- up to 0.8.11, fixes CVE-2009-5023, CVE-2013-2178
- applied upstream