diff --git a/0001-CVE-2022-38745.patch b/0001-CVE-2022-38745.patch
new file mode 100644
index 0000000000000000000000000000000000000000..4c4c27679e10e1c54ef48b57cd282cacad98b3f7
--- /dev/null
+++ b/0001-CVE-2022-38745.patch
@@ -0,0 +1,96 @@
+From b1fcdc417f14fc561358203d67a4e90e5d7f7b54 Mon Sep 17 00:00:00 2001
+From: Stephan Bergmann <sbergman@redhat.com>
+Date: Mon, 21 Feb 2022 11:55:21 +0100
+Subject: [PATCH] Avoid unnecessary empty -Djava.class.path=
+
+Change-Id: Idcfe7321077b60381c0273910b1faeb444ef1fd8
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130242
+Tested-by: Jenkins
+Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
+
+erAck: backported to 6.0.6.1
+erAck: backported to 5.3.6.1
+---
+ .../plugins/sunmajor/pluginlib/sunjavaplugin.cxx | 16 +++++++++++++---
+ jvmfwk/source/framework.cxx                      |  8 ++++++--
+ jvmfwk/source/fwkbase.cxx                        |  3 +++
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+index d69b439..dd859cb 100644
+--- a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
++++ b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+@@ -749,17 +749,22 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
+     // all versions below 1.5.1
+     options.push_back(Option("abort", reinterpret_cast<void*>(abort_handler)));
+     bool hasStackSize = false;
++#ifdef UNX
++    // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
++    // in the class path in order to have applet support:
++    OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
++#endif
+     for (int i = 0; i < cOptions; i++)
+     {
+         OString opt(arOptions[i].optionString);
+ #ifdef UNX
+-        // Until java 1.5 we need to put a plugin.jar or javaplugin.jar (<1.4.2)
+-        // in the class path in order to have applet support:
+         if (opt.startsWith("-Djava.class.path="))
+         {
+-            OString sAddPath = getPluginJarPath(pInfo->sVendor, pInfo->sLocation,pInfo->sVersion);
+             if (!sAddPath.isEmpty())
++            {
+                 opt += OString(SAL_PATHSEPARATOR) + sAddPath;
++                sAddPath.clear();
++            }
+         }
+ #endif
+         if (opt == "-Xint") {
+@@ -805,6 +810,11 @@ javaPluginError jfw_plugin_startJavaVirtualMachine(
+         }
+ #endif
+     }
++#ifdef UNX
++    if (!sAddPath.isEmpty()) {
++        options.emplace_back("-Djava.class.path=" + sAddPath, nullptr);
++    }
++#endif
+ 
+     std::unique_ptr<JavaVMOption[]> sarOptions(new JavaVMOption[options.size()]);
+     for (std::vector<Option>::size_type i = 0; i != options.size(); ++i) {
+diff --git a/jvmfwk/source/framework.cxx b/jvmfwk/source/framework.cxx
+index 94f7c2c..9780e42 100644
+--- a/jvmfwk/source/framework.cxx
++++ b/jvmfwk/source/framework.cxx
+@@ -287,8 +287,12 @@ javaFrameworkError jfw_startVM(
+                 //In direct mode the options are specified by bootstrap variables
+                 //of the form UNO_JAVA_JFW_PARAMETER_1 .. UNO_JAVA_JFW_PARAMETER_n
+                 vmParams = jfw::BootParams::getVMParameters();
+-                sUserClassPath =
+-                    "-Djava.class.path=" + jfw::BootParams::getClasspath();
++                auto const cp = jfw::BootParams::getClasspath();
++                if (!cp.isEmpty())
++                {
++                    sUserClassPath =
++                        "-Djava.class.path=" + cp;
++                }
+             }
+             else
+                 OSL_ASSERT(false);
+diff --git a/jvmfwk/source/fwkbase.cxx b/jvmfwk/source/fwkbase.cxx
+index b7d1d91..d8a0740 100644
+--- a/jvmfwk/source/fwkbase.cxx
++++ b/jvmfwk/source/fwkbase.cxx
+@@ -490,6 +490,9 @@ OString makeClassPathOption(OUString const & sUserClassPath)
+ 
+     sPaths = OUStringToOString(
+         sBufCP.makeStringAndClear(), osl_getThreadTextEncoding());
