gzip (1.12-1ubuntu3.2) noble-security; urgency=medium

  * SECURITY UPDATE: insecure temp file handling
    - debian/patches/CVE-2026-41991.patch: gzexe: use -C if lacking mktemp in
      gzexe.in, zdiff.in.
    - CVE-2026-41991
  * SECURITY UPDATE: overflow in LZH decompression logic
    - debian/patches/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z
      in unlzh.c.
    - CVE-2026-41992

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 03 Jul 2026 07:53:51 -0400

gzip (1.12-1ubuntu3.1) noble; urgency=medium

  * d/p/0001-maint-fix-s390-buffer-flushes.patch: align the behavior of
    dfltcc_inflate to do the same as gzip_inflate when it hits a premature EOF
    (LP: #2083700)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 27 Jan 2025 13:56:44 -0300

gzip (1.12-1ubuntu3) noble; urgency=high

  * No change rebuild for 64-bit time_t and frame pointers.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 17:58:45 +0200

gzip (1.12-1ubuntu2) noble; urgency=medium

  [ Helmut Grohne ]
  * Move files to /usr (closes: #1059533)

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 22 Feb 2024 12:24:36 +0100

gzip (1.12-1ubuntu1) kinetic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Enable DFLTCC optimisations on s390x by default.
  * Dropped changes, included upstream:
    - Cherrypick upstream patches for optimized s390x zlib compression
      and enable it
    - Applying patch from upstream to fix a segfault caused by passing
      multiple files larger than 5kb to a gzip command while zlib
      acceleration is enabled
    - debian/patches/CVE-2022-1271-1.patch: avoid exploit via multi-newline
      file names in zgrep.in.
    - debian/patches/CVE-2022-1271-2.patch: add test in tests/Makefile.am,
      tests/zgrep-abuse.
    - debian/patches/CVE-2022-1271-3.patch: port to POSIX sed in zgrep.in.
    - debian/patches/CVE-2022-1271-4.patch: optimize out a grep in
      gzexe.in.
    - debian/patches/CVE-2022-1271-5.patch: use C locale more often in
      gzexe.in, sample/zfile, zdiff.in, zgrep.in, znew.in.
    - debian/patches/CVE-2022-1271-6.patch: fix "binary file matches"
      mislabeling in tests/Makefile.am, tests/zgrep-binary, zgrep.in.
  * Dropped changes, superseded upstream:
    - debian/rules: fix permissions on new test scripts.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 15 Aug 2022 17:36:42 -0700

gzip (1.12-1) sid; urgency=high

  * new upstream release
    - zgrep: fix arbitrary-file-write vulnerability
      address CVE-2022-1271 (closes: #1009168)
    - report correct length of 4 GiB and larger files (closes: #149775)
    - zgrep: fix "binary file matches" mislabeling; remove
      zgrep-syntax-error.diff patch
    - gzip: port to SIGPIPE-less platforms; remove sigpipe.diff patch
    - gzexe: fix count of lines to skip; remove corresponding patch
  * set standards version to 4.6.0
  * update copyright notice

 -- Milan Kupcevic <milan@debian.org>  Sat, 09 Apr 2022 22:22:26 -0400

gzip (1.10-4ubuntu4) jammy; urgency=medium

  * SECURITY UPDATE: arbitrary file override with crafted file names
    - debian/patches/CVE-2022-1271-1.patch: avoid exploit via multi-newline
      file names in zgrep.in.
    - debian/patches/CVE-2022-1271-2.patch: add test in tests/Makefile.am,
      tests/zgrep-abuse.
    - debian/patches/CVE-2022-1271-3.patch: port to POSIX sed in zgrep.in.
    - debian/patches/CVE-2022-1271-4.patch: optimize out a grep in
      gzexe.in.
    - debian/patches/CVE-2022-1271-5.patch: use C locale more often in
      gzexe.in, sample/zfile, zdiff.in, zgrep.in, znew.in.
    - debian/patches/CVE-2022-1271-6.patch: fix "binary file matches"
      mislabeling in tests/Makefile.am, tests/zgrep-binary, zgrep.in.
    - debian/rules: fix permissions on new test scripts.
    - CVE-2022-1271

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 08 Apr 2022 06:53:06 -0400

gzip (1.10-4ubuntu3) jammy; urgency=medium

  * No-change rebuild for ppc64el baseline bump.

