apply CVE patch for security weakness