- up to 1.5.1; fixes CVE-2014-8602