A backport is a change taken from a newer version of software and applied to an older version that is still supported. Linux distributions and vendors do this regularly for security fixes, so that customers who stay on a stable release can receive a fix without having to move to a newer version with other changes.
Backporting makes long-term support practical, because it fixes the problem while keeping the behavior of the older version largely the same. It is a common reason that a package's version number stays low even after a vulnerability is fixed.
That is also why version numbers alone can mislead. A scanner or a quick check that compares your version with the one where upstream fixed a flaw can wrongly report that you are vulnerable, and sometimes the opposite. The correct reference is the vendor's advisory, which lists the exact package build that contains the fix. A backport also depends on the vendor choosing to provide it for that version, and some old releases do not receive one.
To check your own system, find the vendor advisory for your release, compare the installed package version with the fixed one it lists, and look at the package changelog for the relevant identifier. Then confirm that the updated package is the one actually running.