* SECURITY UPDATE: buffer over-read in the mp4 module while cropping the stsc atom of a specially crafted mp4 file, which could terminate the worker process - debian/patches/CVE-2024-7347.patch: widen n to uint64_t and cast the (next_chunk - chunk) * samples multiplications in ngx_http_mp4_crop_stsc_data() to avoid a 32-bit integer overflow, reject stsc atoms whose chunks are unordered, and ignore the samples per chunk value of an empty chunk run - CVE-2024-7347 * SECURITY UPDATE: client certificate verification bypass through TLSv1.3 session resumption with a server name other than the negotiated one - debian/patches/CVE-2025-23419.patch: reject a resumed handshake in ngx_http_ssl_servername() when the session host name differs from the requested server name and the virtual server verifies client certificates - CVE-2025-23419