myoung pushed to xen (f27). "add some CVE references"