Hello @dbry,

I am incredibly thankful for your help for CVE-2020-35738 wrt 4.70.0. As mentioned there already, I am fixing all the pending security vulnerabilities for Debian ELTS which is at version 4.70.0.

I have carefully reviewed and backported all that I could find. Here's my take on this:

CVE ID	Fixing Commit	Backported?
CVE-2016-10169	4bc05fc	Only a part of it, i.e., the hunk in src/read_words.c of the fixing commit. The initial hunk wasn't a part of the older version.
CVE-2018-19840	070ef6f	Backported completely.
CVE-2018-19841	bba5389	My assessment was the v4.70.0 was not affected as I couldn't find the vulnerable code. Let me know if this isn't the case.
CVE-2019-1010315	4c0faba	Vulnerable code is not present; DFF support was introduced later.
CVE-2019-1010317	f68a955	Vulnerable code is not present; CAF support was introduced later.
CVE-2019-1010319	33a0025	It looks like CLEAR (WaveHeader); was already in v4.70.0. So I guess this is not affecting that version. Right?
CVE-2019-11498	bc6cba3	Vulnerable code is not present; DFF support was introduced later.
CVE-2020-35738	63f3ec7 and 89df160	Backported already with your help! ❤️

If you have some time (and can take a quick look at this), could you help me verify that this is indeed correct?
Based on this, I'll also backport to v5.0.0, where some of these are already fixed.