* SECURITY UPDATE: NULL pointer dereference in xmlPatMatch - debian/patches/libxml2-2.10.2-CVE-2025-27113.patch: compile an explicit child:: axis step to XML_OP_ELEM instead of XML_OP_CHILD in xmlCompileStepPattern() in pattern.c; backport of upstream libxml2 503f788e (v2.12.10, v2.13.6, v2.14.0). XML_OP_CHILD accepts a document node and does not advance the current node, so a pattern such as "/child::name" matched against a document node reached the unguarded node->parent load in the XML_OP_ROOT case of xmlPatMatch() and crashed. Reachable through the public xmlPatternMatch(), used in-tree by xmlTextReaderPreservePattern() and by Schematron rule contexts; the streaming matcher already compiled the child axis correctly, so XML Schema identity constraints and the XPath streaming optimisation are unaffected. Upstream fixed only the compiler side and leaves the XML_OP_ROOT load unguarded to this day; it is left unguarded here too, and no in-tree caller reaches it. Behaviour change: patterns using the explicit child:: axis now select the named element itself rather than its parent, which is correct XPath and what the streaming matcher already did - CVE-2025-27113 * SECURITY UPDATE: heap out-of-bounds read in xmlSchemaIDCFillNodeTables - debian/patches/libxml2-2.10.2-CVE-2025-32415.patch: use the live bind->nbNodes instead of the stale local nbNodeTable for both the guard and the terminator of the IDC node-table loop in xmlSchemaIDCFillNodeTables in xmlschemas.c; backport of upstream libxml2 384cc7c1 (v2.13.8), whose master twin is 487ee1d8 (v2.14.2). nbNodeTable is snapshotted before the target loop, but the loop shrinks the node table every time it moves a duplicate key-sequence to bind->dupls, so from the next target onwards the loop walks slots past the live end of the table; once the table is empty the guard is still true and a match evaluates bind->nodeTable[-1], reading one element before the start of the heap allocation and leaving bind->nbNodes negative for the targets that follow. Reachable from schema validation of an untrusted instance document against a schema carrying identity constraints, or from an untrusted schema. Applied on top of libxml2-2.10.2-CVE-2024-56171.patch, which edits the same function but a different defect (a stale pointer rather than a stale count) and does not overlap these hunks - CVE-2025-32415 * SECURITY UPDATE: integer overflow in xmlBuildQName leading to a stack-based buffer overflow - debian/patches/libxml2-2.10.2-CVE-2025-6021.patch: hold the local-name and prefix lengths in size_t, reject a negative len, and bound lenn + lenp + 2 against SIZE_MAX before the buffer-size test and the allocation, in tree.c; backport of upstream libxml2 17d950ae (v2.13.9). The lengths were held in int and summed in int arithmetic, so a long enough QName made lenn + lenp + 2 wrap negative, which both defeated the buffer-size test - handing back a caller's 50-byte stack buffer - and undersized the xmlMallocAtomic() allocation, letting the following memcpy()s and the NUL store write out of bounds - CVE-2025-6021 * SECURITY UPDATE: stack-based buffer overflows in xmlcatalog --shell - debian/patches/libxml2-2.10.2-CVE-2026-11979.patch: bounds-check the three copy loops in usershell() in xmlcatalog.c, which wrote a line of user input into the fixed command[100], arg[400] and argv[20] stack buffers with no limit at all; backport of upstream libxml2 cd48d441 (v2.15.4), whose xmlcatalog.c hunks are identical to master's c2e233fc. Over-long input is now rejected with a diagnostic instead of corrupting the stack frame. Upstream's test/catalogs/test.sh hunk is dropped because that file does not exist in 2.10.2; usershell() itself is byte-identical to upstream's pre-fix version, so the guards are carried verbatim. Affects only the xmlcatalog command-line utility shipped by this package -- no library entry point reaches usershell() - CVE-2026-11979 * Harden the xmlcatalog command line parser - debian/patches/libxml2-2.10.2-xmlcatalog-argv-oob-read.patch: check that --add and --del were given enough arguments before indexing argv in main() in xmlcatalog.c; backport of upstream libxml2 b1fea45b. This is not a CVE and is not part of CVE-2026-11979; it is carried alongside it because upstream shipped both in the same release and both touch the same file. "xmlcatalog --add a" read argv[4] past the end of the argument vector and passed whatever followed it, in practice a process environment string, to xmlCatalogAdd()