We patched the other issues (CVEs mentioned in the release notes) in bug 754681, but this wasn't in our snapshot:
"some more denial of service (compute time or stack exhaustion) counter-measures
added that avoid minutes of decoding time with malformed files found
(In reply to John Helmert III from comment #1)
> Please cleanup.
(In reply to Michał Górny from comment #2)
> (In reply to John Helmert III from comment #1)
> > Please cleanup.