libvpx (1.14.0-1ubuntu2.3) noble-security; urgency=medium

  * SECURITY UPDATE: Heap buffer overflow
    - debian/patches/CVE-2026-2447.patch: return 0 if buffer is full in
      vp9/vp9_cx_iface.c.
    - CVE-2026-2447

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 18 Feb 2026 10:45:47 -0500

libvpx (1.14.0-1ubuntu2.2) noble-security; urgency=medium

  * SECURITY UPDATE: use-after-free vulnerability
    - debian/patches/CVE-2025-5283.patch: fix double free on init failure.
    - CVE-2025-5283

 -- Fabian Toepfer <fabian.toepfer@canonical.com>  Mon, 02 Jun 2025 16:58:48 +0200

libvpx (1.14.0-1ubuntu2.1) noble-security; urgency=medium

  * SECURITY UPDATE: multiple integer overflows
    - debian/patches/CVE-2024-5197-pre1.patch: add test/vpx_image_test.cc.
    - debian/patches/CVE-2024-5197-1.patch: fix integer overflows in calc
      of stride_in_bytes in test/vpx_image_test.cc, vpx/src/vpx_image.c.
    - debian/patches/CVE-2024-5197-2.patch: avoid integer overflows in
      arithmetic operations in test/vpx_image_test.cc, vpx/src/vpx_image.c,
      vpx/vpx_image.h.
    - debian/patches/CVE-2024-5197-3.patch: fix a bug in alloc_size for
      high bit depths in vpx/src/vpx_image.c.
    - CVE-2024-5197

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 05 Jun 2024 09:49:38 -0400

libvpx (1.14.0-1ubuntu2) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 02:20:28 +0000

libvpx (1.14.0-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/rules: Disable LTO (Closes: #1015532)

 -- Lukas Märdian <slyon@ubuntu.com>  Thu, 14 Mar 2024 16:49:55 +0100

libvpx (1.14.0-1) experimental; urgency=medium

  * New upstream version 1.14.0
    - SONAME bump: libvpx8 -> libvpx9
  * debian/copyright:
    - Update copyright years
    - Add myself

 -- Sebastian Ramacher <sramacher@debian.org>  Sat, 27 Jan 2024 12:56:19 +0100

libvpx (1.13.1-2) unstable; urgency=medium

  * Upload to unstable
  * debian/: Honor CPPFLAGS

 -- Sebastian Ramacher <sramacher@debian.org>  Thu, 05 Oct 2023 23:10:32 +0200

libvpx (1.13.1-1) experimental; urgency=medium

  * New upstream version 1.13.1
    - SONAME bump: libvpx7 -> libvpx8
  * debian/patches: Drop patches included upstream
  * debian/: Remove no longer supported architectures
  * debian/control:
    - Add myself to uploaders
    - Bump Standards-Version

 -- Sebastian Ramacher <sramacher@debian.org>  Sat, 30 Sep 2023 23:08:26 +0200

libvpx (1.12.0-1.1) unstable; urgency=high

  * Non-maintainer upload.
  * encode_api_test: add ConfigResizeChangeThreadCount
  * VP8: disallow thread count changes (CVE-2023-5217) (Closes: #1053182)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 28 Sep 2023 23:07:11 +0200

libvpx (1.12.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.12.0
  * debian/control: Bump Standards-Version
  * debian/libvpx7.symbols: Bump minimal version of symbols doing version checks

 -- Sebastian Ramacher <sramacher@debian.org>  Sat, 09 Jul 2022 15:20:25 +0200

libvpx (1.11.0-2) unstable; urgency=medium

  * Team upload
  * Upload to unstable

 -- Sebastian Ramacher <sramacher@debian.org>  Sun, 24 Oct 2021 17:08:21 +0200

libvpx (1.11.0-1) experimental; urgency=medium

  * Team upload

  [ Jakub Adam ]
  * Enable VP9 high bit depth (10/12) profiles.

  [ Sebastian Ramacher ]
  * New upstream version 1.11.0
  * SONAME bump: libvpx6 -> libvpx7
  * debian/control: Remove incorrect MA: foreign from vpx-tools

 -- Sebastian Ramacher <sramacher@debian.org>  Sun, 10 Oct 2021 22:18:17 +0200

libvpx (1.10.0-2) unstable; urgency=medium

  * debian/: Relax ABI version check and bump minimum version for init
    functions

 -- Sebastian Ramacher <sramacher@debian.org>  Tue, 31 Aug 2021 08:59:02 +0200

libvpx (1.10.0-1) unstable; urgency=medium

  * Team upload

  [ Debian Janitor ]
  * Set upstream metadata fields: Repository, Repository-Browse.
  * Remove constraints unnecessary since buster

  [ Sebastian Ramacher ]
  * New upstream release
  * debian/control:
    - Bump Standards-Version
    - Drop obsolete Pre-Depends
  * debian/rules: Do not install README and AUTHORS

 -- Sebastian Ramacher <sramacher@debian.org>  Tue, 24 Aug 2021 22:56:11 +0200

libvpx (1.9.0-1) unstable; urgency=medium

  * Team upload
  * New upstream release (Closes: #976835)
  * debian/watch: versionmangle for RC releases
  * debian/control:
    - Bump Standards-Version
    - Remove unneeded ${shlibs:Depends} from libvpx-dev
    - Bump debhelper compat to 13
    - Set RRR: no
  * debian/rules: Use /usr/share/dpkg/architecture.mk

 -- Sebastian Ramacher <sramacher@debian.org>  Tue, 08 Dec 2020 18:02:59 +0100

libvpx (1.8.2-1) unstable; urgency=medium

  * New upstream version 1.8.2.
  * Bump Standards-Version to 4.4.1.

 -- Ondřej Nový <onovy@debian.org>  Fri, 27 Dec 2019 17:59:25 +0100

libvpx (1.8.1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Ondřej Nový <onovy@debian.org>  Mon, 05 Aug 2019 08:46:57 +0200

libvpx (1.8.1-1) experimental; urgency=medium

  * New upstream release
    - This release is ABI incompatible
  * Bump debhelper compat level to 12 and use debhelper-compat
  * Bump Standards-Version to 4.4.0 (no changes needed)
  * d/changelog, d/control: Remove trailing empty line at the end of file
  * Fix installation of neon version of library on ARM (Closes: #922817)

 -- Ondřej Nový <onovy@debian.org>  Wed, 17 Jul 2019 00:05:27 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libvpx-doc`.
