avahi (0.8-18ubuntu1.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-34933-1.patch: core: refuse to accept
      publish flags where both wide_area and multicast are set
    - debian/patches/CVE-2026-34933-2.patch: tests: make sure
      AVAHI_PUBLISH_USE_WIDE_AREA is refused
    - CVE-2026-34933

 -- Allen Huang <allen.huang@canonical.com>  Tue, 05 May 2026 13:28:46 +0100

avahi (0.8-18ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2142150). Remaining changes:
    - avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
      avahi-client-fix-resource-leak.patch: Issues discovered by static
      analysis (Upstream pull request #202)
    - SECURITY UPDATE: Reachable assertions exist in domain functions in
      avahi-common
      + debian/patches/CVE-2023-38470-2.patch: bail out when escaped
        labels can't fit into ret
      + CVE-2023-38470
    - SECURITY UPDATE: Reachable assertions exist in server functions in
      avahi-core
      + debian/patches/CVE-2023-38471-2.patch: core: return errors from
        avahi_server_set_host_name properly
      + CVE-2023-38471
  * Dropped changes applied upstream:
    - SECURITY UPDATE: Denial of service when creating a record browser.
      + debian/patches/CVE-2025-68276.patch: Add AVAHI_LOOKUP_USE_WIDE_AREA and
        wide area use check in avahi-core/browse.c.
      + CVE-2025-68276
    - SECURITY UPDATE: Denial of service after CNAME expiration.
      + debian/patches/CVE-2025-68468.patch: Remove assert in
        avahi-core/browse.c.
      + CVE-2025-68468
    - SECURITY UPDATE: Denial of service on receiving CNAME resource records.
      + debian/patches/CVE-2025-68471.patch: Change assert to return on
        wide_area check in avahi-core/browse.c.
      + CVE-2025-68471

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Tue, 17 Feb 2026 21:26:06 -0800

avahi (0.8-18) unstable; urgency=medium

  [ Simon McVittie ]
  * d/copyright: Don't quote the FSF's former postal address here

  [ Michael Biebl ]
  * core: refuse to create wide-area record browsers when wide-area is off.
    Patch cherry-picked from upstream Git
    CVE-2025-68276 (Closes: #1125417)
  * core: fix DoS bug by removing incorrect assertion.
    Patch cherry-picked from upstream Git
    CVE-2025-68468 (Closes: #1125418)
  * core: fix DoS bug by changing assert to return.
    Patch cherry-picked from upstream Git
    CVE-2025-68471 (Closes: #1125419)
  * core: fix uncontrolled recursion bug using a simple loop detection
    algorithm.
    Patch cherry-picked from upstream Git
    CVE-2026-24401 (Closes: #1126342)
  * Randomize transaction IDs in wide area queries.
    Patch cherry-picked from upstream Git.
    CVE-2024-52616 (Closes: #1088111)
  * Bump Standards-Version to 4.7.3

 -- Michael Biebl <biebl@debian.org>  Sun, 01 Feb 2026 16:54:47 +0100

avahi (0.8-17ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: Denial of service when creating a record browser.
    - debian/patches/CVE-2025-68276.patch: Add AVAHI_LOOKUP_USE_WIDE_AREA and
      wide area use check in avahi-core/browse.c.
    - CVE-2025-68276
  * SECURITY UPDATE: Denial of service after CNAME expiration.
    - debian/patches/CVE-2025-68468.patch: Remove assert in
      avahi-core/browse.c.
    - CVE-2025-68468
  * SECURITY UPDATE: Denial of service on receiving CNAME resource records.
    - debian/patches/CVE-2025-68471.patch: Change assert to return on
      wide_area check in avahi-core/browse.c.
    - CVE-2025-68471

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 19 Jan 2026 13:55:55 -0330

avahi (0.8-17ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2130121). Remaining changes:
    - avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
      avahi-client-fix-resource-leak.patch: Issues discovered by static
      analysis (Upstream pull request #202)
    - SECURITY UPDATE: Reachable assertions exist in domain functions in
      avahi-common
      + debian/patches/CVE-2023-38470-2.patch: bail out when escaped
        labels can't fit into ret
      + CVE-2023-38470
    - SECURITY UPDATE: Reachable assertions exist in server functions in
      avahi-core
      + debian/patches/CVE-2023-38471-2.patch: core: return errors from
        avahi_server_set_host_name properly
      + CVE-2023-38471
  * Dropped changes applied upstream:
    - d/t/local-resolve-service: Add non-superficial DEP-8 test, which validates
      resolving of mDNS .local domains and service discovery. (LP #2103699)

