fix CVE-2014-2240 and CVE-2014-2241