- up to 3.6.22, fixes  CVE-2013-4408 and CVE-2012-6150