 -- Ural Tunaboyu <ural.tunaboyu@canonical.com>  Tue, 02 Dec 2025 16:15:49 -0800

avahi (0.8-17) unstable; urgency=medium

  * Team upload

  [ Lukas Märdian ]
  * d/t/local-resolve-service: Add non-superficial DEP-8 test, which
    validates resolving of mDNS .local domains and service discovery

  [ Simon McVittie ]
  * d/control: Build-depend on gobject-introspection, gir1.2-*-dev.
    libgirepository1.0-dev is non-multiarch-friendly and should be phased
    out during the forky cycle.
  * Add patch from upstream 0.9-rc2 to turn off wide-area by default.
    (Mitigates: CVE-2024-52615, CVE-2024-52616, #1088110, #1088111)
  * Standards-Version: 4.7.2 (no changes required)

 -- Simon McVittie <smcv@debian.org>  Tue, 09 Sep 2025 10:24:58 +0100

avahi (0.8-16ubuntu3) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Wed, 03 Sep 2025 15:02:42 +0000

avahi (0.8-16ubuntu2) plucky; urgency=medium

  * d/t/local-resolve-service: Add non-superficial DEP-8 test, which validates
    resolving of mDNS .local domains and service discovery. (LP: #2103699)

 -- Lukas Märdian <slyon@ubuntu.com>  Thu, 20 Mar 2025 10:56:21 +0100

avahi (0.8-16ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2098794). Remaining changes:
    - avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
      avahi-client-fix-resource-leak.patch: Issues discovered by static
      analysis (Upstream pull request #202)
    - SECURITY UPDATE: Reachable assertions exist in domain functions in
      avahi-common
      + debian/patches/CVE-2023-38470-2.patch: bail out when escaped
        labels can't fit into ret
      + CVE-2023-38470
    - SECURITY UPDATE: Reachable assertions exist in server functions in
      avahi-core
      + debian/patches/CVE-2023-38471-2.patch: core: return errors from
        avahi_server_set_host_name properly
      + CVE-2023-38471
  * Dropped changes, no longer needed:
    - Disable lto, see https://bugzilla.redhat.com/show_bug.cgi?id=1907727
      [Fixed in 0.8-16]

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Tue, 18 Feb 2025 16:22:58 -0300

avahi (0.8-16) unstable; urgency=medium

  * Stop using embedded copy of sd-daemon.{c,h} and use libsystemd instead.
    Fixes build failures with LTO enabled.
    This adds a Build-Depends on libsystemd-dev on linux-any.
    Patch cherry-picked from upstream Git.

 -- Michael Biebl <biebl@debian.org>  Sat, 04 Jan 2025 20:59:52 +0100

avahi (0.8-15) unstable; urgency=medium

  * Fix "Invalid service type" failures using an upstream patch.
    The initial patch to address 'avahi-browse -a breaks with "Invalid service
    type" if a device sends a malformed service' that was applied to Debian
    was not accepted upstream but solved differently. Use that upstream patch
    instead.
  * Remove inactive Maintainers from Uploaders.
    Thanks Loic and Sebastian!
  * Add Origin metadata according to DEP-3 for patches that have been cherry
    picked

 -- Michael Biebl <biebl@debian.org>  Wed, 04 Dec 2024 14:50:18 +0100

avahi (0.8-14ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2090963). Remaining changes:
    - Disable lto, see https://bugzilla.redhat.com/show_bug.cgi?id=1907727
    - avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
      avahi-client-fix-resource-leak.patch: Issues discovered by static
      analysis (Upstream pull request #202)
    - SECURITY UPDATE: Reachable assertions exist in domain functions in
      avahi-common
      + debian/patches/CVE-2023-38470-2.patch: bail out when escaped
        labels can't fit into ret
      + CVE-2023-38470
    - SECURITY UPDATE: Reachable assertions exist in server functions in
      avahi-core
      + debian/patches/CVE-2023-38471-2.patch: core: return errors from
        avahi_server_set_host_name properly
      + CVE-2023-38471
  * Dropped changes, included in Debian:
    - SECURITY UPDATE: Reachable assertions exist in server functions of
      avahi-core
      + debian/patches/CVE-2023-38469-1.patch: reject overly long TXT
        resource records
      + debian/patches/CVE-2023-38469-2.patch: tests: pass overly long TXT
        resource records
      + CVE-2023-38469
    - SECURITY UPDATE: Reachable assertions exist in domain functions in
      avahi-common
      + debian/patches/CVE-2023-38470-1.patch: Ensure each label is at least
        one byte long
    - SECURITY UPDATE: Reachable assertions exist in server functions in
      avahi-core
      + debian/patches/CVE-2023-38471-1.patch: core: extract host name using
        avahi_unescape_label()
    - SECURITY UPDATE: Reachable assertions exist in dbus functions in
      avahi-daemon
      + debian/patches/CVE-2023-38472.patch: core: make sure there is rdata
        to process before parsing it
      + CVE-2023-38472
    - SECURITY UPDATE: Reachable assertions exist in alternative functions
      in avahi-common
      + debian/patches/CVE-2023-38473.patch: common: derive alternative host
        name from its unescaped version
      + CVE-2023-38473
  * Dropped changes, no longer needed:
    - avahi-autoipd: Demote isc-dhcp-client from Recommends to Suggests.
      Debian dropped isc-dhcp-client from Recommends altogether.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Tue, 03 Dec 2024 17:57:06 -0300

