Merged CVE fix backports by idunham.