Log Message:
patches for CVE-2017-7186 from upstream
there are commits upstream that may fix the remaining 3 known vulnerabilities,
but they are not in the "bleeding obvious" category