- up to 1.16; fixes CVE-2014-4877