But if you look under the Security Advisory, the table column "Fixed Release Availability" shows that version 16.3.1 contains the fix.
Under the bug, it also shows that fixed versions are: 15.2(5.2.29i)E, 15.4(1)IA1.73, etc. If the other trains weren...