diff --git a/Lib/aifc.py b/Lib/aifc.py
index 29545a5..3270047 100644
--- a/Lib/aifc.py
+++ b/Lib/aifc.py
@@ -873,23 +873,27 @@
         sys.argv.append('/usr/demos/data/audio/bach.aiff')
     fn = sys.argv[1]
     f = open(fn, 'r')
-    print("Reading", fn)
-    print("nchannels =", f.getnchannels())
-    print("nframes   =", f.getnframes())
-    print("sampwidth =", f.getsampwidth())
-    print("framerate =", f.getframerate())
-    print("comptype  =", f.getcomptype())
-    print("compname  =", f.getcompname())
-    if sys.argv[2:]:
-        gn = sys.argv[2]
-        print("Writing", gn)
-        g = open(gn, 'w')
-        g.setparams(f.getparams())
-        while 1:
-            data = f.readframes(1024)
-            if not data:
-                break
-            g.writeframes(data)
-        g.close()
+    try:
+        print("Reading", fn)
+        print("nchannels =", f.getnchannels())
+        print("nframes   =", f.getnframes())
+        print("sampwidth =", f.getsampwidth())
+        print("framerate =", f.getframerate())
+        print("comptype  =", f.getcomptype())
+        print("compname  =", f.getcompname())
+        if sys.argv[2:]:
+            gn = sys.argv[2]
+            print("Writing", gn)
+            g = open(gn, 'w')
+            try:
+                g.setparams(f.getparams())
+                while 1:
+                    data = f.readframes(1024)
+                    if not data:
+                        break
+                    g.writeframes(data)
+            finally:
+                g.close()
+            print("Done.")
+    finally:
         f.close()
-        print("Done.")
diff --git a/Lib/http/cookies.py b/Lib/http/cookies.py
index d291678..dc3c74a 100644
--- a/Lib/http/cookies.py
+++ b/Lib/http/cookies.py
@@ -338,6 +338,8 @@
         "version"  : "Version",
     }
 
+    _flags = {'secure', 'httponly'}
+
     def __init__(self):
         # Set defaults
         self.key = self.value = self.coded_value = None
@@ -435,15 +437,18 @@
     (?P<key>                       # Start of group 'key'
     """ + _LegalCharsPatt + r"""+?   # Any word of at least one letter
     )                              # End of group 'key'
-    \s*=\s*                        # Equal Sign
-    (?P<val>                       # Start of group 'val'
-    "(?:[^\\"]|\\.)*"                # Any doublequoted string
-    |                                # or
+    (                              # Optional group: there may not be a value.
+    \s*=\s*                          # Equal Sign
+    (?P<val>                         # Start of group 'val'
+    "(?:[^\\"]|\\.)*"                  # Any doublequoted string
+    |                                  # or
     \w{3},\s[\w\d\s-]{9,11}\s[\d:]{8}\sGMT  # Special case for "expires" attr
-    |                                # or
-    """ + _LegalCharsPatt + r"""*    # Any word or empty string
-    )                              # End of group 'val'
-    \s*;?                          # Probably ending in a semi-colon
+    |                                  # or
+    """ + _LegalCharsPatt + r"""*      # Any word or empty string
+    )                                # End of group 'val'
+    )?                             # End of optional value group
+    \s*                            # Any number of spaces.
+    (\s+|;|$)                      # Ending either at space, semicolon, or EOS.
     """, re.ASCII)                 # May be removed if safe.
 
 
@@ -549,8 +554,12 @@
                     M[key[1:]] = value
             elif key.lower() in Morsel._reserved:
                 if M:
-                    M[key] = _unquote(value)
-            else:
+                    if value is None:
+                        if key.lower() in Morsel._flags:
+                            M[key] = True
+                    else:
+                        M[key] = _unquote(value)
+            elif value is not None:
                 rval, cval = self.value_decode(value)
                 self.__set(key, rval, cval)
                 M = self[key]
diff --git a/Lib/test/test_http_cookies.py b/Lib/test/test_http_cookies.py
index e8327e5..1cfbe74 100644
--- a/Lib/test/test_http_cookies.py
+++ b/Lib/test/test_http_cookies.py
@@ -109,13 +109,51 @@
         self.assertEqual(C.output(),
                          'Set-Cookie: Customer="WILE_E_COYOTE"; Max-Age=10')
 
-        # others
+    def test_set_secure_httponly_attrs(self):
         C = cookies.SimpleCookie('Customer="WILE_E_COYOTE"')
         C['Customer']['secure'] = True
         C['Customer']['httponly'] = True
         self.assertEqual(C.output(),
             'Set-Cookie: Customer="WILE_E_COYOTE"; httponly; secure')
 
