Security update for CVE-2016-4414 (denial of service).
Fixes changes after #14080 where the updated hash was missing. Put the source in a common file so there is only one place to update.