myoung pushed to xen (master). "add some CVE references"