libraw (0.21.5b-1ubuntu1.1) resolute-security; urgency=medium

  * SECURITY UPDATE: OOB read via load_flags/raw_width argument
    - debian/patches/CVE-2026-5342.patch: Nikon padded/12bit: no need to
      calculate padded row size before final raw_width adjustment in
      src/decoders/decoders_libraw.cpp, src/metadata/tiff.cpp.
    - CVE-2026-5342
  * SECURITY UPDATE: integer overflow in deflate_dng_load_raw
    - debian/patches/CVE-2026-20884-pre1.patch: implemented RAW size limit check
      and allocation result check for 4-shot pentax loaded and FP-dng loader in
      src/decoders/decoders_libraw.cpp, src/decoders/fp_dng.cpp.
    - debian/patches/CVE-2026-20884-pre2.patch: FP DNG data limit: perform
      calculations in 64 bit in src/decoders/fp_dng.cpp.
    - debian/patches/CVE-2026-20884.patch: Fix for data size calculation integer
      overflow in float/deflated DNG loader; Check for read results in
      src/decoders/fp_dng.cpp.
    - CVE-2026-20884
  * SECURITY UPDATE: heap overflow in x3f_thumb_loader
    - debian/patches/CVE-2026-20889.patch: Add checks in
      src/decoders/unpack_thumb.cpp, src/x3f/x3f_parse_process.cpp,
      src/x3f/x3f_utils_patched.cpp.
    - CVE-2026-20889
  * SECURITY UPDATE: heap overflow in lossless_jpeg_load_raw functionality
    - debian/patches/CVE-2026-21413.patch: check raw_width in
      src/decoders/decoders_dcraw.cpp.
    - CVE-2026-21413
  * SECURITY UPDATE: integer overflow in uncompressed_fp_dng_load_raw
    - debian/patches/CVE-2026-24450.patch: avoid integer overflow in allocation
      size calculation. Also: check for EOF in read loop in
      src/decoders/fp_dng.cpp.
    - CVE-2026-24450
  * SECURITY UPDATE: heap overflow in x3f_load_huffman
    - debian/patches/CVE-2026-24660.patch: X3F decoder: implemented hard single
      allocation limit via LIBRAW_X3F_ALLOC_LIMIT_MB define; allocation size
      calculation converted to 64 bit arithm in libraw/libraw_const.h,
      src/x3f/x3f_utils_patched.cpp.
    - CVE-2026-24660

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Jul 2026 11:16:30 -0400

libraw (0.21.5b-1ubuntu1) resolute; urgency=medium

  * d/libraw23t64.symbols: Remove d/libraw23t64.symbols, added in
    0.21.5b-1 in Debian. It is generated without LTO therefore builds
    in Ubuntu with LTO enabled fail during dpkg-gensymbols. (LP: #2141767)

 -- John Chittum <john.chittum@canonical.com>  Mon, 16 Feb 2026 13:19:31 -0500

libraw (0.21.5b-1) unstable; urgency=medium

  * Team upload.
  * Bump Standards-Version: 4.7.3
  * add d/gbp.conf
  * New upstream version 0.21.5b
  * debian/copyright: update-debian-copyright to 2026
  * update d/libraw23t64.lintian-overrides
  * d/control: Build-Depends add dh-sequence-pkgkde-symbolshelper
  * d/libraw23t64.symbols, fix lintian warning:
      - copy debian/tmp/DEBIAN/symbols to debian/libraw23t64.symbols
      - add SymbolsHelper-Confirmed
      - use pkgkde-symbolshelper batchpatch libraw_0.21.4-3~exp*.build
      - set symbols version down to 0.21.2 from 0.21.4

 -- xiao sheng wen <atzlinux@debian.org>  Sun, 04 Jan 2026 12:17:25 +0800

libraw (0.21.4-2) unstable; urgency=medium

  * Team upload.
  * Revert "d/libraw23t64.symbols: add some symbols already exist in 0.21.3"
    fix FTBFS on some Architecture:
    https://buildd.debian.org/status/logs.php?pkg=libraw&ver=0.21.4-1