++    if (sPaths.isEmpty()) {
++        return "";
++    }
+ 
+     OString sOptionClassPath("-Djava.class.path=");
+     sOptionClassPath += sPaths;
+-- 
+2.44.0
+
diff --git a/0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch b/0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
new file mode 100644
index 0000000000000000000000000000000000000000..22aeaffe62dba2945bc96e892872a8e31b435d13
--- /dev/null
+++ b/0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
@@ -0,0 +1,61 @@
+From 106a8d40c33ce0bf927054a7ea4e9c6fe6f341d5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Fri, 3 Nov 2023 14:20:07 +0000
+Subject: [PATCH] escape url passed to gstreamer
+
+Change-Id: I3c93ee34800cc8563370f75ef3ef6f8a9220e6ec
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158894
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit f41dcadf6492a6ffd32696d50f818e44355b9ad9)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159583
+
+erAck: backported to 7.1.8.1
+erAck: backported to 6.0.6.1
+---
+ avmedia/source/gstreamer/gstframegrabber.cxx | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/avmedia/source/gstreamer/gstframegrabber.cxx b/avmedia/source/gstreamer/gstframegrabber.cxx
+index db2f203..a525e9b 100644
+--- a/avmedia/source/gstreamer/gstframegrabber.cxx
++++ b/avmedia/source/gstreamer/gstframegrabber.cxx
+@@ -56,18 +56,17 @@ void FrameGrabber::disposePipeline()
+ FrameGrabber::FrameGrabber( const OUString &rURL ) :
+     FrameGrabber_BASE()
+ {
+-    gchar *pPipelineStr;
+-    pPipelineStr = g_strdup_printf(
+ #ifdef AVMEDIA_GST_0_10
++    const char pPipelineStr[] =
+         "uridecodebin uri=%s ! ffmpegcolorspace ! videoscale ! appsink "
+         "name=sink caps=\"video/x-raw-rgb,format=RGB,pixel-aspect-ratio=1/1,"
+         "bpp=(int)24,depth=(int)24,endianness=(int)4321,"
+-        "red_mask=(int)0xff0000, green_mask=(int)0x00ff00, blue_mask=(int)0x0000ff\"",
++        "red_mask=(int)0xff0000, green_mask=(int)0x00ff00, blue_mask=(int)0x0000ff\"";
+ #else
++    const char pPipelineStr[] =
+         "uridecodebin uri=%s ! videoconvert ! videoscale ! appsink "
+-        "name=sink caps=\"video/x-raw,format=RGB,pixel-aspect-ratio=1/1\"",
++        "name=sink caps=\"video/x-raw,format=RGB,pixel-aspect-ratio=1/1\"";
+ #endif
+-        OUStringToOString( rURL, RTL_TEXTENCODING_UTF8 ).getStr() );
+ 
+     GError *pError = nullptr;
+     mpPipeline = gst_parse_launch( pPipelineStr, &pError );
+@@ -78,6 +77,12 @@ FrameGrabber::FrameGrabber( const OUString &rURL ) :
+     }
+ 
+     if( mpPipeline ) {
++
++        if (GstElement *pUriDecode = gst_bin_get_by_name(GST_BIN(mpPipeline), "source"))
++            g_object_set(pUriDecode, "uri", OUStringToOString(rURL, RTL_TEXTENCODING_UTF8).getStr(), nullptr);
++        else
++            g_warning("Missing 'source' element in gstreamer pipeline");
++
+         // pre-roll
+         switch( gst_element_set_state( mpPipeline, GST_STATE_PAUSED ) ) {
+         case GST_STATE_CHANGE_FAILURE:
+-- 
+2.44.0
+
diff --git a/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch b/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
new file mode 100644
index 0000000000000000000000000000000000000000..487629fa28fa550ba3fb1f59fa1c835f7fb04a7a
--- /dev/null
+++ b/0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
@@ -0,0 +1,82 @@
+From 30a28017ec9ffd7e26bb7867be1597250cceee23 Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Thu, 16 Feb 2023 20:20:31 +0100
+Subject: [PATCH] Obtain actual 0-parameter count for OR(), AND() and
+ 1-parameter functions
+
+OR and AND for legacy infix notation are classified as binary
+operators but in fact are functions with parameter count. In case
+no argument is supplied, GetByte() returns 0 and for that case the
+implicit binary operator 2 parameters were wrongly assumed.
