CVE-2018-14665 for 1.20 branch (1.20.3)

Merged Adam Jackson requested to merge ajax/xserver:server-1.20-branch into server-1.20-branch

Merge request reports