Port CVE patches from php-5.3.3-40.el6_6