* SECURITY UPDATE: use-after-free in the DTD parser reachable through xmlParseInternalSubset() - debian/patches/CVE-2026-6653.patch: stop xmlPushInput() in parser.c from returning -1 when the parser has already been halted, since inputPush() has by then installed the input as ctxt->input and the caller reads -1 as "ownership not transferred" and frees it. xmlParsePEReference() then leaves ctxt->input dangling and xmlParseInternalSubset()'s loop reads through it in RAW, which is evaluated before the XML_PARSER_EOF test can short-circuit. The halt itself comes from the amplification check in xmlParserEntityCheck() added by Patch-for-security-issue-CVE-2021-3541.patch and is left untouched - CVE-2026-6653 * SECURITY UPDATE: stack buffer overflows in xmlcatalog --shell mode - debian/patches/CVE-2026-11979.patch: add capacity checks to the command, argument and argv loops of the usershell() command-line parser in xmlcatalog.c, so an over-long --shell command line is rejected instead of written past the end of the on-stack buffers - CVE-2026-11979