Patch for php-7.0.3

NEWS

@@ -43,6 +43,10 @@ PHP                                                                        NEWS
 - mbstring:
   . Fixed bug #71397 (mb_send_mail segmentation fault). (Andrea, Yasuo)
 
+- Core:
+  . Fixed bug #73807 (Performance problem with processing large post request).
+    (Nikita)
+
 - OpenSSL:
   . Fixed bug #71475 (openssl_seal() uninitialized memory usage). (Stas)
 
@@ -128,6 +132,9 @@ PHP                                                                        NEWS
   . Implemented FR #55651 (Option to ignore the returned FTP PASV address).
     (abrender at elitehosts dot com)
 
+- Intl:
+  . Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message). (libnex)
+
 - Mbstring:
   . Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV,
     Segmentation fault). (Laruence)
@@ -656,6 +663,10 @@ PHP                                                                        NEWS
   . Corrected oci8 hash destructors to prevent segfaults, and a few other fixes.
     (Cameron Porter)
 
+- IMAP:
+  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
+    mailbox parameter). (Stas)
+
 - ODBC:
   . Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined
     columns). (cmb)

UPGRADING

@@ -15,6 +15,13 @@
 13. Other Changes
 
 
+- IMAP:
+  Starting with 7.2.13, rsh/ssh logins are disabled by default. Use
+  imap.enable_insecure_rsh if you want to enable them. Note that the IMAP
+  library does not filter mailbox names before passing them to rsh/ssh
+  command, thus passing untrusted data to this function with rsh/ssh enabled
+  is insecure.
+
 ========================================
 1. Backward Incompatible Changes
 ========================================