up to 5.4.18; fixes CVE-2013-4113 and CVE-2013-4248