I have sent an e-mail aking what vulnerabilities are present in Lazarus. I don't remember anything in our bug tracker, so I find this rather odd. Maybe they just blindly included it. -- Felipe Monteiro de Carvalho