In reply to Chris.

Only one of the vulnerabilities is limited to 4.2. The other goes back even further, hence Jeff's comment. I've seen updates released for versions as old as 3.7.