avahi (0.8-14) unstable; urgency=medium

  [ Simon McVittie ]
  * d/upstream/metadata: Add
  * d/watch: Use Github releases API
    (Closes: #1059615)
  * d/watch.devel: Add a secondary watch file that downloads release
    candidates.
    This is not used by default by infrastructure (we don't necessarily want
    to package every prerelease), but can be used via
    `uscan --watchfile debian/watch.devel`.
    Thanks to Marc Leeman
  * d/gbp.conf: Update packaging branch to debian/latest as per DEP-14
  * d/salsa-ci.yml: Add.
    Disable the cross-build test for now, this will need some more thought
    (perhaps building with nogir and/or nopython).

  [ Michael Biebl ]
  * Remove obsolete maintscript code from pre oldstable
  * Cleanup runtime / state directories more thoroughly on package purge.
    Those directories do not contain any valuable data that should be
    preserved beyond a package purge. So simplify the cleanup and do it more
    thoroughly by just removing all runtime and state files.
    While at it, correct an old changelog entry which referenced a wrong
    path. (Closes: #849454, #1051442)
  * Bump Standards-Version to 4.7.0
  * Drop isc-dhcp-client Recommends from avahi-autoipd.
    ISC DHCP client is no longer actively maintained, so stop recommending
    it. Still ship the integration hooks though for the time being.
    (Closes: #1064500)
  * avahi-discover: Fix invalid escape sequences.
    Patch cherry-picked from upstream Git. (Closes: #1085347)
  * core: make sure there is rdata to process before parsing it.
    Patch cherry-picked from upstream Git.
    (CVE-2023-38472, Closes: #1054879)
  * core: reject overly long TXT resource records.
    Patches cherry-picked from upstream Git.
    (CVE-2023-38469, Closes: #1054876)
  * Ensure each label is at least one byte long.
    Patch cherry-picked from upstream Git.
    (CVE-2023-38470, Closes: #1054877)
  * core: extract host name using avahi_unescape_label()
    Patch cherry-picked from upstream Git.
    (CVE-2023-38471, Closes: #1054878)
  * common: derive alternative host name from its unescaped version.
    Patch cherry-picked from upstream Git.
    (CVE-2023-38473, Closes: #1054880)

 -- Michael Biebl <biebl@debian.org>  Sat, 30 Nov 2024 22:54:34 +0100

avahi (0.8-13ubuntu6) noble; urgency=medium

  * avahi-autoipd: Demote isc-dhcp-client from Recommends to Suggests
    (LP: #2058242)

 -- Benjamin Drung <bdrung@ubuntu.com>  Fri, 05 Apr 2024 12:57:26 +0200

avahi (0.8-13ubuntu5) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 07:28:17 +0000

avahi (0.8-13ubuntu4) noble; urgency=medium

  * No-change rebuild against libglib2.0-0t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 11 Mar 2024 22:03:07 +0000

avahi (0.8-13ubuntu3) noble; urgency=medium

  * No-change rebuild against libglib2.0-0t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 08 Mar 2024 03:51:49 +0000

avahi (0.8-13ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: Reachable assertions exist in server functions of
    avahi-core
    - debian/patches/CVE-2023-38469-1.patch: reject overly long TXT
      resource records
    - debian/patches/CVE-2023-38469-2.patch: tests: pass overly long TXT
      resource records
    - CVE-2023-38469

  * SECURITY UPDATE: Reachable assertions exist in domain functions in
    avahi-common
    - debian/patches/CVE-2023-38470-1.patch: Ensure each label is at least
      one byte long
    - debian/patches/CVE-2023-38470-2.patch: bail out when escaped labels
      can't fit into ret
    - CVE-2023-38470

  * SECURITY UPDATE: Reachable assertions exist in server functions in
    avahi-core
    - debian/patches/CVE-2023-38471-1.patch: core: extract host name using
      avahi_unescape_label()
    - debian/patches/CVE-2023-38471-2.patch: core: return errors from
      avahi_server_set_host_name properly
    - CVE-2023-38471

  * SECURITY UPDATE: Reachable assertions exist in dbus functions in
    avahi-daemon
    - debian/patches/CVE-2023-38472.patch: core: make sure there is rdata
      to process before parsing it
    - CVE-2023-38472

