dnsmasq (2.90-2ubuntu0.4) noble-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in log_query.
    - debian/patches/CVE-2026-12725.patch: Account for the "not supported"
      string in logs, and add checks to catch overflow in src/cache.c and
      src/dnssec.c
    - CVE-2026-12725
  * SECURITY UPDATE: Buffer OOB read in find_soa.
    - debian/patches/CVE-2026-12969.patch: change the extrabytes argument
      from 0 to 10 in src/rfc1035.c
    - CVE-2026-12969

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 13 Jul 2026 16:12:36 -0600

dnsmasq (2.90-2ubuntu0.3) noble-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow on malicious caches in DNS
    forwarding.
    - debian/patches/CVE-2026-2291.patch: Expand char name size in
      src/dnsmasq.h.
    - CVE-2026-2291
  * SECURITY UPDATE: NSEC bitmap parsing infinite loop
    - debian/patches/CVE-2026-4890.patch: Correct erroneous iteration index
      in src/dnssec.c
    - CVE-2026-4890
  * SECURITY UPDATE: Unbounded length field in RRSIG packets.
    - debian/patches/CVE-2026-4891.patch: Validate rdlen in src/dnssec.c
    - CVE-2026-4891
  * SECURITY UPDATE: Buffer overflow in create_helper
    - debian/patches/CVE-2026-4892.patch: Add upper bound to for loop in
      src/helper.c
    - CVE-2026-4892
  * SECURITY UPDATE: Erroneous client subnet validation
    - debian/patches/CVE-2026-4893.patch: Fixed length passed to check_source
      in src/forward.c
    - CVE-2026-4893
  * SECURITY UPDATE: Buffer overflow in extract_addresses.
    - debian/patches/CVE-2026-5172.patch: Check index after extracting name
      in src/rfc1035.c
    - CVE-2026-5172

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 29 Apr 2026 12:39:03 -0600

dnsmasq (2.90-2ubuntu0.1) noble; urgency=medium

  * d/p/fix-crash-when-reloading-DHCP-config-on-SIGHUP.patch:
    Confusion in the code to free old DHCP configuration when
    it's being reloaded causes invalid pointers to be followed
    and a crash (LP: #2026757).

  [ Lukas Märdian ]
  * d/t/{control,functions}: Allow running on non-ifupdown systems and work
    around systemd-resolved conflict
  * d/t/{get-address+query-dns+lua+alt,ip-addr.patterns}: dhcpcd compat.
    It does not send the hostname in its default configuration, provides
    slightly different lease lifetimes and adds the 'noprefixroute' tag to
    the test address from ip-addr.patterns (compared to ISC dhclient).

 -- Miriam España Acebal <miriam.espana@canonical.com>  Tue, 14 Jan 2025 17:34:59 +0100

dnsmasq (2.90-2build2) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:48:56 +0000

dnsmasq (2.90-2build1) noble; urgency=medium

  * No-change rebuild against libhogweed6t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 03 Mar 2024 06:22:49 +0000

dnsmasq (2.90-2) unstable; urgency=medium

  [ Sven Geuer ]
  * Relax limits imposed by d/t/functions.d/ip-addr.patterns to allow for
    successful tests on ci.debian.net.

