Hi I strongly suspect serna of embedding a number of Java libraries (already packaged in Debian), such as ant, fop and batik. I already fixed a bug (#638693) and mentioned this on #d-security as well. ~Niels