Upstream claimed[1] that CVE-2018-10393 is a duplicate of CVE-2017-14160
but added follow up patch[2]. We applied this patch in 1.3.6-r2.

[1]: https://gitlab.xiph.org/xiph/vorbis/-/issues/2334#note_52200
[2]: https://gitlab.xiph.org/xiph/vorbis/-/commit/a9eb99a5bd6f2d7da02d6cd13a428baf3a1bf48c

ref #11914