 -- Simon Kelley <simon@thekelleys.org.uk>  Wed, 14 Feb 2024 11:33:14 +0000

dnsmasq (2.90-1) unstable; urgency=medium

  [ Simon Kelley ]
  * New upstream. (closes: #1033165)
  * Move hard-coding of Lua version from the upstream Makefile
    to  d/rules.
  * Security fixes for Keytrap - DNSSEC validation CPU exhaustion.
    CVE-2023-50387 and CVE-2023-50868
  [ Sven Geuer ]
  * Introduce autokpgtests per d/tests/* (closes: #1034135).
  * Switch to dpkg-source 3.0 (quilt) format (closes: #1007041).
  * doc.html: Add patch to eliminate privacy breaches leaving the Donations
    paragraph as untouched as possible.
  * Prepend dnsmasq. to default, init, preinst, postinst, prerm, postrm.
  * Rename d/systemd.service to d/dnsmasq.service.
  * Rename d/systemd@.service to d/dnsmasq@.service.
  * Refactor d/rules to use the DH sequencer and fix major lintian issues
    (closes: #844989, #1040923, #1063551).
    Modified files:
    - d/rules
        Complete rewrite making use of debhelper and its tools, fixes lintian
        warning debian-rules-sets-dpkg-architecture-variable.
    - d/control
        Build-Depends, Pre-Depends, Depends added or changed as needed, lintian
        error depends-on-obsolete-package fixed.
    - d/dnsmasq.default
        ENABLED removed and comment changed to fix lintian error
        init.d-script-should-always-start-service.
    - d/dnsmasq.init
        Remove handling of obsolete ENABLED flag.
        Extract code used with System-V-style init and systemd into
        d/init-system-common, extract code used with systemd only
        into d/systemd-helper. This fixes lintian warning
        systemd-service-file-wraps-init-script.
        Drop workaround for hypothetically non-existent file
        /lib/lsb/init-functions, it has been around for more than a decade.
    - d/dnsmasq.service, d/dnsmasq@.service
        Adapt these files to make use of init-system-common and systemd-helper.
    - d/dnsmasq.{post,pre}{inst,rm}
        Rely mostly on the script snippets created by the DH tools to get
        things done, implicitly fixes the lintian warnings
        maintainer-script-should-not-use-dpkg-maintscript-helper and
        command-with-path-in-maintainer-script.
    - d/resolvconf*
        Change file mode bits to 0755, the installed files need it
    New files:
    - d/dnsmasq.{install,links,maintscript}
    - d/dnsmasq-base.{dirs,docs,install}
    - d/dnsmasq-base-lua.{dirs,docs,install,links}
    - d/dnsmasq-utils.{install,manpages}
        The DH tools use these to install what was scripted explicitly
        in the previous version of the d/rules file,
        lintian warning dbus-policy-in-etc fixed
    - d/init-system-common
    - d/systemd-helper
        These files contain slightly modified code formerly part of in
        d/dnsmasq.init.
    Deleted files:
    - d/*conffiles
    - d/lintian-override
    - d/installed-marker
        These are not in use anymore.
  * Deal with a removed conffile and changed links.
    Modified files:
    - d/dnsmasq-base.{postinst,postrm}
    New files:
    - d/dnsmasq-base.maintscript
    - d/dnsmasq-base-lua.maintscript
  * Add watch file and upstream's signing key.
    New files:
    - d/watch
    - d/u/signing-key.asc
  * Remove dependency on package adduser.
    Modified files:
    - d/control
    - d/dnsmasq.post{inst,rm}
  * Refactor d/copyright to comply with DEP 5 (closes: #966505).
  * Remove trailing whitespace from various files under debian/.
  * Bump Standards-Version to 4.6.2.
  * Specify Rules-Requires-Root.
  * Update http:// to https:// with Homepage, Vcs-Git and Vcs-Browser.
  * Introduce d/u/metadata.
  * Fix lintian issue duplicate-short-description.
  * Fix lintian issue capitalization-error-in-description.
  * Bump Lua version to 5.4 (closes: #1050750).
    Modified files:
    - d/control
    - d/t/functions.d/log.patterns

 -- Simon Kelley <simon@thekelleys.org.uk>  Fri, 23 Jan 2024 22:52:01 +0000

dnsmasq (2.89-1) unstable; urgency=low

   * New upstream.

 -- Simon Kelley <simon@thekelleys.org.uk>  Tue, 13 Jan 2023 21:57:01 +0000

dnsmasq (2.88-1) unstable; urgency=low

   * New upstream.
   * Fix loss of server configuration (closes: #1020830)
     Git commit 930428fb970f4991e5c2933fd5a5d2504c18a551

 -- Simon Kelley <simon@thekelleys.org.uk>  Wed, 2 Nov 2022 22:15:45 +0000

dnsmasq (2.87-1) unstable; urgency=low

   * New upstream. (closes: #1001209, #1003156)
   * Include new NFTset support in the build.
   * Fix crash on netboot with DNS server disabled. (closes: #996332)
   * Fix rare lockup in DNSSEC. (closes: #1001576)
   * Close old bug. (closes: #902963)

