fixes for CVE-2014-6271, added CVE-2014-6278