Fix CVE-2016-9036 and CVE-2016-9037.
These vulnerabilities are embargoed, but Mitre will publish them in the next couple days.