* SECURITY UPDATE: Integer overflow in doProlog related to storeEntityValue and entity textLen (libexpat before 2.8.2) - debian/patches/CVE-2026-56407.patch: cap the entity value pool length at INT_MAX before assigning it to the signed ENTITY::textLen in doProlog - CVE-2026-56407 * SECURITY UPDATE: Integer overflow in copyString (libexpat before 2.8.2) - debian/patches/CVE-2026-56408.patch: reject lengths above SIZE_MAX / sizeof(XML_Char) before sizing the copy, closing the multiplication overflow in wide-character (libexpatw) builds - CVE-2026-56408 * SECURITY UPDATE: Integer overflow for the output filename in xmlwf when -d outputDir is used (libexpat before 2.8.2) - debian/patches/CVE-2026-56409.patch: check the output path join for addition and multiplication overflow, and check the malloc result, before writing the joined path - CVE-2026-56409