it. :)