* SECURITY UPDATE: use-after-free after xmlSchemaItemListAdd - debian/patches/libxml2-2.10.2-CVE-2024-56171.patch: refresh the cached pointer to the duplicates array after xmlSchemaItemListAdd() may have reallocated it, in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c; backport of upstream libxml2 5880a9a6 (v2.12.10, v2.13.6, v2.14.0). Reachable from schema validation of an untrusted instance document that produces duplicate identity-constraint keys. The second site additionally checks xmlSchemaItemListAdd()'s return before refreshing the pointer: 2.10.2 assigns xmlRealloc()'s result straight to list->items, so unlike upstream it leaves it NULL on failure - CVE-2024-56171 * SECURITY UPDATE: use-after-free in xmlParseInternalSubset - debian/patches/libxml2-2.10.2-CVE-2026-6653.patch: drop the post-push XML_PARSER_EOF check from xmlPushInput(), and give the xmlSkipBlankChars() loop an XML_PARSER_EOF guard, both in parser.c; backports of upstream libxml2 f19a9510 (its xmlPushInput hunk) and e129c1d1. xmlPushInput() tested for a halted parser only after inputPush() had already installed the input as ctxt->input, and then returned -1, so xmlParsePEReference() freed an input stream that ctxt->input still pointed at and a crafted DTD internal subset caused a heap use-after-free read in xmlParseInternalSubset(). With that input no longer freed the parser goes on to re-enter xmlSkipBlankChars(), whose loop was unconditional while NEXT is a no-op on a halted parser, so the same document would spin at 100% CPU instead of crashing; the guard ends the loop, matching the three other loops in the file. The halt comes from the entity amplification check added for CVE-2021-3541, which 2.10.2 carries; that check is left in place. The upstream fix for this CVE (463bbeec, v2.11.0) is not used: it appends members to the public xmlEntity and xmlParserInput structs, changing their size, and enforces the amplification cap even under XML_PARSE_HUGE - CVE-2026-6653