exiv2 (0.27.5-3ubuntu1.3) jammy-security; urgency=medium

  * SECURITY REGRESSION: Segmentation Fault (LP: #2144731)
   - Remove CVE-2025-55304 patches due to intrusive changes causing
     a segmentation fault
   - CVE-2025-55304

 -- Bruce Cable <bruce.cable@canonical.com>  Thu, 19 Mar 2026 10:13:06 +1100

exiv2 (0.27.5-3ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Out of Bounds Read
    - debian/patches/CVE-2026-25884.patch: Fix out-of-bounds read
    - debian/patches/CVE-2026-27596.patch: Check for integer overflow.
    - CVE-2026-25884
    - CVE-2026-27596
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2025-54080.patch: Better bounds checking
    - debian/patches/CVE-2026-27631.patch: Check for integer overflow
    - debian/patches/CVE-2025-55304-1.patch: Add new method
      appendIccProfile to fix quadratic performance issue
    - debian/patches/CVE-2025-55304-2.patch: Fix docstring
    - CVE-2025-54080
    - CVE-2026-27631
    - CVE-2025-55304

 -- Bruce Cable <bruce.cable@canonical.com>  Fri, 13 Mar 2026 19:21:32 +1100

exiv2 (0.27.5-3ubuntu1) jammy; urgency=medium

  * Sync with Debian (LP: #1959508). Remaining change:
    - Mark symbols as optional not seen when building with lto

 -- Jeremy Bicha <jbicha@ubuntu.com>  Mon, 11 Apr 2022 13:55:15 -0400

exiv2 (0.27.5-3) unstable; urgency=medium

  * Team upload.
  * Update symbols from buildds.

 -- Sandro Knauß <hefee@debian.org>  Sat, 26 Mar 2022 18:35:36 +0100

exiv2 (0.27.5-2) unstable; urgency=medium

  * Team upload.
  * Update Multi-Arch information for -dev and -doc.
  * Enable BMFF support (Closes: #1000788)
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.
  * Fix day-of-week for changelog entry 0.10-1.
  * Enable hardening.
  * Update symbols from buildds.
  * Register documentation via doc-base.
  * Update symbols for BMFF support.

 -- Sandro Knauß <hefee@debian.org>  Fri, 25 Mar 2022 01:00:00 +0100

exiv2 (0.27.5-1ubuntu1) jammy; urgency=medium

  * Sync with Debian. Remaining change:
    - Mark symbols as optional not seen when building with lto
  * Mark additional symbols as optional not seen on latest Ubuntu build

 -- Jeremy Bicha <jeremy.bicha@canonical.com>  Thu, 10 Feb 2022 17:03:25 -0500

exiv2 (0.27.5-1) unstable; urgency=medium

  * Team upload.

  [ Simon Schmeisser ]
  * New upstream release (Closes: #1000788):
    - fixes CVE-2021-29458 (Closes: #987277)
    - fixes CVE-2021-29463 (Closes: #988241)
    - fixes CVE-2021-29464 (Closes: #988242)
    - fixes CVE-2021-29470 (Closes: #987450)
    - fixes CVE-2021-29473 (Closes: #987736)
    - fixes CVE-2021-29623 (Closes: #988481)
    - fixes CVE-2021-32617 (Closes: #988731)
    - fixes CVE-2021-32815 (Closes: #992705)
    - fixes CVE-2021-34334 (Closes: #992706)
    - fixes CVE-2021-34335 (Closes: #992707)
    - fixes CVE-2021-3482 (Closes: #986888)
    - fixes CVE-2021-37615
    - fixes CVE-2021-37616
    - fixes CVE-2021-37618
    - fixes CVE-2021-37619
    - fixes CVE-2021-37620
    - fixes CVE-2021-37621
    - fixes CVE-2021-37622
    - fixes CVE-2021-37623
  * Remove patches that have been fixed upstream:
    - fix-man-page-table-formatting.patch
    - fcf-protection-only-on-x86.diff
  * Update symbols file

  [ Sandro Knauß ]
  * Remove cruft dbg->dbgsym package dependency.
  * Bump Standards-Version to 4.6.0 (No changes needed).
  * Bump compat level to 13.
  * Bring copyright file in line with DEP-5.
  * Remove maxy from Uploaders list.
  * Cleanup copyright file.

 -- Sandro Knauß <hefee@debian.org>  Thu, 10 Feb 2022 20:05:47 +0100

exiv2 (0.27.3-3) unstable; urgency=medium

  * Team upload.
  * Update symbols file from the logs of buildds.

 -- Pino Toscano <pino@debian.org>  Sun, 09 Aug 2020 07:15:23 +0200

exiv2 (0.27.3-2) unstable; urgency=medium

  * Team upload.
  * Limit -fcf-protection only on x86 architectures, as it does not exist
    elsewhere; patch fcf-protection-only-on-x86.diff.

 -- Pino Toscano <pino@debian.org>  Sun, 09 Aug 2020 00:51:27 +0200

exiv2 (0.27.3-1) unstable; urgency=medium

  * Team upload.
  * New upstream release:
    - fixes CVE-2019-17402 (Closes: #946341)
  * Update the patches:
    - fix-man-page-table-formatting.patch: refresh
    - remove-execute-permission-bit-from-ini-test-sample.patch: not needed as
      patch, it will be done with a simpler chmod
    - Fix-issue-712.patch: drop, backported from upstream
    - Add-comment-to-explain-choice-of-cut-off-value.patch: drop, backported
      from upstream
    - Fix-1011-fix_1011_jp2_readmetadata_loop.patch: drop, backported from
      upstream
    - drop debian/source/include-binaries, no more needed now
  * Update symbols file. (Closes: #950631, #957188)
  * Add Rules-Requires-Root: no.
  * Append -Wno-deprecated-declarations to the CXXFLAGS: exiv2 uses
    std::auto_ptr<> a lot, so avoid the lots of deprecation warnings.
  * Remove the executable permissions from all the .ini files in libexiv2-doc.
  * Explicitly add the gettext build dependency.
  * Do not ship TODO in libexiv2-doc, as it is not useful for users.

 -- Pino Toscano <pino@debian.org>  Sat, 08 Aug 2020 23:23:52 +0200

# For older changelog entries, run 'apt-get changelog libexiv2-27'
