Index: general/genlib/libssh2.xml
===================================================================
--- general/genlib/libssh2.xml	(revision b5bd147f2d9e874660c24518d94b43647f0fc30c)
+++ general/genlib/libssh2.xml	(revision 41f721e6696dcaef75140d54794d0df5bbe86aee)
@@ -71,4 +71,13 @@
     </itemizedlist>
 
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Required patch:
+          <ulink url="&patch-root;/libssh2-&libssh2-version;-security_fixes-1.patch"/>
+        </para>
+      </listitem>
+    </itemizedlist>
+
     <bridgehead renderas="sect3">libssh2 Dependencies</bridgehead>
 
@@ -93,5 +102,6 @@
     </para>
 
-<screen><userinput>./configure --prefix=/usr --disable-static &amp;&amp;
+<screen><userinput>patch -Np1 -i ../libssh2-&libssh2-version;-security_fixes-1.patch &amp;&amp;
+./configure --prefix=/usr --disable-static            &amp;&amp;
 make</userinput></screen>
 
Index: introduction/welcome/changelog.xml
===================================================================
--- introduction/welcome/changelog.xml	(revision b5bd147f2d9e874660c24518d94b43647f0fc30c)
+++ introduction/welcome/changelog.xml	(revision 41f721e6696dcaef75140d54794d0df5bbe86aee)
@@ -46,4 +46,16 @@
       <itemizedlist>
         <listitem>
+          <para>[ken] - Add a warning in xdg-utils about an unfixed
+          security vulnerability.</para>
+        </listitem>
+        <listitem>
+          <para>[ken] - Patch libssh2-1.9.0 for a security vulnerability. Fixes
+          <ulink url="&blfs-ticket-root;14853">#14853</ulink>.</para>
+        </listitem>
+        <listitem>
+          <para>[ken] - Patch flac-1.3.3 for a security vulnerability. Fixes
+          <ulink url="&blfs-ticket-root;14852">#14852</ulink>.</para>
+        </listitem>
+        <listitem>
           <para>[timtas] - Update to xscreensaver-6.00. Fixes
           <ulink url="&blfs-ticket-root;14851">#14851</ulink>.</para>
Index: multimedia/libdriv/flac.xml
===================================================================
--- multimedia/libdriv/flac.xml	(revision b5bd147f2d9e874660c24518d94b43647f0fc30c)
+++ multimedia/libdriv/flac.xml	(revision 41f721e6696dcaef75140d54794d0df5bbe86aee)
@@ -68,4 +68,15 @@
         <para>
           Estimated build time: &flac-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">Additional Downloads</bridgehead>
+
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Required patch:
+          <ulink url="&patch-root;/flac-&flac-version;-security_fixes-1.patch"/>
         </para>
       </listitem>
@@ -97,7 +108,8 @@
     </para>
 
-<screen><userinput>./configure --prefix=/usr \
-            --disable-thorough-tests \
-            --docdir=/usr/share/doc/flac-&flac-version; &amp;&amp;
+<screen><userinput>patch -Np1 -i ../flac-&flac-version;-security_fixes-1.patch      &amp;&amp;
+./configure --prefix=/usr                                \
+            --disable-thorough-tests                     \
+            --docdir=/usr/share/doc/flac-&flac-version;          &amp;&amp;
 make</userinput></screen>
 
Index: xsoft/other/xdg-utils.xml
===================================================================
--- xsoft/other/xdg-utils.xml	(revision b5bd147f2d9e874660c24518d94b43647f0fc30c)
+++ xsoft/other/xdg-utils.xml	(revision 41f721e6696dcaef75140d54794d0df5bbe86aee)
@@ -36,4 +36,22 @@
       It is required for Linux Standards Base (LSB) conformance.
     </para>
+
+    <warning>
+      <para>
+        A security vulnerability exists in all versions of
+        <application>xdg-utils</application> from version 1.1.0rc1 when handling
+        mailto: URIs. An attacker could potentially send a victim a URI that
+        automatically attaches a sensitive file to a new email. If a victim user
+        does not notice that an attachment was added and sends the email, this
+        could result in sensitive information disclosure.
+      </para>
+
+      <para>
+        To mitigate this flaw, either do not use mailto links at all, or always
+        double-check in the user interface that there are no unwanted attachments
+        before sending emails, especially when the email originates from clicking
+        on a mailto link.
+      </para>
+    </warning>
 
     &lfs101_checked;
