Security update: Add xpm-secfix-thomas.diff to fix many issues, including: integer...

Security update: Add xpm-secfix-thomas.diff to fix many issues, including: integer issues resulting in infinite loops and buffer overflows; a one-byte buffer overflow; stack-based overflows with sprintf() and string functions; replaces popen() with s_popen(); path traversal issues; buffer underruns; and memory leaks (missing free(), found by Egbert Eich). Patch by Thomas Biege and Matthiew Herrb.