Hello,

This patch (applied to core-updates) fixes the two CVEs disclosed recently.

I am currently testing the patch. I think the patch works but it is
still building right now.