Fixes CVE-2018-13785 and CVE-2018-14048. Added PKG_CPE_ID for proper CVE tracking. Signed-off-by: Rosen Penev <rosenp@gmail.com>