- CVE-2019-9023: complete the heap-based buffer over-read fix in the mbstring regular expression functions for invalid multibyte data; the backport carried by Patch873/Patch875/Patch1011 was taken from the PHP-7.3.1 cumulative and was missing two of the upstream code changes. Add the php.net bug #77370 clamp to the regparse.c pattern-scanner macros (PINC/PFETCH, the oniguruma 4.7.1 equivalents of upstream's PFETCH/PINC_S/PFETCH_S) so a truncated multibyte sequence at the end of a pattern can no longer leave the cursor past the buffer end, plus the upstream reproducer ext/mbstring/tests/bug77370.phpt; and add the case-folding clamp from the bug #77381/#77382/#77385/#77394 commit to the five Unicode *_mbc_to_normalize() implementations in ext/mbstring/oniguruma/enc/ (utf8, utf16_be, utf16_le, utf32_be, utf32_le), which are oniguruma 4.7.1's equivalent of upstream's onigenc_unicode_mbc_case_fold(), so a case-insensitive mb_ereg()/mb_split() pattern ending in a truncated multibyte sequence no longer copies more bytes than the buffer holds - CVE-2019-9641: integer overflows in the EXIF extension on 32-bit builds leading to an uninitialized read (php.net bug #77509). Backport upstream commit 5e824a88d073d282c4f358f186cb87ddc284f83d: exif_process_IFD_in_TIFF() added the directory size, the IFD size and a constant 2 to the attacker-controlled directory offset before comparing the sums against the file size, so a crafted TIFF could wrap the sums, pass the checks and have php_ifd_get16u() read from the still-uninitialized section buffer. The additions are rewritten as subtractions from the file size, which cannot overflow, and num_entries is widened to size_t before being scaled by 12