In CVE pages like CVE-2017-5754 I see per major version two releases one of them marked with "(security)". What does this mean? In the example the kernel fix Stretch (security) was released earlier. How do I add the repository to have my server fixed earlier with this release? Or is this unwise because it is may be unstable or untested with security priority in mind? Is there a Debian page that explains it?
“(security)” means the package is available in the security repositories, not in the main repositories. To get security updates for Wheezy, ensure you have
deb http://security.debian.org wheezy/updates main
in your repositories (typically in
/etc/apt/sources.list). Updates made available in security repositories are ready for public consumption — you should upgrade as soon as you see one. However you should only use security repositories corresponding to the release you actually use — so only use the Wheezy repository above if you’re running Wheezy.
Packages are normally copied from the security repositories to the main repositories when a point release is made.
You’ll find relevant information on the Debian security page.