SECURITY UPDATE: stack-based buffer overflows in the xmlcatalog utility
interactive --shell mode
debian/patches/CVE-2026-11979.patch: Add bounds checks in usershell() in
xmlcatalog.c so the command, arg and argv fixed-size stack buffers are not
overflowed by an overly long --shell input line