- up to 1.0.5; fixes CVE-2013-1996