we need get the branch from tag instead of git branch, because we
generate releasecandidates and the first stable release from git master
and only do the git branch after the release is done.

XSA-204		CVE-2016-10013	x86: Mishandling of SYSCALL singlestep during emulation
XSA-203		CVE-2016-10025	x86: missing NULL pointer check in VMFUNC emulation
XSA-202		CVE-2016-10024	x86 PV guests may be able to mask interrupts

fixes #6570

the ext3 is provided by ext4 module nowdays.

fixes #6167

fixes #6529