[Users] Last security patch

[David Touitou]

> Thanks David; it wasn't clear to me that the author was saying in the last
> section that all these exposures had been fixed.

I might be wrong.
But considereing there are attributed CVE numbers and patches, it looks to me as standard procedure:
 . vulnerability discovered and embargoed
 . software company contacted
 . software company acknowledged the vulnerability
 . software company issued patch
 . a couple days later, vulnerability went public with explanations

David