i don't think CVEs were a thing at the start of the GNU rewrite