These CVE fixes come from upstream master branch and no
new version released, so backport rather than upgrade.
(From OE-Core rev: bd8d2c25f595e30a3fdcad8a2409913bb8af7c5c)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>