djvulibre (3.5.28-2ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2021-46312.patch: More Fedora patches
      (parameter validation avoid zdiv exceptions)
    - CVE-2021-46312

 -- John Breton <john.breton@canonical.com>  Fri, 20 Feb 2026 10:31:18 -0500

djvulibre (3.5.28-2ubuntu0.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: code execution via OOB write
    - debian/patches/0008-*.patch: fix potential buffer overflow in
      MMRDecoder in libdjvu/MMRDecoder.cpp.
    - CVE-2025-53367

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 08 Jul 2025 12:56:00 -0400

djvulibre (3.5.28-2build2) jammy; urgency=medium

  * No-change rebuild for ppc64el baseline bump.

 -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Wed, 23 Mar 2022 14:50:45 +0100

djvulibre (3.5.28-2build1) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:10:54 +0200

djvulibre (3.5.28-2) unstable; urgency=high

  * bump policy version
  * Include Fedora 3.5.27 patches, foward ported, taken from djvulibre.spec in
    https://src.fedoraproject.org/rpms/djvulibre.git
    - Patch0: djvulibre-3.5.22-cdefs.patch                    (forward ported)
    - #Patch1: djvulibre-3.5.25.3-cflags.patch              (disabled in Fedora)
    - Patch2: djvulibre-3.5.27-buffer-overflow.patch        (UPSTREAMED)
    - Patch3: djvulibre-3.5.27-infinite-loop.patch          (UPSTREAMED)
    - Patch4: djvulibre-3.5.27-stack-overflow.patch         (UPSTREAMED)
    - Patch5: djvulibre-3.5.27-zero-bytes-check.patch       (UPSTREAMED)
    - Patch6: djvulibre-3.5.27-export-file.patch              (forward ported)
    - Patch7: djvulibre-3.5.27-null-dereference.patch       (UPSTREAMED)
    - Patch8: djvulibre-3.5.27-check-image-size.patch         (forward ported)
    - Patch9: djvulibre-3.5.27-integer-overflow.patch         (forward ported)
    - Patch10: djvulibre-3.5.27-check-input-pool.patch        (forward ported)
    - Patch11: djvulibre-3.5.27-djvuport-stack-overflow.patch (forward ported)
    - Patch12: djvulibre-3.5.27-unsigned-short-overflow.patch (forward ported)
    These address a number of crashes and security issues, including
    CVE-2021-3500 (closes: #988215)

 -- Barak A. Pearlmutter <bap@debian.org>  Mon, 10 May 2021 18:56:59 +0100

djvulibre (3.5.28-1) unstable; urgency=medium

  [ Leon Bottou ]
  * version number change

  [ Barak A. Pearlmutter ]
  * rules does not require root
  * version-4 debian/watch uscan support file

 -- Barak A. Pearlmutter <bap@debian.org>  Mon, 23 Nov 2020 13:10:15 +0000

djvulibre (3.5.27.1-15) unstable; urgency=medium

  * bump to debhelper 13
  * bump policy version
  * track upstream including libtiff bug fix (closes: #962779)

 -- Barak A. Pearlmutter <bap@debian.org>  Wed, 22 Jul 2020 15:18:20 +0100

djvulibre (3.5.27.1-14) unstable; urgency=medium

  * Merge upstream fix for CVE-2019-18804 (closes: #945114)
  * bump policy

 -- Barak A. Pearlmutter <bap@debian.org>  Thu, 21 Nov 2019 15:30:21 +0000

djvulibre (3.5.27.1-13) unstable; urgency=medium

  * track upstream bug fixes
  * Run lintian-brush:
    - Add missing colon in closes line.
    - Set upstream metadata fields: Archive.

 -- Barak A. Pearlmutter <bap@debian.org>  Wed, 11 Sep 2019 14:12:18 +0100

djvulibre (3.5.27.1-12) unstable; urgency=medium

  * track upstream bug fixes and such
  * bump policy

 -- Barak A. Pearlmutter <bap@debian.org>  Sat, 10 Aug 2019 13:48:53 +0200

# For older changelog entries, run 'apt-get changelog libdjvulibre-text'
