libraw (0.20.2-2ubuntu2.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: OOB read via load_flags/raw_width argument
    - debian/patches/CVE-2026-5342.patch: Nikon padded/12bit: no need to
      calculate padded row size before final raw_width adjustment in
      src/decoders/decoders_libraw.cpp, src/metadata/tiff.cpp.
    - CVE-2026-5342
  * SECURITY UPDATE: integer overflow in deflate_dng_load_raw
    - debian/patches/CVE-2026-20884-pre1.patch: implemented RAW size limit check
      and allocation result check for 4-shot pentax loaded and FP-dng loader in
      src/decoders/decoders_libraw.cpp, src/decoders/fp_dng.cpp.
    - debian/patches/CVE-2026-20884-pre2.patch: FP DNG data limit: perform
      calculations in 64 bit in src/decoders/fp_dng.cpp.
    - debian/patches/CVE-2026-20884.patch: Fix for data size calculation integer
      overflow in float/deflated DNG loader; Check for read results in
      src/decoders/fp_dng.cpp.
    - CVE-2026-20884
  * SECURITY UPDATE: heap overflow in x3f_thumb_loader
    - debian/patches/CVE-2026-20889.patch: Add checks in
      src/decoders/unpack_thumb.cpp, src/x3f/x3f_parse_process.cpp,
      src/x3f/x3f_utils_patched.cpp.
    - CVE-2026-20889
  * SECURITY UPDATE: heap overflow in lossless_jpeg_load_raw functionality
    - debian/patches/CVE-2026-21413.patch: check raw_width in
      src/decoders/decoders_dcraw.cpp.
    - CVE-2026-21413
  * SECURITY UPDATE: heap overflow in x3f_load_huffman
    - debian/patches/CVE-2026-24660.patch: X3F decoder: implemented hard single
      allocation limit via LIBRAW_X3F_ALLOC_LIMIT_MB define; allocation size
      calculation converted to 64 bit arithm in libraw/libraw_const.h,
      src/x3f/x3f_utils_patched.cpp.
    - CVE-2026-24660

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Jul 2026 12:50:32 -0400

libraw (0.20.2-2ubuntu2.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Out of bounds read
    - debian/patches/CVE-2025-43961-CVE-2025-43962.patch: Check
      size of head array values
    - CVE-2025-43961
    - CVE-2025-43962
    - debian/patches/CVE-2025-43963.patch: check split_col/split_row
      values in phase_one_correct
    - CVE-2025-43963
  * SECURITY UPDATE: Malformed input
    - debian/patches/CVE-2025-43964.patch: additional checks in PhaseOne
      correction tag 0x412 processing
    - CVE-2025-43964

 -- Bruce Cable <bruce.cable@canonical.com>  Mon, 28 Apr 2025 14:02:47 +1000

libraw (0.20.2-2ubuntu2.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service via buffer overflow
    - debian/patches/CVE-2021-32142.patch: check for input buffer size on
      datastream::gets in src/libraw_datastream.cpp.
    - CVE-2021-32142
  * SECURITY UPDATE: heap-buffer-overflow in raw2image_ex()
    - debian/patches/CVE-2023-1729.patch: do not set shrink flag for 3/4
      component images in src/preprocessing/raw2image.cpp.
    - CVE-2023-1729

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 01 Jun 2023 13:03:58 -0400

libraw (0.20.2-2ubuntu2) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 13:14:52 +0100

libraw (0.20.2-2ubuntu1) jammy; urgency=medium

  * Merge with/Rebase on Debian. Remaining changes:
    - Mark C++ template instantiation symbols optional (LP: #1917756)
    - Mark symbols as optional not seen when building with lto

 -- Heather Ellsworth <heather.ellsworth@canonical>  Tue, 23 Nov 2021 20:37:09 +0000

libraw (0.20.2-2) unstable; urgency=medium

  * debian/watch: bump version 3 -> 4
  * debian/control: S-V bump 4.5.0 -> 4.6.0 (no changes needed)
  * debian/libraw-doc.docs: install cpp samples (Closes: #994019)
  * debian/libraw-bin.install: move sample binaries to usr/bin
  * debian/NEWS: added to describe sample binaries move
  * debian/rules:
    - drop useless linker flags
    - hardening options added

 -- Matteo F. Vescovi <mfv@debian.org>  Sat, 11 Sep 2021 16:56:07 +0200

libraw (0.20.2-1) unstable; urgency=medium

  * New upstream release

 -- Matteo F. Vescovi <mfv@debian.org>  Mon, 19 Oct 2020 23:00:12 +0200

libraw (0.20.0-4) unstable; urgency=medium

  * Upload to unstable
  * debian/libraw20.symbols: drop duplicates and
    restrict to 64 bits

 -- Matteo F. Vescovi <mfv@debian.org>  Tue, 18 Aug 2020 15:45:30 +0200

libraw (0.20.0-3) experimental; urgency=medium

  * debian/libraw20.symbols: drop MISSING and update others

 -- Matteo F. Vescovi <mfv@debian.org>  Tue, 04 Aug 2020 23:43:02 +0200

libraw (0.20.0-2) experimental; urgency=medium

  * debian/libraw20.symbols: file updated

 -- Matteo F. Vescovi <mfv@debian.org>  Tue, 04 Aug 2020 21:11:25 +0200

# For older changelog entries, run 'apt-get changelog libraw20'
