2.8.5 is claimed to fix CVE-2016-{1897,1898}.
@vcunat removed 2.7 and 2.6. The global version of 2.6 was unused, and 2.7 -> 2.8 switch should be without problems by inspecting http://abi-laboratory.pro/tracker/timeline/ffmpeg/ (only ABI changes and symbol additions)