gzip (1.10-4ubuntu4.2) jammy-security; urgency=medium

  * SECURITY UPDATE: insecure temp file handling
    - debian/patches/CVE-2026-41991.patch: gzexe: use -C if lacking mktemp in
      gzexe.in, zdiff.in.
    - CVE-2026-41991
  * SECURITY UPDATE: overflow in LZH decompression logic
    - debian/patches/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z
      in unlzh.c.
    - CVE-2026-41992

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 03 Jul 2026 07:55:53 -0400

gzip (1.10-4ubuntu4.1) jammy; urgency=medium

  * Cherry-pick upstream patch to use more portable alignment to resolve
    failure to execute on
    WSL1. https://github.com/microsoft/WSL/issues/8219 LP: #1966849

 -- Dimitri John Ledkov <dimitri.ledkov@canonical.com>  Mon, 05 Sep 2022 14:33:59 +0100

gzip (1.10-4ubuntu4) jammy; urgency=medium

  * SECURITY UPDATE: arbitrary file override with crafted file names
    - debian/patches/CVE-2022-1271-1.patch: avoid exploit via multi-newline
      file names in zgrep.in.
    - debian/patches/CVE-2022-1271-2.patch: add test in tests/Makefile.am,
      tests/zgrep-abuse.
    - debian/patches/CVE-2022-1271-3.patch: port to POSIX sed in zgrep.in.
    - debian/patches/CVE-2022-1271-4.patch: optimize out a grep in
      gzexe.in.
    - debian/patches/CVE-2022-1271-5.patch: use C locale more often in
      gzexe.in, sample/zfile, zdiff.in, zgrep.in, znew.in.
    - debian/patches/CVE-2022-1271-6.patch: fix "binary file matches"
      mislabeling in tests/Makefile.am, tests/zgrep-binary, zgrep.in.
    - debian/rules: fix permissions on new test scripts.
    - CVE-2022-1271

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 08 Apr 2022 06:53:06 -0400

gzip (1.10-4ubuntu3) jammy; urgency=medium

  * No-change rebuild for ppc64el baseline bump.

 -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Wed, 23 Mar 2022 14:57:33 +0100

gzip (1.10-4ubuntu2) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:12:32 +0200

gzip (1.10-4ubuntu1) impish; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Cherrypick upstream patches for optimizied s390x zlib compression
      and enable it
    - Applying patch from upstream to fix a segfault caused by passing
      multiple files larger than 5kb to a gzip command while zlib
      acceleration is enabled
    - Enable DFLTCC optimisations on s390x by default. LP: #1884514

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 29 Apr 2021 09:07:34 -0700

gzip (1.10-4) sid; urgency=medium

  * skip out of range timestamp test on mips64el (closes: #983706)

 -- Milan Kupcevic <milan@debian.org>  Tue, 02 Mar 2021 18:30:16 -0500

gzip (1.10-3) sid; urgency=medium

  * Many thanks to Bdale Garbee for a quarter of a century worth of
    contributions to this package.
  * new maintainer (closes: #976304)
  * link static ssp library when building with mingw (closes: #983373)
  * gzexe: fix count of lines to skip (closes: #958425)

 -- Milan Kupcevic <milan@debian.org>  Fri, 26 Feb 2021 21:11:52 -0500

gzip (1.10-2ubuntu3) hirsute; urgency=medium

  * Enable DFLTCC optimisations on s390x by default. LP: #1884514

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 28 Jan 2021 15:56:12 +0000

gzip (1.10-2ubuntu2) hirsute; urgency=medium

  [ William 'jawn-smith' Wilson ]
  * Applying patch from upstream to fix a segfault caused by passing
    multiple files larger than 5kb to a gzip command while zlib
    acceleration is enabled (LP: #1901528)

 -- Brian Murray <brian@ubuntu.com>  Mon, 18 Jan 2021 10:35:03 -0800

# For older changelog entries, run 'apt-get changelog gzip'