 -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Wed, 23 Mar 2022 14:57:33 +0100

gzip (1.10-4ubuntu2) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:12:32 +0200

gzip (1.10-4ubuntu1) impish; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Cherrypick upstream patches for optimizied s390x zlib compression
      and enable it
    - Applying patch from upstream to fix a segfault caused by passing
      multiple files larger than 5kb to a gzip command while zlib
      acceleration is enabled
    - Enable DFLTCC optimisations on s390x by default. LP: #1884514

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 29 Apr 2021 09:07:34 -0700

gzip (1.10-4) sid; urgency=medium

  * skip out of range timestamp test on mips64el (closes: #983706)

 -- Milan Kupcevic <milan@debian.org>  Tue, 02 Mar 2021 18:30:16 -0500

gzip (1.10-3) sid; urgency=medium

  * Many thanks to Bdale Garbee for a quarter of a century worth of
    contributions to this package.
  * new maintainer (closes: #976304)
  * link static ssp library when building with mingw (closes: #983373)
  * gzexe: fix count of lines to skip (closes: #958425)

 -- Milan Kupcevic <milan@debian.org>  Fri, 26 Feb 2021 21:11:52 -0500

gzip (1.10-2ubuntu3) hirsute; urgency=medium

  * Enable DFLTCC optimisations on s390x by default. LP: #1884514

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 28 Jan 2021 15:56:12 +0000

gzip (1.10-2ubuntu2) hirsute; urgency=medium

  [ William 'jawn-smith' Wilson ]
  * Applying patch from upstream to fix a segfault caused by passing
    multiple files larger than 5kb to a gzip command while zlib
    acceleration is enabled (LP: #1901528)

 -- Brian Murray <brian@ubuntu.com>  Mon, 18 Jan 2021 10:35:03 -0800

gzip (1.10-2ubuntu1) groovy; urgency=medium

  * Merge from Debian unstable
    - Remaining changes:
      * Cherrypick upstream patches for optimizied s390x zlib compression
        and enable it
    - Dropped changes:
      * Build-depend on binutils (>= 2.33.1-6ubuntu1)
      * Pass -fstack-protector to mingw build to fix FTBFS

 -- Balint Reczey <rbalint@ubuntu.com>  Thu, 28 May 2020 19:37:48 +0200

gzip (1.10-2) unstable; urgency=medium

  * -DUNALIGNED_OK was only meant to be enabled on amd64, closes: #954283

 -- Bdale Garbee <bdale@gag.com>  Thu, 19 Mar 2020 11:01:46 -0600

gzip (1.10-1) unstable; urgency=medium

  * new upstream version, closes: #925554
  * explicitly link -lssp when building with mingw, closes: #951951
  * apply suggestions from lintian and Nicolas Boulenguez, closes: #881895

 -- Bdale Garbee <bdale@gag.com>  Tue, 25 Feb 2020 14:56:28 -0700

gzip (1.10-0ubuntu4) focal; urgency=high

  * Rebuild with binutils 2.33.1-6ubuntu1 (LP: #1843479)
    - Build-depend on binutils (>= 2.33.1-6ubuntu1)
  * Pass -fstack-protector to mingw build to fix FTBFS

 -- Balint Reczey <rbalint@ubuntu.com>  Fri, 13 Dec 2019 16:41:46 +0100

gzip (1.10-0ubuntu3) eoan; urgency=medium

  * Fix typpo in enabling optimized s390x zlib compression. LP: #1841052

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 23 Aug 2019 10:24:50 +0100

gzip (1.10-0ubuntu2) eoan; urgency=medium

  * Cherrypick gnu debbugs fixes for optimizied s390x zlib
    compression. LP: #1839123

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 12 Aug 2019 12:08:24 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog gzip`.