+    def test_secure_httponly_false_if_not_present(self):
+        C = cookies.SimpleCookie()
+        C.load('eggs=scrambled; Path=/bacon')
+        self.assertFalse(C['eggs']['httponly'])
+        self.assertFalse(C['eggs']['secure'])
+
+    def test_secure_httponly_true_if_present(self):
+        # Issue 16611
+        C = cookies.SimpleCookie()
+        C.load('eggs=scrambled; httponly; secure; Path=/bacon')
+        self.assertTrue(C['eggs']['httponly'])
+        self.assertTrue(C['eggs']['secure'])
+
+    def test_secure_httponly_true_if_have_value(self):
+        # This isn't really valid, but demonstrates what the current code
+        # is expected to do in this case.
+        C = cookies.SimpleCookie()
+        C.load('eggs=scrambled; httponly=foo; secure=bar; Path=/bacon')
+        self.assertTrue(C['eggs']['httponly'])
+        self.assertTrue(C['eggs']['secure'])
+        # Here is what it actually does; don't depend on this behavior.  These
+        # checks are testing backward compatibility for issue 16611.
+        self.assertEqual(C['eggs']['httponly'], 'foo')
+        self.assertEqual(C['eggs']['secure'], 'bar')
+
+    def test_bad_attrs(self):
+        # issue 16611: make sure we don't break backward compatibility.
+        C = cookies.SimpleCookie()
+        C.load('cookie=with; invalid; version; second=cookie;')
+        self.assertEqual(C.output(),
+            'Set-Cookie: cookie=with\r\nSet-Cookie: second=cookie')
+
+    def test_extra_spaces(self):
+        C = cookies.SimpleCookie()
+        C.load('eggs  =  scrambled  ;  secure  ;  path  =  bar   ; foo=foo   ')
+        self.assertEqual(C.output(),
+            'Set-Cookie: eggs=scrambled; Path=bar; secure\r\nSet-Cookie: foo=foo')
+
     def test_quoted_meta(self):
         # Try cookie with quoted meta-data
         C = cookies.SimpleCookie()
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 9bebd1a..fdd2cf7 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -208,13 +208,21 @@
                    (('emailAddress', 'python-dev@python.org'),))
         self.assertEqual(p['subject'], subject)
         self.assertEqual(p['issuer'], subject)
-        self.assertEqual(p['subjectAltName'],
-                         (('DNS', 'altnull.python.org\x00example.com'),
-                         ('email', 'null@python.org\x00user@example.org'),
-                         ('URI', 'http://null.python.org\x00http://example.org'),
-                         ('IP Address', '192.0.2.1'),
-                         ('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
-                        )
+        if ssl._OPENSSL_API_VERSION >= (0, 9, 8):
+            san = (('DNS', 'altnull.python.org\x00example.com'),
+                   ('email', 'null@python.org\x00user@example.org'),
+                   ('URI', 'http://null.python.org\x00http://example.org'),
+                   ('IP Address', '192.0.2.1'),
+                   ('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
+        else:
+            # OpenSSL 0.9.7 doesn't support IPv6 addresses in subjectAltName
+            san = (('DNS', 'altnull.python.org\x00example.com'),
+                   ('email', 'null@python.org\x00user@example.org'),
+                   ('URI', 'http://null.python.org\x00http://example.org'),
+                   ('IP Address', '192.0.2.1'),
+                   ('IP Address', '<invalid>'))
+
+        self.assertEqual(p['subjectAltName'], san)
 
     def test_DER_to_PEM(self):
         with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f:
diff --git a/Misc/NEWS b/Misc/NEWS
index 81ad8f5..6de4812 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -66,6 +66,12 @@
 Library
 -------
 
+- Issue #16611: http.cookie now correctly parses the 'secure' and 'httponly'
+  cookie flags.
+
+- Issue #11973: Fix a problem in kevent. The flags and fflags fields are now
+  properly handled as unsigned.
+
 - Issue #17702: On error, os.environb now removes suppress the except context
   when raising a new KeyError with the original key.
 
@@ -84,7 +90,7 @@
   in the tkinter module.
 
 - Issue #18747: Re-seed OpenSSL's pseudo-random number generator after fork.
-  A pthread_atfork() parent handler is used to seeded the PRNG with pid, time
+  A pthread_atfork() parent handler is used to seed the PRNG with pid, time
   and some stack data.
 
 - Issue #8865: Concurrent invocation of select.poll.poll() now raises a
@@ -372,6 +378,8 @@
 Tools/Demos
 -----------
 
+- Issue #18817: Fix a resource warning in Lib/aifc.py demo.
+
 - Issue #18439: Make patchcheck work on Windows for ACKS, NEWS.
 
 - Issue #18448: Fix a typo in Tools/demo/eiffel.py.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 97934d9..82d0a6a 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -2586,7 +2586,7 @@
 /* Seed OpenSSL's PRNG at fork(), http://bugs.python.org/issue18747
  *
  * The parent handler seeds the PRNG from pseudo-random data like pid, the
- * current time (miliseconds or seconds) and an uninitialized arry.
+ * current time (miliseconds or seconds) and an uninitialized array.
  * The array contains stack variables that are impossible to predict
  * on most systems, e.g. function return address (subject to ASLR), the
  * stack protection canary and automatic variables.
@@ -2595,7 +2595,7 @@
  * Note:
  * The code uses pthread_atfork() until Python has a proper atfork API. The
  * handlers are not removed from the child process. A parent handler is used
- * instead of a child handler because fork() is suppose to be async-signal
+ * instead of a child handler because fork() is supposed to be async-signal
  * safe but the handler calls unsafe functions.
  */
 
diff --git a/Modules/selectmodule.c b/Modules/selectmodule.c
index 92d0e67..603a2b6 100644
--- a/Modules/selectmodule.c
+++ b/Modules/selectmodule.c
@@ -1638,7 +1638,7 @@
     PyObject *pfd;
     static char *kwlist[] = {"ident", "filter", "flags", "fflags",
                              "data", "udata", NULL};
-    static char *fmt = "O|hhi" DATA_FMT_UNIT UINTPTRT_FMT_UNIT ":kevent";
+    static char *fmt = "O|hHI" DATA_FMT_UNIT UINTPTRT_FMT_UNIT ":kevent";
 
     EV_SET(&(self->e), 0, EVFILT_READ, EV_ADD, 0, 0, 0); /* defaults */