+Similar for functions expecting 1 parameter, without argument 1
+was assumed. For "real" unary and binary operators the compiler
+already checks parameters. Omit OR and AND and 1-parameter
+functions from this implicit assumption and return the actual 0
+count.
+
+Change-Id: Ie05398c112a98021ac2875cf7b6de994aee9d882
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147173
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+
+(cherry picked from commit e7ce9bddadb2db222eaa5f594ef1de2e36d57e5c)
+Conflicts:
+        sc/source/core/tool/interpr4.cxx
+
+erAck: backported to 6.0.6.1
+---
+ formula/source/core/api/token.cxx | 13 +++++--------
+ sc/source/core/tool/interpr4.cxx  | 10 +++++++++-
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/formula/source/core/api/token.cxx b/formula/source/core/api/token.cxx
+index 07ff7cc..0964dc4 100644
+--- a/formula/source/core/api/token.cxx
++++ b/formula/source/core/api/token.cxx
+@@ -106,17 +106,14 @@ sal_uInt8 FormulaToken::GetParamCount() const
+         return 0;       // parameters and specials
+                         // ocIf, ocIfError, ocIfNA and ocChoose not for FAP, have cByte then
+ //2do: bool parameter whether FAP or not?
+-    else if ( GetByte() )
++    else if (GetByte())
+         return GetByte();   // all functions, also ocExternal and ocMacro
+-    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP)
+-        return 2;           // binary
+-    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP)
+-            || eOp == ocPercentSign)
+-        return 1;           // unary
++    else if (SC_OPCODE_START_BIN_OP <= eOp && eOp < SC_OPCODE_STOP_BIN_OP && eOp != ocAnd && eOp != ocOr)
++        return 2;           // binary operators, compiler checked; OR and AND legacy but are functions
++    else if ((SC_OPCODE_START_UN_OP <= eOp && eOp < SC_OPCODE_STOP_UN_OP) || eOp == ocPercentSign)
++        return 1;           // unary operators, compiler checked
+     else if (SC_OPCODE_START_NO_PAR <= eOp && eOp < SC_OPCODE_STOP_NO_PAR)
+         return 0;           // no parameter
+-    else if (SC_OPCODE_START_1_PAR <= eOp && eOp < SC_OPCODE_STOP_1_PAR)
+-        return 1;           // one parameter
+     else if ( eOp == ocIf || eOp == ocIfError || eOp == ocIfNA || eOp == ocChoose )
+         return 1;           // only the condition counts as parameter
+     else
+diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
+index 904fecd..405d8dc 100644
+--- a/sc/source/core/tool/interpr4.cxx
++++ b/sc/source/core/tool/interpr4.cxx
+@@ -4030,7 +4030,15 @@ StackVar ScInterpreter::Interpret()
+                     nStackBase = sp - pCur->GetParamCount();
+             }
+             if ( nStackBase > sp )
+-                nStackBase = sp;        // underflow?!?
++            {
++                SAL_WARN("sc.core", "Stack anomaly at " << aPos.Format(
++                            ScRefFlags::VALID | ScRefFlags::FORCE_DOC | ScRefFlags::TAB_3D, pDok)
++                        << "  eOp: " << static_cast<int>(eOp)
++                        << "  params: " << static_cast<int>(pCur->GetParamCount())
++                        << "  nStackBase: " << nStackBase << "  sp: " << sp);
++                nStackBase = sp;
++                assert(!"underflow");
++            }
+ 
+             switch( eOp )
+             {
+-- 
+2.44.0
+
diff --git a/0001-disable-script-dump.patch b/0001-disable-script-dump.patch
new file mode 100644
index 0000000000000000000000000000000000000000..3c31cd908ce74d6b6eef51fe30df861419a5eb62
--- /dev/null
+++ b/0001-disable-script-dump.patch
@@ -0,0 +1,102 @@
+From 40e24bd22205f8dd8b107fc059eba8b1b376fd28 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 13 Feb 2023 13:56:10 +0000
+Subject: [PATCH] disable script dump
+
+Change-Id: I04d740cc0fcf87daa192a0a6af34138278043a19
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/146986
+Tested-by: Jenkins
+Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147051
+Tested-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147255
+Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
+Reviewed-by: Andras Timar <andras.timar@collabora.com>
+(cherry picked from commit ae3a7dcbb60bb73700737b9ca8940ce3103648d9)
+
+erAck: backported to 6.0.6.1
+erAck: backported to 5.3.6.1
+---
+ .../source/drivers/hsqldb/HDriver.cxx         | 31 +++++++++++++++++++
+ external/hsqldb/UnpackedTarball_hsqldb.mk     |  1 +
+ .../hsqldb/patches/disable-dump-script.patch  | 14 +++++++++
+ 3 files changed, 46 insertions(+)
