* SECURITY UPDATE: out-of-bounds read via a positional field width or precision in printf/sprintf - debian/patches/CVE-2023-4156.patch: reject a negative positional index in format_tree() in builtin.c. The digit run of a `%*N$' specifier is accumulated into an int, so a sufficiently long N wraps it negative; the existing guard tested only val >= num_args, letting the negative value reach the_args[val] and read before the start of the argument array - CVE-2023-4156 * SECURITY UPDATE: use-after-free in getline from a two-way pipe - debian/patches/CVE-2026-40467.patch: stop do_getline_redir() in io.c from releasing redir_exp immediately after redirect(), since the two-way-pipe error path still reads redir_exp->stptr/stlen through is_non_fatal_redirect(). The DEREF is moved to each control-flow path after the node's last use - CVE-2026-40467 * SECURITY UPDATE: heap buffer overflow in sub()/gsub() on 32-bit architectures - debian/patches/CVE-2026-40468.patch: widen the sofar accumulator in do_sub() in builtin.c from int to size_t so the running offset into the replacement buffer cannot overflow while the buffer itself is sized with size_t arithmetic. The upstream commit's second hunk, widening i to int64_t in parse_escape() in node.c, is carried verbatim for fidelity; it is inert here, as that function's octal and hex loops are bounded at 0777 and 0xFF and it returns int - CVE-2026-40468 * SECURITY UPDATE: integer overflow in the sub()/gsub() replacement size computation on 32-bit architectures - debian/patches/CVE-2026-40469.patch: compute the ampersand expansion in do_sub() in builtin.c as a uint64_t and fatal out with "replacement expansion too large" when the result would exceed SIZE_MAX, instead of wrapping and under-allocating the destination buffer - CVE-2026-40469 * SECURITY UPDATE: stack buffer overflow in the readdir extension - debian/patches/CVE-2026-40553.patch: build the path in ftype() in extension/readdir.c with a bounded snprintf() and reject the entry when the result would be truncated, replacing the unbounded strcpy()/strcat() pair that overflowed fname[] for a sufficiently long directory or entry name - CVE-2026-40553