Comment # 3 on bug 1203018 from Johannes Segitz

I'll wait with publishing this CVE to be able to include the fixed package
versions in the description