libexif (0.6.24-1ubuntu0.24.04.1) noble-security; urgency=medium

  * SECURITY UPDATE: integer overflow when decoding MakerNotes
    - debian/patches/CVE-2026-32775.patch: check maxlen to be at least 1 in
      libexif/apple/mnote-apple-entry.c, libexif/canon/mnote-canon-entry.c,
      libexif/fuji/mnote-fuji-entry.c, libexif/olympus/mnote-olympus-entry.c,
      libexif/pentax/mnote-pentax-entry.c.
    - CVE-2026-32775
  * SECURITY UPDATE: 32bit integer overflow in Nikon MakerNote handling
    - debian/patches/CVE-2026-40385.patch: Avoid overflow on 32bit system when
      reading Nikon MakerNotes in libexif/olympus/exif-mnote-data-olympus.c.
    - CVE-2026-40385
  * SECURITY UPDATE: integer underflow in size checking for Fuji and Olympus
    MakerNote decoding
    - debian/patches/CVE-2026-40386.patch: fixed 2 unsigned integer underflows
      in libexif/fuji/exif-mnote-data-fuji.c, libexif/olympus/exif-mnote-data-
      olympus.c.
    - CVE-2026-40386

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Jul 2026 10:36:26 -0400

libexif (0.6.24-1build2) noble; urgency=high

  * No change rebuild for 64-bit time_t and frame pointers.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 18:03:23 +0200

libexif (0.6.24-1build1) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 13:11:45 +0100

libexif (0.6.24-1) unstable; urgency=medium

  * New upstream version 0.6.24:
    - Regression in exif_data_load_data fixed; EXIF in JPEG data loads again.
    - Many Canon tag names decoded.
    - "Persistent" AFL fuzzer added to code samples.
    - Translation updates.
  * debian/copyright: Update for libexif 0.6.24.
  * Install the upstream documentation and examples in libexif-dev but package
    the files in libexif-doc (as preferred by Debian Policy section 12.3).
  * Upstream README and NEWS files are now only installed in libexif-dev.
  * Delete debian/README.source.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Sun, 05 Dec 2021 16:28:31 +1100

libexif (0.6.23-1) unstable; urgency=medium

  * New upstream version:
    - Support for more Exif 2.3 tags.
    - Support for Apple iOS MakerNote format.
    - Default GPS IFD table added.
    - EXIF_TAG_SENSITIVITY_TYPE decoder added.
    - Translation updates.
    - Multiple security fixes.
  * debian/control: Raise Standards-Version to 4.6.0 (no changes needed).
  * debian/copyright: Update for libexif 0.6.23.
  * debian/gbp.conf: Use DEP-14 branch naming.
  * debian/patches: Drop all patches. Security fixes included in this version.
  * debian/upstream/metadata: Update ChangeLog URL.
  * debian/watch: Use string substitutions where possible.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Sun, 26 Sep 2021 13:28:52 +1000

libexif (0.6.22-3) unstable; urgency=medium

  * Add upstream patch to prevent compiler optimization of a buffer
    overflow check (fixes CVE-2020-0452).
  * Add Forwarded: not-needed to cve-2020-0198.patch.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Fri, 06 Nov 2020 23:01:25 +1100

libexif (0.6.22-2) unstable; urgency=medium

  * Add upstream patch to fix an unsigned integer overflow in
    libexif/exif-data.c (CVE-2020-0198) (Closes: #962345).

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Sat, 13 Jun 2020 18:01:44 +1000

libexif (0.6.22-1) unstable; urgency=medium

  * New upstream version.
    - Support for certain EXIF 2.3 tags.
    - Multiple security fixes.
    - New and updated translations.
  * debian/copyright: Update for libexif 0.6.22.
  * debian/patches: Drop all patches. Upstream has fixed all known bugs.
  * debian/rules:
    - No longer include /usr/share/dpkg/architecture.mk.
    - Remove special handling for the 'binary' target. The problematic
      directory was renamed 'binary-dist' in this version of libexif.
  * libexif-dev: Install SECURITY.md.
  * libexif-doc: Drop dependency on libjs-jquery.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Tue, 02 Jun 2020 22:02:21 +1000

libexif (0.6.21-9) unstable; urgency=medium

  * Emmanuel Bouthenot has stepped down as an Uploader.
    - Thank you for maintaining libexif!
  * Add Hugh McMaster as an Uploader.
  * Add upstream patches to fix multiple security issues:
    - cve-2020-13112.patch: Fix MakerNote tag size overflow issues at
      read time (CVE-2020-13112) (Closes: #961407).
    - cve-2020-13113.patch: Ensure MakerNote data pointers are
      NULL-initialized (CVE-2020-13113) (Closes: #961409).
    - cve-2020-13114.patch: Add a failsafe on the maximum number of
      Canon MakerNote subtags to catch extremely large values in tags
      (CVE-2020-13114) (Closes: #961410).
  * Rebase other patches as needed.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Thu, 28 May 2020 23:23:33 +1000

libexif (0.6.21-8) unstable; urgency=medium

  * Team upload.
  * debian/copyright:
    - Extend Emmanuel Bouthenot's years of maintenance to 2014.
    - Add myself to the 'debian' section.
  * debian/patches/cve-2020-0093.patch:
    - Prevent a read buffer overflow in exif-data.c (CVE-2020-0093).
  * libexif-doc:
    - Do not remove the Doxygen-generated jquery.js file.
    - Do not symlink jquery.js to the equivalent system file.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Wed, 20 May 2020 22:30:00 +1000

libexif (0.6.21-7) unstable; urgency=medium

  * Team upload.
  * Frederic Peters has stepped down as an Uploader. Thank you for your work!
  * debian/control:
    - Use debhelper-compat v13.
    - Update Uploaders field.
  * debian/copyright: Add information for files in contrib/examples.
  * debian/patches/cve-2020-12767.patch:
    - Prevent some possible divide-by-zero errors in exif-entry.c's
      exif_entry_get_value() function (CVE-2020-12767) (Closes: #960199).
  * debian/patches/exif-loader-undefined-behaviour.patch:
    - Prevent undefined behaviour when left-shifting with type 'int'.
  * debian/rules:
    - Use dh_installdocs-indep override instead of dh_installdocs override.
    - Remove embedded jquery.js file after installing documentation.
    - Do not install the upstream ChangeLog.
  * libexif12: Update source paths for documentation files.
  * libexif-dev: Update source paths for documentation files.
  * libexif-doc:
    - Update source paths for documentation files.
    - Install contrib/example source files.
  * Add debian/not-installed file.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Fri, 15 May 2020 23:23:07 +1000

libexif (0.6.21-6) unstable; urgency=medium

  * Team upload.
  * Acknowledge NMU by Salvatore Bonaccorso.
  * debian/changelog: Remove trailing whitespace.
  * debian/control:
    - Build-Depend on debhelper-compat (=12).
    - Raise Standards-Version to 4.5.0 from 4.1.3 (no changes needed).
    - Declare Rules-Requires-Root: no.
  * debian/patches: Add upstream patches by Marcus Meissner:
    - Avoid the use of unsafe integer overflow checking constructs
      (CVE-2019-9278) (Closes: #945948).
    - Avoid implicit behaviour by casting to unsigned int before shifting left.
  * debian/rules: Do not manually install libexif.pc into a multi-arch libdir.
  * libexif12.symbols: Specify libexif-dev in the Build-Depends-Package
      meta-information field.
  * Add Debian upstream/metadata file.

 -- Hugh McMaster <hugh.mcmaster@outlook.com>  Thu, 23 Jan 2020 20:03:01 +1100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libexif12`.
