lcms2 (2.12~rc1-2ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: nteger overflow in CubeSize
    - debian/patches/CVE-2026-41254-pre1.patch: fix a bounds check in
      src/cmslut.c.
    - debian/patches/CVE-2026-41254-pre2.patch: prevent allocating a big
      chunk of memory on corrupted LUT in src/cmslut.c.
    - debian/patches/CVE-2026-41254-1.patch: fix integer overflow in
      CubeSize() in src/cmslut.c.
    - debian/patches/CVE-2026-41254-2.patch: check for overflow in
      src/cmslut.c.
    - CVE-2026-41254

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 21 Apr 2026 08:46:35 -0400

lcms2 (2.12~rc1-2build2) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 13:09:28 +0100

lcms2 (2.12~rc1-2build1) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:13:49 +0200

lcms2 (2.12~rc1-2) unstable; urgency=medium

  * Brown paperbag release: upload source only to the buildds. 

 -- Thomas Weber <tweber@debian.org>  Wed, 13 Jan 2021 17:50:17 +0100

lcms2 (2.12~rc1-1) unstable; urgency=medium

  * New upstream version 2.12~rc1 (Closes: #972925)
  * Update copyright information
  * Bump standards version to 4.5.1, no changes needed
  * Bump debhelper compat level to 13
  * Switch to automatic generation of dbgsym package
  * Remove patch CVE-2018-16435.patch - applied upstream
  * Switch to format 4 of debian/watch

 -- Thomas Weber <tweber@debian.org>  Wed, 13 Jan 2021 03:47:09 +0100

lcms2 (2.9-4) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/changelog: Remove trailing whitespaces
  * d/watch: Use https protocol

  [ Thomas Weber ]
  * Bump standards version to 4.4.0, no changes needed
  * dh_strip_nondeterminism should not normalize src.zip (Closes: #935177)

 -- Thomas Weber <tweber@debian.org>  Mon, 09 Sep 2019 22:40:46 +0200

lcms2 (2.9-3) unstable; urgency=medium

  * Fix integer overflow in AllocateDataSet() (CVE-2018-16435)
    Thanks to Salvatore Bonaccorso <carnil@debian.org> and
    Marti Maria <marti.maria@littlecms.com>
    (Closes: #907983)

 -- Thomas Weber <tweber@debian.org>  Wed, 05 Sep 2018 17:59:06 +0200

lcms2 (2.9-2) unstable; urgency=medium

  * Switch Vcs links to salsa.debian.org
  * Add Build-Depends-Package header to symbols file (see #900819)
    Thanks to Andreas Henriksson <andreas@fatal.se>
  * Bump standards version to 4.1.4, no changes needed

 -- Thomas Weber <tweber@debian.org>  Sat, 09 Jun 2018 22:33:22 +0200

lcms2 (2.9-1) unstable; urgency=medium

  * New upstream version 2.9:
    - Drop patch fix-CVE-2016-10165 (applied upstream)
    - Drop patch lcms2-fix-strFrom16-byte-order.patch (applied upstream)
    - Update patch dont-write-uninitialized-memory-for-color-strings.patch
    - Update patch prepare-for-libtoolizing.patch
    - Update symbols file for 2.9 version.
      The 2.9 release no longer exports private symbols.
    - Update doc-base files for new 2.9 upstream version
  * Remove build-depends on dh-autoreconf.
    We depend on debhelper >= 10, so this is automatically enabled
    Thanks to lintian
  * Bump standards version from 3.9.8 to 4.1.2:
    - Use httpS in the "Format" field of debian/copyright. (policy 4.0.0)

 -- Thomas Weber <tweber@debian.org>  Sun, 17 Dec 2017 15:52:01 +0100

lcms2 (2.8-4) unstable; urgency=medium

  * New patch: debian/patches/fix-CVE-2016-10165.patch.
    Fix for CVE-2016-10165. (Closes: #852627)
    Thanks to Salvatore Bonaccorso <carnil@debian.org>

 -- Thomas Weber <tweber@debian.org>  Thu, 26 Jan 2017 11:04:13 +0100

# For older changelog entries, run 'apt-get changelog liblcms2-2'