+ create mode 100644 external/hsqldb/patches/disable-dump-script.patch
+
+diff --git a/connectivity/source/drivers/hsqldb/HDriver.cxx b/connectivity/source/drivers/hsqldb/HDriver.cxx
+index af24d31..933ac52 100644
+--- a/connectivity/source/drivers/hsqldb/HDriver.cxx
++++ b/connectivity/source/drivers/hsqldb/HDriver.cxx
+@@ -300,6 +300,37 @@ namespace connectivity
+                         } // if ( xStream.is() )
+                         ::comphelper::disposeComponent(xStream);
+                     }
++
++                    // disallow any database/script files that contain a "SCRIPT[.*]" entry (this is belt and braces
++                    // in that bundled hsqldb 1.8.0 is patched to also reject them)
++                    //
++                    // hsqldb 2.6.0 release notes have: added system role SCRIPT_OPS for export / import of database structure and data
++                    // which seems to provide a builtin way to do this with contemporary hsqldb
++                    const OUString sScript( "script" );
++                    if (!bIsNewDatabase && xStorage->isStreamElement(sScript))
++                    {
++                        Reference<XStream > xStream = xStorage->openStreamElement(sScript, ElementModes::READ);
++                        if (xStream.is())
++                        {
++                            std::unique_ptr<SvStream> pStream(::utl::UcbStreamHelper::CreateStream(xStream));
++                            if (pStream)
++                            {
++                                OString sLine;
++                                while (pStream->ReadLine(sLine))
++                                {
++                                    OString sText = sLine.trim();
++                                    if (sText.startsWithIgnoreAsciiCase("SCRIPT"))
++                                    {
++                                        ::connectivity::SharedResources aResources;
++                                        sMessage = aResources.getResourceString(STR_COULD_NOT_LOAD_FILE).replaceFirst("$filename$", sSystemPath);
++                                        break;
++                                    }
++                                }
++                            }
++                        } // if ( xStream.is() )
++                        ::comphelper::disposeComponent(xStream);
++                    }
++
+                 }
+                 catch(Exception&)
+                 {
+diff --git a/external/hsqldb/UnpackedTarball_hsqldb.mk b/external/hsqldb/UnpackedTarball_hsqldb.mk
+index 0906647..5c00c17 100644
+--- a/external/hsqldb/UnpackedTarball_hsqldb.mk
++++ b/external/hsqldb/UnpackedTarball_hsqldb.mk
+@@ -27,6 +27,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,hsqldb,\
+ 	$(if $(HSQLDB_USE_JDBC_4_1),\
+ 		external/hsqldb/patches/jdbc-4.1.patch \
+ 	) \
++	external/hsqldb/patches/disable-dump-script.patch \
+ ))
+ 
+ # vim: set noet sw=4 ts=4:
+diff --git a/external/hsqldb/patches/disable-dump-script.patch b/external/hsqldb/patches/disable-dump-script.patch
+new file mode 100644
+index 0000000..401dd38
+--- /dev/null
++++ b/external/hsqldb/patches/disable-dump-script.patch
+@@ -0,0 +1,14 @@
++--- a/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 11:08:11.297243034 +0000
+++++ b/hsqldb/src/org/hsqldb/DatabaseCommandInterpreter.java	2023-02-13 13:49:17.973089433 +0000
++@@ -403,6 +403,11 @@
++                     throw Trace.error(Trace.INVALID_IDENTIFIER);
++                 }
++ 
+++                // added condition to avoid execution of spurious command in .script or .log file
+++                if (session.isProcessingScript() || session.isProcessingLog()) {
+++                    return new Result(ResultConstants.UPDATECOUNT);
+++                }
+++
++                 dsw = new ScriptWriterText(database, token, true, true, true);
++ 
++                 dsw.writeAll();
+-- 
+2.44.0
+
diff --git a/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch b/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
new file mode 100644
index 0000000000000000000000000000000000000000..16dac7f910f3d795347551cf77c12a8020c154de
--- /dev/null
+++ b/0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
@@ -0,0 +1,84 @@
+From 0ef6d568922ea3ff852310e87f813074d3029e88 Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Fri, 17 Feb 2023 12:03:54 +0100
+Subject: [PATCH] Stack check safety belt before fishing in muddy waters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Have it hit hard in debug builds.