 -- Simon Kelley <simon@thekelleys.org.uk>  Wed, 25 Sep 2022 23:11:25 +0000

dnsmasq (2.86-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix --address=/#/...... which was lost in 2.86. (closes: #995655)

 -- Michael Biebl <biebl@debian.org>  Wed, 10 Nov 2021 22:05:45 +0100

dnsmasq (2.86-1) unstable; urgency=low

   * Fix debian/changelog format error. (closes: #986626)

 -- Simon Kelley <simon@thekelleys.org.uk>  Thu, 08 Apr 2021 22:39:00 +0100

dnsmasq (2.85-1) unstable; urgency=low

   * New upstream.
   * Includes fix to CVE-2021-3448.
   * Fix manpage typos. (closes: #986150)

 -- Simon Kelley <simon@thekelleys.org.uk>  Sat, 03 Apr 2021 22:17:23 +0100

dnsmasq (2.84-1.2) unstable; urgency=medium

   * Non-maintainer upload.
   * Bump old-version in dpkg-maintscript-helper dir_to_symlink calls to also
     clean up after upgrades to an earlier version in testing.

 -- Andreas Beckmann <anbe@debian.org>  Thu, 01 Apr 2021 16:01:51 +0200

dnsmasq (2.84-1.1) unstable; urgency=medium

   * Non-maintainer upload.
   * Fix symlink to directory conversion for /usr/share/doc/dnsmasq.
     This is achieved by directly calling dpkg-maintscript-helper in the preinst,
     postinst, and postrm scripts, since the package does not use debhelper.
     (Closes: #985282)

 -- Sébastien Villemot <sebastien@debian.org>  Sun, 28 Mar 2021 10:55:07 +0200

dnsmasq (2.84-1) unstable; urgency=low

   * New upstream.

 -- Simon Kelley <simon@thekelleys.org.uk>  Sun, 24 Jan 2021 22:02:01 +0000

dnsmasq (2.83-1) unstable; urgency=high

   * New upstream.
   * Includes fixes to CVE-2020-25681 - CVE-2020-25687 inclusive.

 -- Simon Kelley <simon@thekelleys.org.uk>  Fri, 15 Jan 2021 22:22:41 +0000

dnsmasq (2.82-1) unstable; urgency=low

   * New upstream.

 -- Simon Kelley <simon@thekelleys.org.uk>  Fri, 26 Jun 2020 22:22:41 +0000

dnsmasq (2.81-4) unstable; urgency=low

   * Remove runit support when building for Ubuntu. (closes: #960401)

 -- Simon Kelley <simon@thekelleys.org.uk>  Fri, 26 Jun 2020 21:52:44 +0000

dnsmasq (2.81-3) unstable; urgency=low

   * Fixes to control file for bug 958100

 -- Simon Kelley <simon@thekelleys.org.uk>  Sun, 19 Apr 2020 21:44:12 +0000

dnsmasq (2.81-2) unstable; urgency=low

   * Fix FTBFS on kFreeBSD. (closes: #958100)

 -- Simon Kelley <simon@thekelleys.org.uk>  Sat, 18 Apr 2020 18:34:15 +0000

dnsmasq (2.81-1) unstable; urgency=low

   * New upstream.
   * Fix nodocs/nodoc confusion in rules. (closes: #922758)
   * Add Vcs-* fields to control. (closes: #922422)
   * Add systemd support for multiple daemon instances. (closes: #914305)
   * Add note explaining that ENABLED is SYSV-init only. (closes: #914755)
   * Replace ash with dash in contrib/reverse-dns. (closes: #920224)
   * Move to libidn2. (closes: #932695)
   * Fix RA problem with two interfaces on same net, but RA service on
     only one of the interfaces. (closes: #949565)
   * Fix breakage of dig +trace. (closes: #942363)
   * Fix build faliure with newer Nettle libraries. (closes: #940985)
   * Support runscript init-system (closes: #929884)
   * Security fix for CVE-2019-14834 (closes: #948373)

 -- Simon Kelley <simon@thekelleys.org.uk>  Wed, 8 Apr 2020 17:33:15 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog dnsmasq-base`.
