SECURITY UPDATE: infinite loop on circular parameter entities
debian/patches/CVE-2026-106568.patch: check entity values for both
'%' and '&' references in ValidateEntities() so circular parameter
entity declarations are rejected in ParseInternalDoctype() in
magick/xml-tree.c
CVE-2026-106568
SECURITY UPDATE: memory leak in the YUV encoder
debian/patches/CVE-2026-109263.patch: destroy the luma image when the
chroma ResizeImage() fails and destroy the chroma image after the
encoding loop in WriteYUVImage() in coders/yuv.c
CVE-2026-109263
SECURITY UPDATE: PostScript code injection through the font name
debian/patches/CVE-2026-109275.patch: only pass font names made of
alphanumerics, '-', '_' and '.' to the PostScript renderer in
RenderPostscript() in magick/annotate.c