+
+Change-Id: I9ea54844a0661fd7a75616a2876983a74b2d5bad
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147205
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 9d91fbba6f374fa1c10b38eae003da89bd4e6d4b)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147245
+Reviewed-by: Caolán McNamara <caolanm@redhat.com>
+(cherry picked from commit 166a07062dd4ffedca6106f439a6fcddaeee5eb5)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147391
+Tested-by: Michael Stahl <michael.stahl@allotropia.de>
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit f8efb098f2abbf054a15dcf7daaaacfa575685ae)
+
+erAck: backported to 5.3.6.1
+---
+ sc/source/core/inc/interpre.hxx  | 12 ++++++++++++
+ sc/source/core/tool/interpr1.cxx |  4 ++--
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/sc/source/core/inc/interpre.hxx b/sc/source/core/inc/interpre.hxx
+index 636f2ec..934b253 100644
+--- a/sc/source/core/inc/interpre.hxx
++++ b/sc/source/core/inc/interpre.hxx
+@@ -220,6 +220,7 @@ private:
+ inline bool MustHaveParamCount( short nAct, short nMust );
+ inline bool MustHaveParamCount( short nAct, short nMust, short nMax );
+ inline bool MustHaveParamCountMin( short nAct, short nMin );
++inline bool MustHaveParamCountMinWithStackCheck( short nAct, short nMin );
+ void PushParameterExpected();
+ void PushIllegalParameter();
+ void PushIllegalArgument();
+@@ -1032,6 +1033,17 @@ inline bool ScInterpreter::MustHaveParamCountMin( short nAct, short nMin )
+     return false;
+ }
+ 
++inline bool ScInterpreter::MustHaveParamCountMinWithStackCheck( short nAct, short nMin )
++{
++    assert(sp >= nAct);
++    if (sp < nAct)
++    {
++        PushParameterExpected();
++        return false;
++    }
++    return MustHaveParamCountMin( nAct, nMin);
++}
++
+ inline bool ScInterpreter::CheckStringPositionArgument( double & fVal )
+ {
+     if (!rtl::math::isFinite( fVal))
+diff --git a/sc/source/core/tool/interpr1.cxx b/sc/source/core/tool/interpr1.cxx
+index 22ae915..002f6ca 100644
+--- a/sc/source/core/tool/interpr1.cxx
++++ b/sc/source/core/tool/interpr1.cxx
+@@ -6659,7 +6659,7 @@ void ScInterpreter::ScVLookup()
+ void ScInterpreter::ScSubTotal()
+ {
+     sal_uInt8 nParamCount = GetByte();
+-    if ( MustHaveParamCountMin( nParamCount, 2 ) )
++    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 2 ) )
+     {
+         // We must fish the 1st parameter deep from the stack! And push it on top.
+         const FormulaToken* p = pStack[ sp - nParamCount ];
+@@ -6706,7 +6706,7 @@ void ScInterpreter::ScSubTotal()
+ void ScInterpreter::ScAggregate()
+ {
+     sal_uInt8 nParamCount = GetByte();
+-    if ( MustHaveParamCountMin( nParamCount, 3 ) )
++    if ( MustHaveParamCountMinWithStackCheck( nParamCount, 3 ) )
+     {
+         // fish the 1st parameter from the stack and push it on top.
+         const FormulaToken* p = pStack[ sp - nParamCount ];
+-- 
+2.44.0
+
diff --git a/0003-Always-push-a-result-even-if-it-s-only-an-error.patch b/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f68e790d51fec65f92a4f8cd8b43d1e6a02786ca
--- /dev/null
+++ b/0003-Always-push-a-result-even-if-it-s-only-an-error.patch
@@ -0,0 +1,52 @@
+From d8dea30b52fc6c787443e09f2872b24ef0d4f159 Mon Sep 17 00:00:00 2001
+From: Eike Rathke <erack@redhat.com>
+Date: Mon, 27 Feb 2023 16:10:06 +0100
+Subject: [PATCH] Always push a result, even if it's only an error
+
+PERCENTILE() and QUARTILE() if an error was passed as argument (or
+an error encountered during obtaining arguments) omitted to push
+an error result, only setting the error.
