* SECURITY UPDATE: arbitrary code execution via the opvp Driver parameter - debian/patches/CVE-2024-33871.patch: refuse a Driver change once LockSafetyParams is set, and report the Driver length without the trailing NUL, in contrib/opvp/gdevopvp.c. - CVE-2024-33871 * SECURITY UPDATE: unchecked Implementation pointer in Pattern colour space - debian/patches/CVE-2024-46951.patch: check that the Pattern Implementation object really is a pattern instance before dereferencing it in patterncomponent() in psi/zcolor.c. - CVE-2024-46951 * SECURITY UPDATE: integer overflow validating the output filename format - debian/patches/CVE-2024-46953.patch: reject format widths that overflow an int and tighten the length check in gx_parse_output_format() and gx_parse_output_file_name() in base/gsdevice.c. - CVE-2024-46953 * SECURITY UPDATE: out-of-bounds data access in filenameforall - debian/patches/CVE-2024-46956.patch: correct the buffer length check in file_continue() in psi/zfile.c, so filenameforall cannot return a string whose declared size exceeds the scratch buffer. - CVE-2024-46956