Hello,
I made apt-get update && apt-get dist-upgrade and could see following messages:

....
Die folgenden Pakete werden aktualisiert (Upgrade):
bash ghostscript ghostscript-cups libcairo-gobject2 libcairo2 libgs9
libgs9-common libnspr4 libnss3 libx11-6 libx11-data libx11-xcb1 libxi6
libxtst6 tzdata tzdata-java
16 aktualisiert, 0 neu installiert, 0 zu entfernen und 0 nicht aktualisiert.
Es müssen 10,0 MB an Archiven heruntergeladen werden.
Nach dieser Operation werden 179 kB Plattenplatz zusätzlich benutzt.
Möchten Sie fortfahren [J/n]? J
Holen: 1 http://security.debian.org/ wheezy/updates/main bash amd64 4.2+dfsg-0.1+deb7u4 [1.499 kB]
Holen: 2 http://security.debian.org/ wheezy/updates/main bash amd64 4.2+dfsg-0.1+deb7u4 [1.499 kB]
Holen: 3 http://security.debian.org/ wheezy/updates/main libx11-data all 2:1.5.0-1+deb7u3 [189 kB]
Holen: 4 http://security.debian.org/ wheezy/updates/main libx11-6 amd64 2:1.5.0-1+deb7u3 [902 kB]
...

why is bash uploaded 2 times? do we have a security issue there?

CVE-2016-7543: https://security-tracker.debian.org/.../CVE-2016-7543

Since your using amd64, 4.2+dfsg-0.1+deb7u4 is the supported/available version for via both "oldstable/Wheezy" as the main (essential) version (same for i386, armel and armhf) ...and "old-sec/Wheezy-Security" (thanks to the LTS team).
old-sec is used as a separate distribution as it doesn't support everything, including all the less-used(and EOL) architectures.
Those are still stuck with 4.2+dfsg-0.1+deb7u3

https://tracker.debian.org/news/809239
https://tracker.debian.org/pkg/bash
https://packages.debian.org/wheezy/bash