+
+Fallout from
+
+    commit f336f63da900d76c2bf6e5690f1c8a7bd15a0aa2
+    CommitDate: Thu Mar 3 16:28:59 2016 +0000
+
+        tdf#94635 Add FORECAST.ETS functions to Calc
+
+Change-Id: I23e276fb0ce735cfd6383cc963446499dcf819f4
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/147922
+Reviewed-by: Eike Rathke <erack@redhat.com>
+Tested-by: Jenkins
+(cherry picked from commit 64914560e279c71ff1233f4bab851e2a292797e6)
+
+erAck: backported to 5.3.6.1
+---
+ sc/source/core/tool/interpr3.cxx | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sc/source/core/tool/interpr3.cxx b/sc/source/core/tool/interpr3.cxx
+index 77767f8..cdac1f6 100644
+--- a/sc/source/core/tool/interpr3.cxx
++++ b/sc/source/core/tool/interpr3.cxx
+@@ -3392,7 +3392,7 @@ void ScInterpreter::ScPercentile( bool bInclusive )
+     GetNumberSequenceArray( 1, aArray, false );
+     if ( aArray.empty() || aArray.size() == 0 || nGlobalError != FormulaError::NONE )
+     {
+-        SetError( FormulaError::NoValue );
++        PushNoValue();
+         return;
+     }
+     if ( bInclusive )
+@@ -3415,7 +3415,7 @@ void ScInterpreter::ScQuartile( bool bInclusive )
+     GetNumberSequenceArray( 1, aArray, false );
+     if ( aArray.empty() || aArray.size() == 0 || nGlobalError != FormulaError::NONE )
+     {
+-        SetError( FormulaError::NoValue );
++        PushNoValue();
+         return;
+     }
+     if ( bInclusive )
+-- 
+2.44.0
+
diff --git a/0168229624cfac409e766913506961a8-ucpp-1.3.2.tar.gz b/0168229624cfac409e766913506961a8-ucpp-1.3.2.tar.gz
deleted file mode 100644
index 2a64a8900face6e72c31766aeccd4aa5616d83a9..0000000000000000000000000000000000000000
Binary files a/0168229624cfac409e766913506961a8-ucpp-1.3.2.tar.gz and /dev/null differ
diff --git a/86b1daaa438f5a7bea9a52d7b9799ac0-xmlsec1-1.2.23.tar.gz b/86b1daaa438f5a7bea9a52d7b9799ac0-xmlsec1-1.2.23.tar.gz
deleted file mode 100644
index 08844595d6b4b2d2fcf39843f68503945984aa8a..0000000000000000000000000000000000000000
Binary files a/86b1daaa438f5a7bea9a52d7b9799ac0-xmlsec1-1.2.23.tar.gz and /dev/null differ
diff --git a/dist b/dist
new file mode 100644
index 0000000000000000000000000000000000000000..ad8eb77ba59be071474988a034571694eaa9db8e
--- /dev/null
+++ b/dist
@@ -0,0 +1 @@
+an7_9
diff --git a/download b/download
new file mode 100644
index 0000000000000000000000000000000000000000..9097f384cfd6b70240a92f63e0971e28fbc39552
--- /dev/null
+++ b/download
@@ -0,0 +1,5 @@
+0168229624cfac409e766913506961a8  0168229624cfac409e766913506961a8-ucpp-1.3.2.tar.gz
+86b1daaa438f5a7bea9a52d7b9799ac0  86b1daaa438f5a7bea9a52d7b9799ac0-xmlsec1-1.2.23.tar.gz
+361153226d8c6b4058355cf7cffe297b  libreoffice-5.3.6.1.tar.xz
+c942f959691de14af571ec88986dd5d7  libreoffice-help-5.3.6.1.tar.xz
+e608fe5cd446835ee311fc6ac9629b33  libreoffice-translations-5.3.6.1.tar.xz
diff --git a/libreoffice-5.3.6.1.tar.xz b/libreoffice-5.3.6.1.tar.xz
deleted file mode 100644
index 7c1cd826e415184501efffc5f149cca4e02c63cf..0000000000000000000000000000000000000000
