Additional Security issues

[Mark Doliner]

Thanks for sending these out!  I'll try to take a look soon.

These aren't public knowledge yet, right?  I think I'd still prefer to
do a release within the next week or so with the two MXit fixes and
with updated CA certs, and then do another release later and include
fixes for:
- these issues
- yahoo failure to validate utf8
- possibly fix the pango MS Windows crash with some characters