  * SECURITY UPDATE: Reachable assertions exist in alternative functions
    in avahi-common
    - debian/patches/CVE-2023-38473.patch: common: derive alternative host
      name from its unescaped version
    - CVE-2023-38473

 -- Nick Galanis <nick.galanis@canonical.com>  Mon, 20 Nov 2023 13:51:34 +0200

avahi (0.8-13ubuntu1) noble; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Disable lto, see https://bugzilla.redhat.com/show_bug.cgi?id=1907727
    - avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
      avahi-client-fix-resource-leak.patch: Issues discovered by static analysis
      (Upstream pull request #202)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Thu, 16 Nov 2023 15:20:09 -0500

avahi (0.8-13) unstable; urgency=medium

  * Team upload
  * gir1.2-avahi-0.6: Make the Provides on gir1.2-avahicore-0.6 versioned.
    This will allow it to satisfy versioned dependencies on
    gir1.2-avahicore-0.6 (>= x).
  * libavahi-gobject-dev: Add Provides for the included GIR XML.
    To make cross-compiling and bootstrapping easier, the version of the
    gobject-introspection mini-policy currently in experimental asks for
    GIR XML to either be split into a gir1.2-x-y-dev package or have
    Provides on that name, so that dependent packages can add that package
    to their Build-Depends.
  * gir1.2-avahi-0.6, libavahi-gobject-dev: Add ${gir:Provides}.
    When built with the version of gobject-introspection currently in
    experimental, this will generate a Provides equivalent to the ones that
    are currently hard-coded.
  * libavahi-gobject-dev: Add ${gir:Depends}.
    Just for completeness: the only dependency is gir1.2-gobject-2.0, which
    all GObject-Introspection-based tools are expected to pull in as a
    dependency anyway.
  * d/control, d/rules: Implement nogir build profile.
    This allows src:avahi to be bootstrapped on new architectures before
    gobject-introspection has been compiled, breaking a cyclic dependency:
    gobject-introspection pulls in cairo, which indirectly Depends on
    the non-GObject parts of avahi (via cups and ghostscript).
    Disabling the entire libavahi-gobject-dev package is a bigger hammer
    than we would normally use, but it avoids a trip through NEW to split
    the package between C development files and a new gir1.2-avahi-0.6-dev
    binary package. (Closes: #1055437)

 -- Simon McVittie <smcv@debian.org>  Tue, 07 Nov 2023 10:54:25 +0000

avahi (0.8-12) unstable; urgency=medium

  * Team upload
  * Install the systemd unit in /usr/lib/systemd/system.
    This was allowed by Technical Committee resolution #1053901. avahi
    has not usually been backported, so it doesn't seem important to make
    backports trivial for this particular package.
    Build-depend on debhelper (>= 13.11.6~) so that dh_installsystemd finds
    the unit in its new location.
  * d/control: Canonicalize order of build-dependencies.
    No functional change.
  * Build-depend on pkgconf instead of pkg-config
  * d/tests: Add superficial autopkgtests for the -dev packages.
    Linking a trivial executable to a library is a surprisingly effective
    way to detect packaging errors like a missing dependency.

 -- Simon McVittie <smcv@debian.org>  Fri, 20 Oct 2023 11:07:11 +0100

avahi (0.8-11) unstable; urgency=medium

  [ Josh Triplett ]
  * Drop /etc/default/avahi-daemon entirely.
    The only option in it hasn't been used since avahi-daemon 0.8-4 in 2021,
    which removed the avahi-daemon-check-dns mechanism in favor of upstream
    logic serving the same function. Nothing else in the package references
    this at all.

  [ Jeremy Bícha ]
  * Build-Depend on dh-sequence-gir & dh-sequence-python3

  [ Robert McQueen ]
  * Fix browsing when invalid services present.
    Import patch from Arch to prevent service browsing from aborting in the
    middle if your network contains a device with an invalid service name.
    See https://github.com/lathiat/avahi/issues/212 and
    https://bugs.archlinux.org/task/71781

  [ Michael Biebl ]
  * Use default dh_autoreconf instead of calling ./autogen.sh.
    Running ./autogen.sh before build causes common/Makefile.am to be
    deleted during dh_auto_clean, resulting in a subsequent build failure.
    Use the default dh_autoreconf sequence instead which doesn't trigger
    this behaviour.
    Fixes ftbfs-binary-after-build (Closes: #1049786)
  * Clean up avahi-python/avahi/__pycache__/
    Fixes ftbfs-source-after-build (Closes: #1044112)

 -- Michael Biebl <biebl@debian.org>  Thu, 07 Sep 2023 21:43:48 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libavahi-common-data`.
