CVE-2013-4545: Setting only CURLOPT_SSL_VERIFYHOST without 
CURLOPT_SSL_VERIFYPEER set should still verify that the host 
name fields in the server certificate is fine or return failure.

Bug: http://curl.haxx.se/mail/lib-2013-10/0002.html
Reported-by: Ishan SinghLevett

Relevant upstream patch at:
https://github.com/bagder/curl/commit/3c3622b6

--- lib/ssluse.c.orig	2013-11-18 06:59:53.408117483 -0800
+++ lib/ssluse.c	2013-11-18 07:00:26.212993187 -0800
@@ -2357,7 +2357,7 @@
    * operations.
    */
 
-  if(!data->set.ssl.verifypeer)
+  if(!data->set.ssl.verifypeer && !data->set.ssl.verifyhost)
     (void)servercert(conn, connssl, FALSE);
   else
     retcode = servercert(conn, connssl, TRUE);