Binary files a/libreoffice-5.3.6.1.tar.xz and /dev/null differ
diff --git a/libreoffice-help-5.3.6.1.tar.xz b/libreoffice-help-5.3.6.1.tar.xz
deleted file mode 100644
index 4b6358eed24f99294edef2d2f3887a749252cd11..0000000000000000000000000000000000000000
Binary files a/libreoffice-help-5.3.6.1.tar.xz and /dev/null differ
diff --git a/libreoffice-translations-5.3.6.1.tar.xz b/libreoffice-translations-5.3.6.1.tar.xz
deleted file mode 100644
index c776133bcfdad3281005fc720644379e4f8c812f..0000000000000000000000000000000000000000
Binary files a/libreoffice-translations-5.3.6.1.tar.xz and /dev/null differ
diff --git a/libreoffice.spec b/libreoffice.spec
index edc3e03034bfe1889d1af9a9fab45e63124ae22f..ca94ba47d2f505999ab6554e3c32c000ee8f32d8 100644
--- a/libreoffice.spec
+++ b/libreoffice.spec
@@ -57,7 +57,7 @@ Summary:        Free Software Productivity Suite
 Name:           libreoffice
 Epoch:          1
 Version:        %{libo_version}.1
-Release:        25%{?libo_prerelease}%{?dist}
+Release:        26%{?libo_prerelease}%{?dist}
 License:        (MPLv1.1 or LGPLv3+) and LGPLv3 and LGPLv2+ and BSD and (MPLv1.1 or GPLv2 or LGPLv2 or Netscape) and Public Domain and ASL 2.0 and Artistic and MPLv2.0 and CC0
 URL:            http://www.libreoffice.org/
 
@@ -291,6 +291,12 @@ Patch61: CVE-2019-9854.patch
 Patch62: CVE-2019-9855.patch
 Patch63: 0001-rhbz-1728763-bg-of-blocks-is-black.patch
 Patch64: 0001-Resolves-rhbz-1900004-Support-Red-Hat-Inc.-as-Java-v.patch
+Patch65: 0001-CVE-2022-38745.patch
+Patch66: 0001-Obtain-actual-0-parameter-count-for-OR-AND-and-1-par.patch
+Patch67: 0002-Stack-check-safety-belt-before-fishing-in-muddy-wate.patch
+Patch68: 0003-Always-push-a-result-even-if-it-s-only-an-error.patch
+Patch69: 0001-disable-script-dump.patch
+Patch70: 0001-CVE-2023-6185-escape-url-passed-to-gstreamer.patch
 
 %if 0%{?rhel}
 # not upstreamed
@@ -1067,6 +1073,10 @@ git am %{patches}
 
 sed -i -e /CppunitTest_sw_ooxmlexport7/d sw/Module_sw.mk
 sed -i -e /CppunitTest_sd_import_tests/d sd/Module_sd.mk
+# Broken with system nss. See also upstream commit ac519af951541b7313a4c98e1bee463bf47356be
+sed -i -e '/^\s*CPPUNIT_TEST(testInsertCertificate_PEM_ODT);/d' desktop/qa/desktop_lib/test_desktop_lib.cxx
+sed -i -e '/^\s*CPPUNIT_TEST(testInsertCertificate_PEM_DOCX);/d' desktop/qa/desktop_lib/test_desktop_lib.cxx
+
 git commit -q -a -m 'temporarily disable failing tests'
 
 # Seeing .git dir makes some of the build tools change their behavior.
@@ -2353,6 +2363,12 @@ done
 %{_includedir}/LibreOfficeKit
 
 %changelog
+* Fri May 17 2024 Eike Rathke <erack@redhat.com> - 1:5.3.6.1-26
+- Fix CVE-2022-38745 Empty entry in Java class path
+- Fix CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing
+- Fix CVE-2023-1183 libreoffice: Arbitrary File Write
+- Fix CVE-2023-6185 escape url passed to gstreamer
+
 * Tue Dec 01 2020 Stephan Bergmann <sbergman@redhat.com> - 1:5.3.6.1-25
 - Resolves: rhbz#1900004 Support Red Hat, Inc. as Java vendor