* SECURITY UPDATE: stack buffer overflow in the genrb tool. addCollation(), parseCollationElements() and realParseTable() copied a resource-bundle key of unbounded length into a fixed char subtag[1024] stack array via u_UCharsToChars() (ICU-22973). Backported from upstream 77.1 and adapted to ICU 57's CharString API, which has no appendInvariantChars(UChar*, int32_t, UErrorCode&) overload. - debian/patches/CVE-2025-5222-57.patch: use icu::CharString for subtag and typeKeyword in source/tools/genrb/parse.cpp. - ELSLANG-115261 - CVE-2025-5222 * SECURITY UPDATE: integer overflow in UnicodeString::doAppend(). int32_t newLength = oldLength + srcLength wraps negative on a large append, giving an undersized allocation and an out-of-bounds write (ICU-20958). Backported from upstream 67.1; ICU 57 has no uprv_add32_overflow(), so an equivalent INT32_MAX pre-check is used. - debian/patches/ICU-12663-57.patch: clamp UnicodeString capacity at kMaxCapacity (0x7ffffff5) and do the allocation arithmetic in size_t, backported from upstream 59.1. Without it the guard below is not sufficient on 57: appending INT32_MAX units to an empty string passes the guard and reaches 57.1's unclamped allocate(), which wraps its int32_t size computation and returns a 6-UChar buffer. - debian/patches/CVE-2020-10531-57.patch: reject the append and setToBogus() on overflow in source/common/unistr.cpp. - ELSLANG-115265 - CVE-2020-10531 * Harden genrb's parseUCARules() against the same primitive as CVE-2025-5222 at a lower threshold: the resource-bundle token was decoded into a fixed char cs[128] and concatenated into a fixed char filename[256], neither bounded (ICU-23159). Backported from upstream 78.1 and adapted to ICU 57's CharString API. No CVE is assigned to this one. - debian/patches/ICU-23159-57.patch: use icu::CharString for the filename built in source/tools/genrb/parse.cpp. * Carry the TestLargeAppend regression test from the upstream CVE-2020-10531 commit into source/test/intltest. It is exhaustive-mode only (`if(quick) return;`), so it does not run in the package's test suite and changes neither build time nor test results.