Fix CVE-2016-9036 and CVE-2016-9037. These vulnerabilities are embargoed, but Mitre will publish them in the next couple days.