 -- xiao sheng wen <atzlinux@debian.org>  Thu, 24 Apr 2025 21:52:02 +0800

libraw (0.21.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 0.21.4
    This minor release fixes the following security issues:
    - CVE-2025-43961 - CVE-2025-43962 Closes: #1103781
    - CVE-2025-43963 Closes: #1103782
    - CVE-2025-43964 Closes: #1103783
  * d/control: Build-Depends delete dpkg-dev (>= 1.22.5), not needed
  * Bump Standards-Version: 4.7.2
  * d/copyright:
      - update year info
      - fix old-fsf-address-in-copyright-file
  * update d/libraw23t64.lintian-overrides
  * d/libraw23t64.symbols:
      - add * Build-Depends-Package: libraw-dev
      - add some symbols already exist in 0.21.3

 -- xiao sheng wen <atzlinux@debian.org>  Thu, 24 Apr 2025 15:55:00 +0800

libraw (0.21.3-1) unstable; urgency=medium

  * New upstream release
    - debian/patches/: patchset dropped (merged upstream)
  * debian/control:
    - pkg-config -> pkgconf
    - S-V bump 4.6.2 -> 4.7.0 (no changes needed)

 -- Matteo F. Vescovi <mfv@debian.org>  Thu, 24 Oct 2024 20:53:40 +0200

libraw (0.21.2-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1062601

 -- Benjamin Drung <bdrung@debian.org>  Wed, 28 Feb 2024 19:43:42 +0000

libraw (0.21.2-2) unstable; urgency=medium

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.

  [ Matthias Klose ]
  * Mark symbols as optional not seen when building with lto. (Closes:
    #1015516)

  [ Heather Ellsworth ]
  * Open merge request against gitlab on salsa.debian.org

  [ Olivier Tilloy ]
  * Mark C++ template instantiations optional
    (This was already done in Debian due to gcc-13 symbols changes

  [ Gianfranco Costamagna ]
  * Team upload
  * Sort symbols
  * Drop duplicated symbols

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Mon, 15 Jan 2024 10:04:22 +0100

libraw (0.21.2-1) unstable; urgency=medium

  * New upstream release
  * debian/patches/: patchset updated
    - Old patches dropped (merged upstream)
    - 0001-CR3-Qstep-table-avoid-wrong-64-bit-code-generation.patch added
    (Closes: #1060257)

 -- Matteo F. Vescovi <mfv@debian.org>  Sun, 14 Jan 2024 18:24:49 +0100

libraw (0.21.1-7) unstable; urgency=medium

  * debian/libraw23.symbols: more symbols fixing

 -- Matteo F. Vescovi <mfv@debian.org>  Mon, 24 Jul 2023 14:22:16 +0200

libraw (0.21.1-6) unstable; urgency=medium

  * debian/patches/: patchset updated
    - 0002-raw-identify-use-fallback-if-PATH_MAX-not-available.patch added
  * debian/libraw23.symbols: initial fix after gcc-13

 -- Matteo F. Vescovi <mfv@debian.org>  Sat, 22 Jul 2023 23:08:47 +0200

libraw (0.21.1-5) unstable; urgency=medium

  * debian/patches/: patchset updated (Closes: #1036281)
    - 0001-Do-not-set-shrink-flag-for-3-4-component-images.patch added
      CVE-2023-1729:
      | A flaw was found in LibRaw. A heap-buffer-overflow
      | in raw2image_ex() caused by a maliciously crafted file
      | may lead to an application crash.

 -- Matteo F. Vescovi <mfv@debian.org>  Wed, 05 Jul 2023 22:47:57 +0200

libraw (0.21.1-4) unstable; urgency=medium

  * Upload to unstable

 -- Matteo F. Vescovi <mfv@debian.org>  Sun, 02 Jul 2023 16:56:51 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libraw23t64`.
