- up to 2.4.7; fixed CVE-2014-3158