security issue patched in lcms