* SECURITY UPDATE: Integer overflow into heap buffer overflow when escaping a URI string - debian/patches/gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch: add this patch to debian/patches/series. The file already shipped in 2.66.8-1+deb11u7, and that upload's changelog announces the CVE as fixed, but the patch was never added to the series and so was never applied: it is the only orphan in the 97-entry quilt stack, while every other CVE patch from the same entry (CVE-2025-14087, CVE-2025-4373, CVE-2025-7039) is listed. The shipped library therefore still counts unacceptable characters in a gint in g_escape_uri_string() in glib/gconvert.c, so g_malloc() is called with p - string + unacceptable * 2 + 1 after the multiplication has wrapped to INT_MIN. Confirmed against the stock Debian 11 libglib2.0-0 2.66.8-1+deb11u8: g_filename_to_uri() on a path of 2^30 escapable characters aborts in gmem.c with "failed to allocate 18446744072635809794 bytes", i.e. the negative sum widened to gsize. The patch is the vendor's own file and is added verbatim, unmodified. - CVE-2025-13601 * SECURITY UPDATE: Off-by-one over-read in the GVariant tuple deserialiser - debian/patches/CVE-2026-58010.patch: correct the padding bounds test in gvs_tuple_is_normal() in glib/gvariant-serialiser.c from offset > value.size to offset >= value.size, which allowed a one-byte read past the end of the serialised data - CVE-2026-58010 * SECURITY UPDATE: Missing range validation in g_date_time_add_full() - debian/patches/CVE-2026-58011.patch: reject results outside 0001-01-01..9999-12-31 in glib/gdatetime.c instead of leaving the "XXX validate" placeholder, preventing a two-byte over-read when the computed day count falls outside the representable range - CVE-2026-58011 * SECURITY UPDATE: Buffer over-read in g_regex_replace() in raw mode - debian/patches/CVE-2026-58012.patch: handle case-changing substitutions byte-wise rather than as UTF-8 in glib/gregex.c when the pattern was compiled with G_REGEX_RAW, where the subject is not required to be valid UTF-8 - CVE-2026-58012 * SECURITY UPDATE: memcmp() past the end of the buffer in GIOChannel - debian/patches/CVE-2026-58013.patch: bound the line-terminator comparison in glib/giochannel.c by the remaining buffer length, which was over-read when a custom terminator is longer than the data left - CVE-2026-58013 * SECURITY UPDATE: One-byte heap under-read in GKeyFile - debian/patches/CVE-2026-58014.patch: guard the trailing-separator test in g_key_file_get_locale_string_list() in glib/gkeyfile.c with len > 0, which indexed value[-1] for an empty value - CVE-2026-58014 * SECURITY UPDATE: Path traversal via the D-Bus SHA-1 cookie context - debian/patches/CVE-2026-58015.patch: validate the server-supplied cookie context in gio/gdbusauthmechanismsha1.c against the D-Bus specification before using it as a keyring filename, so a malicious peer cannot direct the client to hash arbitrary files - CVE-2026-58015