* SECURITY UPDATE: out-of-bounds read when following a redirect whose Location header is empty - debian/patches/php-7.0-CVE-2026-93682.patch: an empty Location header is stored as a zero-length string, i.e. a one-byte allocation holding only the NUL terminator, but the relative-redirect branch of php_stream_url_wrap_http_ex() tested location[1] and the scheme check called strlen() on it, so a server that answered a redirect with a bare "Location:" made the wrapper read past the end of that allocation. The heap bytes it found there decided whether the redirect was joined to the request path, so besides the over-read the target could be built from unrelated heap contents instead of the host root. The length is now taken from header_info.location_len, which the CVE-2025-1861 backport already records, and the relative join is skipped unless the header is longer than one byte, which also keeps single-character Location values resolving against the host root as they did before. Adds upstream's two regression tests, re-pointed at ServerClientTestCase2.inc because this tree's stock ServerClientTestCase.inc has neither phpt_notify_server_start() nor the {{ ADDR }} placeholder. - CVE-2026-93682 * SECURITY UPDATE: FastCGI allowed_clients compared only the first 96 bits of an IPv6 address - debian/patches/php-7.0-CVE-2026-91768.patch: fcgi_is_allowed() passed a hard-coded length of 12 to memcmp() when matching an IPv6 peer against listen.allowed_clients, so only the leading 96 bits of the 128-bit address were compared and the last four bytes were ignored. Any client sharing the /96 prefix of an allowed address was accepted, which for the usual "::1" entry means every address in ::/96 -- including the IPv4-mapped range -- was treated as allowed. The comparison now uses sizeof(client_sa.sa_inet6.sin6_addr), i.e. all 128 bits. - CVE-2026-91768