- up to 1.1.3; fixes CVE-2013-1992