Merge upstream 1.6.17 (Fixes CVE-2011-1752, CVE-2011-1783, and CVE-2011-1921). I am omitting adding contrib/ files to the packaging branch which are normally removed by Debian for unclear licensing, though I am not actually constructing a DFSG-clean upstream tarball.