security fixes

- XSA-92 – CVE-2014-3124
- XSA-96 – CVE-2014-3967, CVE-2014-3968
- XSA-99 – none (yet) assigned