* SECURITY UPDATE: out-of-bounds write in stab_xcoff_builtin_type (binutils/stabs.c) - debian/patches/CVE-2021-45078.patch: reject negative and out-of-range XCOFF builtin type numbers instead of indexing info->xcoff_types with them - CVE-2021-45078 * SECURITY UPDATE: heap buffer overflow in read_section_stabs_debugging_info (binutils/rddbg.c) - debian/patches/CVE-2021-46174.patch: check the stab section holds a whole number of entries before reading them - CVE-2021-46174 * SECURITY UPDATE: heap buffer overflow in find_section_in_set (binutils/readelf.c) - debian/patches/CVE-2022-44840.patch: fill the shndx pool by scanning it directly so each set stays NUL terminated for a crafted .debug_cu_index - CVE-2022-44840 * SECURITY UPDATE: out-of-bounds read in parse_module (bfd/vms-alpha.c) - debian/patches/CVE-2022-47673_CVE-2023-25584.patch: sanity check VMS debug record lengths and DST element sizes before reading them - CVE-2022-47673 - CVE-2023-25584 * SECURITY UPDATE: NULL pointer dereference in compare_symbols (binutils/objdump.c) - debian/patches/CVE-2022-47695.patch: guard the section comparison against symbols that have no section - CVE-2022-47695 * SECURITY UPDATE: crash on an uninitialised asymbol from bfd_mach_o_get_synthetic_symtab (bfd/mach-o.c) - debian/patches/CVE-2022-47696.patch: initialise the_bfd on the synthetic symbols so objdump can sort them - CVE-2022-47696 * SECURITY UPDATE: NULL pointer dereference in elf_gc_sweep (bfd/elflink.c) - debian/patches/CVE-2025-5244.patch: skip the gc_mark propagation when a section group has no first member - CVE-2025-5244 * SECURITY UPDATE: NULL pointer dereference in debug_type_samep and debug_write_type (binutils/debug.c) - debian/patches/CVE-2025-5245.patch: handle enum types that carry no name list - CVE-2025-5245 * SECURITY UPDATE: NULL pointer dereference in process_relocs (binutils/readelf.c) - debian/patches/CVE-2025-69649.patch: do not walk the section headers when the file has none - CVE-2025-69649 * SECURITY UPDATE: out-of-bounds reads in xcoff_link_add_symbols (bfd/xcofflink.c) - debian/patches/CVE-2026-3441_CVE-2026-3442.patch: bound the XTY_LD x_scnlen csect index by the symbol count rather than by the byte offset into the symbol table, and range-check r_symndx before indexing the symbol hashes - CVE-2026-3441 - CVE-2026-3442 * SECURITY UPDATE: heap buffer overflow in xcoff_link_add_symbols (bfd/xcofflink.c) - debian/patches/CVE-2026-6846.patch: size the reloc_info array by the highest section target_index - CVE-2026-6846