Saw this bug quite late. 15.2 is old. We have the fixed versions in 15.3 and newer. In any case AFAIK all CVEs were always backported.