libexif (0.6.21-6ubuntu0.4) focal-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-0452.patch: fixed a incorrect overflow check that could be
      optimized away in libexif/exif-entry.c.
    - CVE-2020-0452

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Fri, 06 Nov 2020 12:14:21 -0300

libexif (0.6.21-6ubuntu0.3) focal-security; urgency=medium

  * SECURITY UPDATE: Out of bounds read
    - debian/patches/CVE-2020-0093.patch: fix read
      buffer overflow making sure the number of bytes being
      copied from does not exceed the source buffer size in
      libexif/exif-data.c.
    - CVE-2020-0093
  * SECURITY UPDATE: Out of bounds read
    - debian/patches/CVE-2020-13112.patch: fix MakerNote tag size
      overflow check for a size overflow while reading tags in
      libexif/canon/exif-mnote-data-canon.c,
      libexif/fuji/exif/mnote-data-fuji.c,
      libexif/olympus/exif-mnote-data-olympus.c,
      libexif/pentax/exif-mnote-data-pentax.c.
    - CVE-2020-13112
  * SECURITY UPDATE: Possibly crash and potential use-after-free
    - debian/patches/CVE-2020-13113.patch: ensures that an uninitialized
      pointer is not dereferenced later in the case where the number of
      components is 0 in libexif/canon/exif-mnote-data-canon.c,
      libexif/fuji/exif-mnote-data-fuji.c,
      libexif/olympus/exif-mnote-data-olympus.c,
      libexif/pentax/exif-mnote-data-pentax.
    - CVE-2020-13113
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2020-13114.patch: add a failsafe on the
      maximum number of Canon MakerNote subtags in
      libexif/canon/exif-mnote-data-canon.c.
    - CVE-2020-13114
  * SECURITY UPDATE: Out of bounds read
    - debian/patches/CVE-2020-0182.patch: fix a buffer read
      overflow in exif_entry_get_value in libexif/exif-entry.c.
    - CVE-2020-0182
  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2020-0198.patch: fix unsigned integer overflow
      in libexif/exif-data.c.
    - CVE-2020-0198

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 08 Jun 2020 11:55:38 -0300

libexif (0.6.21-6ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: Divinding by zero vulnerability
    - debian/patches/CVE-2020-12767.patch: check if d variable is not zeroed
      before use it in libexif/exif-entry.c
    - CVE-2020-12767

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 11 May 2020 13:50:50 -0300

libexif (0.6.21-6) unstable; urgency=medium

  * Team upload.
  * Acknowledge NMU by Salvatore Bonaccorso.
  * debian/changelog: Remove trailing whitespace.
  * debian/control:
    - Build-Depend on debhelper-compat (=12).
    - Raise Standards-Version to 4.5.0 from 4.1.3 (no changes needed).
    - Declare Rules-Requires-Root: no.
  * debian/patches: Add upstream patches by Marcus Meissner:
    - Avoid the use of unsafe integer overflow checking constructs
      (CVE-2019-9278) (Closes: #945948).
    - Avoid implicit behaviour by casting to unsigned int before shifting left.
  * debian/rules: Do not manually install libexif.pc into a multi-arch libdir.
  * libexif12.symbols: Specify libexif-dev in the Build-Depends-Package
      meta-information field.
  * Add Debian upstream/metadata file.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Thu, 23 Jan 2020 20:03:01 +1100

libexif (0.6.21-5.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Reduce maximum recursion depth in exif_data_load_data_content
  * Improve deep recursion detection in exif_data_load_data_content
    (CVE-2018-20030) (Closes: #918730)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 10 Feb 2019 14:59:33 +0100

