fix linking & reapply CVE-2009-3994

...