update cve-3.3 and 3.4