- up to 1.0.7; fixes CVE-2013-1988