* SECURITY UPDATE: arbitrary file disclosure via XML external entity
  - debian/patches/CVE-2012-5656.patch: disable loading external entities
    in src/preferences-skeleton.h, src/ui/dialog/ocaldialogs.cpp,
    src/xml/repr-io.cpp.
  - CVE-2012-5656
* SECURITY UPDATE: possible file loading from /tmp
  - debian/patches/CVE-2012-6076.patch: make sure filename is absolute
    in src/extension/implementation/script.cpp.
  - CVE-2012-6076