- rebase onto Oracle 1.10.4-2.0.5.el7 - CVE-2026-18297: picked up from the vendor as Patch1006, which stops gst_opus_dec_negotiate() using channel positions above 64 channels - the TuxCare duplicate opusdec-over-64-channels patch is dropped; the vendor's 1006-CVE-2026-18297.patch carries the same fix - retain the two halves of our vorbis setup-packet backport the vendor still omits: gst_parse_vorbis_setup_packet() stays declared void in the vendor's Patch1003, so its five `return -1` statements are discarded and is_header_vorbis() still accepts a malformed packet, and its guards cover underrunning the ogg packet but not running both advance loops past op->packet + op->bytes - retain the video-info overflow-check fix, since the vendor's Patch1004 guard computes the very product it is meant to reject and wraps for width/height near G_MAXINT with bpp > 2