diff -Nru libcaca-0.99.beta19/debian/changelog libcaca-0.99.beta19/debian/changelog
--- libcaca-0.99.beta19/debian/changelog	2018-04-03 12:31:55.000000000 +0000
+++ libcaca-0.99.beta19/debian/changelog	2019-01-14 16:31:16.000000000 +0000
@@ -1,3 +1,23 @@
+libcaca (0.99.beta19-2ubuntu0.18.04.1) bionic-security; urgency=medium
+
+  * SECURITY UPDATE: Floating point exception
+    - debian/patches/CVE-2018-20544.patch: fix in
+      caca/dither.c.
+    - CVE-2018-20544
+  * SECURITY UPDATE: Buffer over-write
+    - debian/patches/CVE-2018-20545_20548_20549.patch:
+      fix in src/common-image.h.
+    - CVE-2018-20545
+    - CVE-2018-20548
+    - CVE-2018-20549
+  * SECURITY UPDATE: Buffer over-read
+    - debian/patches/CVE-2018-20546_20547.patch: fix in
+      caca/dither.c.
+    - CVE-2018-20546
+    - CVE-2018-20547
+
+ -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 14 Jan 2019 13:31:16 -0300
+
 libcaca (0.99.beta19-2build2~gcc5.3) bionic; urgency=high
 
   * No change rebuild to pick up -fPIE compiler default
diff -Nru libcaca-0.99.beta19/debian/patches/CVE-2018-20544.patch libcaca-0.99.beta19/debian/patches/CVE-2018-20544.patch
--- libcaca-0.99.beta19/debian/patches/CVE-2018-20544.patch	1970-01-01 00:00:00.000000000 +0000
+++ libcaca-0.99.beta19/debian/patches/CVE-2018-20544.patch	2019-01-14 16:30:29.000000000 +0000
@@ -0,0 +1,45 @@
+From 84bd155087b93ab2d8d7cb5b1ac94ecd4cf4f93c Mon Sep 17 00:00:00 2001
+From: Sam Hocevar <sam@hocevar.net>
+Date: Sat, 29 Dec 2018 22:13:56 +0100
+Subject: [PATCH] dither: fix integer overflows that were causing a division by
+ zero.
+
+Fixes: #36 (CVE-2018-20544)
+---
+ caca/dither.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/caca/dither.c b/caca/dither.c
+index 04b678e0..c6ebab1b 100644
+--- a/caca/dither.c
++++ b/caca/dither.c
+@@ -991,10 +991,10 @@ int caca_dither_bitmap(caca_canvas_t *cv, int x, int y, int w, int h,
+         /* First get RGB */
+         if(d->antialias)
+         {
+-            fromx = (x - x1) * w / deltax;
+-            fromy = (y - y1) * h / deltay;
+-            tox = (x - x1 + 1) * w / deltax;
+-            toy = (y - y1 + 1) * h / deltay;
++            fromx = (uint64_t)(x - x1) * w / deltax;
++            fromy = (uint64_t)(y - y1) * h / deltay;
++            tox = (uint64_t)(x - x1 + 1) * w / deltax;
++            toy = (uint64_t)(y - y1 + 1) * h / deltay;
+ 
+             /* We want at least one pixel */
+             if(tox == fromx) tox++;
+@@ -1017,10 +1017,10 @@ int caca_dither_bitmap(caca_canvas_t *cv, int x, int y, int w, int h,
+         }
+         else
+         {
+-            fromx = (x - x1) * w / deltax;
+-            fromy = (y - y1) * h / deltay;
+-            tox = (x - x1 + 1) * w / deltax;
+-            toy = (y - y1 + 1) * h / deltay;
++            fromx = (uint64_t)(x - x1) * w / deltax;
++            fromy = (uint64_t)(y - y1) * h / deltay;
++            tox = (uint64_t)(x - x1 + 1) * w / deltax;
++            toy = (uint64_t)(y - y1 + 1) * h / deltay;
+ 
+             /* tox and toy can overflow the canvas, but they cannot overflow
+              * when averaged with fromx and fromy because these are guaranteed
diff -Nru libcaca-0.99.beta19/debian/patches/CVE-2018-20545_20458_20549.patch libcaca-0.99.beta19/debian/patches/CVE-2018-20545_20458_20549.patch
--- libcaca-0.99.beta19/debian/patches/CVE-2018-20545_20458_20549.patch	1970-01-01 00:00:00.000000000 +0000
+++ libcaca-0.99.beta19/debian/patches/CVE-2018-20545_20458_20549.patch	2019-01-14 16:30:35.000000000 +0000
@@ -0,0 +1,23 @@
+Backported of:
+
+From 3e52dabe3e64dc50f4422effe364a1457a8a8592 Mon Sep 17 00:00:00 2001
+From: Sam Hocevar <sam@hocevar.net>
+Date: Sat, 29 Dec 2018 22:35:07 +0100
+Subject: [PATCH] img2txt: fix an integer overflow in the BMP loader.
+
+Fixes: #37 (CVE-2018-20545)
+Fixes: #40 (CVE-2018-20548)
+Fixes: #41 (CVE-2018-20549)
+diff --git a/src/common-image.h b/src/common-image.h
+index efc6069..1b99302 100644
+--- a/src/common-image.h
++++ b/src/common-image.h
+@@ -13,7 +13,7 @@
+ struct image
+ {
+     char *pixels;
+-    unsigned int w, h;
++    size_t w, h;
+     struct caca_dither *dither;
+     void *priv;
+ };
diff -Nru libcaca-0.99.beta19/debian/patches/CVE-2018-20546_20547.patch libcaca-0.99.beta19/debian/patches/CVE-2018-20546_20547.patch
--- libcaca-0.99.beta19/debian/patches/CVE-2018-20546_20547.patch	1970-01-01 00:00:00.000000000 +0000
+++ libcaca-0.99.beta19/debian/patches/CVE-2018-20546_20547.patch	2019-01-14 16:30:42.000000000 +0000
@@ -0,0 +1,23 @@
+Backported of:
+
+From 02a09ec9e5ed8981e7a810bfb6a0172dc24f0790 Mon Sep 17 00:00:00 2001
+From: Sam Hocevar <sam@hocevar.net>
+Date: Sun, 30 Dec 2018 13:18:27 +0100
+Subject: [PATCH] dither: fix integer multiplication overflow that caused
+ crashes.
+
+Fixes: #38 (CVE-2018-20546)
+Fixes: #39 (CVE-2018-20547)
+diff --git a/caca/dither.c b/caca/dither.c
+index 17218b1..fb802da 100644
+--- a/caca/dither.c
++++ b/caca/dither.c
+@@ -116,7 +116,7 @@ enum color_mode
+ struct caca_dither
+ {
+     int bpp, has_palette, has_alpha;
+-    int w, h, pitch;
++    size_t w, h, pitch;
+     int rmask, gmask, bmask, amask;
+     int rright, gright, bright, aright;
+     int rleft, gleft, bleft, aleft;
diff -Nru libcaca-0.99.beta19/debian/patches/series libcaca-0.99.beta19/debian/patches/series
--- libcaca-0.99.beta19/debian/patches/series	2014-05-16 19:30:34.000000000 +0000
+++ libcaca-0.99.beta19/debian/patches/series	2019-01-14 16:30:42.000000000 +0000
@@ -1,2 +1,5 @@
 100_doxygen.diff
 200_glut_header.diff
+CVE-2018-20544.patch
+CVE-2018-20545_20458_20549.patch
+CVE-2018-20546_20547.patch