* SECURITY UPDATE: REXML ReDoS via leading-zero hex character reference - debian/patches/CVE-2024-49761.patch: replace the /�*((?:\d+)|(?:x[a-fA-F0-9]+));/ regex in unnormalize() with /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ so that �x...; is no longer accepted as a hex character reference, eliminating the catastrophic-backtracking ReDoS on inputs with many leading zeros. - CVE-2024-49761 * SECURITY UPDATE: REXML DoS via deep same-local-name attributes - debian/patches/CVE-2024-43398.patch: replace the per-attribute tree-walk in Element#[]= with an O(1) parse-time conflict check using a parser-level @namespaces hash and an expanded_names hash keyed on [uri, local_part]; seed @namespaces with the implicitly-bound xml prefix per upstream 78f8712 to avoid breaking XHTML documents that use both xml:lang and lang. - CVE-2024-43398 * SECURITY UPDATE: REXML DoS via entity expansion in SAX/pull parsers - debian/patches/CVE-2024-41946.patch: route the SAX2Parser :text handler through @parser.unnormalize (upstream prerequisite 4ebf21f), and add @entity_expansion_count + per-call sum/Security.entity_expansion_text_limit accounting in BaseParser so that billion-laughs-style XML triggers "entity expansion has grown too large" / "number of entity expansions exceeded" in SAX and pull mode, matching the existing DOM behaviour. - CVE-2024-41946 * SECURITY UPDATE: REXML DoS via slow processing-instruction parsing - debian/patches/CVE-2024-41123.patch: rewrite process_instruction to call parse_name and then match the content separately, avoiding the catastrophic-backtracking INSTRUCTION_PATTERN regex; grow the IOSource read buffer exponentially via min_bytes so that source.match() is O(log n) attempts rather than O(n) on inputs that never match the regex. - CVE-2024-41123