Core:
Fixed bug #68044 (Integer overflow in unserialize() (32-bits only)). (CVE-2014-3669)

cURL:
Fixed bug #68089 (NULL byte injection - cURL lib).

Exif:
Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)

XMLRPC:
Fixed bug #68027 (Global buffer overflow in mkgmtime() function). (CVE-2014-3668)