fix for CVE-2013-4238