libexif (0.6.21-5) unstable; urgency=medium

  * Team upload.
  * debhelper update:
    - Update package compatibility to level 11.
  * debian/changelog:
    - Remove trailing whitespace.
  * debian/control:
    - Build-Depend on debhelper version 11.
    - Raise Standards-Version from 4.1.1 to 4.1.3 (no changes needed).
    - Update the Homepage field to point to https://libexif.github.io
      (Closes: #894183).
    - Update the Vcs fields to point to https://salsa.debian.org.
  * debian/copyright:
    - Update the Source URL field to point to https://libexif.github.io.
  * debian/patches:
    - Add .patch file extensions to existing patches.
    - add-am_prog_ar.patch: Add the AM_PROG_AR macro to configure.ac to avoid
      an automake warning.
    - ac_lang_source-macro.patch: Use AC_LANG_SOURCE macros to avoid several
      automake warnings in configure.ac.
    - fix-size_t-warnings.patch: Cast %u format specifiers to unsigned long to
      prevent compiler warnings on 32-bit and 64-bit platforms.
  * debian/rules:
    - Update dh_installdocs overrides.
    - Remove '--parallel' (now handled by debhelper >= level 11).
  * debian/source/options:
    - Remove from package. Debhelper handles the specified options by default.
  * debian/watch:
    - Update to version 4 and switch to upstream's github repository.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Tue, 03 Apr 2018 22:53:18 +1000

libexif (0.6.21-4) unstable; urgency=high

  * Team upload.
  * debian/control:
    - Allow libexif-doc to take ownership of all documentation files
      previously packaged with libexif-dev (Closes: #880213).
    - Remove the Replaces field from libexif12 and libexif-dev.
  * debian/rules:
    - Include /usr/share/dpkg/architecture.mk.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Thu, 02 Nov 2017 22:31:00 +1100

libexif (0.6.21-3) unstable; urgency=medium

  * Team upload.
  * Import changes from NMU version 0.6.21-2.1.
  * Introduce libexif-doc:
    - Move the development documentation from libexif-dev to
      avoid PNG file conflicts during multi-arch installation.
    - Update the package's doc-base registration.
  * debian/control:
    - Revise package order.
    - Update package Depends lists.
  * debian/copyright:
    - Fix a formatting error.
  * debian/rules:
    - Exclude doxygen md5 files from installation during the
      'dh_installdocs' phase.
  * Do not package the AUTHORS file, since all developers are
    listed in the debian/copyright file.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Fri, 27 Oct 2017 21:29:37 +1100

libexif (0.6.21-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * debhelper update:
    - Update package compatibility to level 10.
  * debian/control:
    - Bump debhelper build-dep to >= 10~.
    - Remove dh-autoreconf from the Build-Depends list, as debhelper
      enables the 'autoreconf' sequence by default.
    - Bump Standards-Version from 3.9.5 to 4.1.1.
    - Use the https protocol in the Vcs-Browser field.
    - Update the URI referenced by the Vcs-Git field.
    - Mark libexif-dev Multi-Arch: same (Closes: #786562).
  * debian/copyright:
    - Update the format specification URI.
    - Remove references to libjpeg/* and configure.in (lintian).
    - Merge paragraphs referring to the same source file (lintian).
  * debian/patches:
    - Add upstream patches to fix CVE-2016-6328 and CVE-2017-7544
      (thanks to Marcus Meissner) (Closes: #873022, #876466).
  * debian/rules:
    - Add 'hardening=+all' to DEB_BUILD_MAINT_OPTIONS.
    - Exclude doxygen md5 files from installation (lintian).
    - Remove '--with autoreconf' (now handled by debhelper level 10).
    - Fix grammatical errors in a comment.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Sat, 07 Oct 2017 22:42:00 +1100

libexif (0.6.21-2) unstable; urgency=medium

  * Use autoreconf instead of autotools-dev (Closes: #754399)
  * Bump Standards-Version to 3.9.5
  * Add symbols file for libexif12
  * Enable parallel building

 -- Emmanuel Bouthenot <kolter@debian.org>  Sun, 24 Aug 2014 21:34:56 +0200

# For older changelog entries, run 'apt-get changelog libexif-doc'
