libxfont (1:2.0.6-2ubuntu0.2) resolute-security; urgency=medium

  * Manage the security patches with quilt. The same fixes as 2ubuntu0.1 are
    applied, but as tracked patches rather than edits made directly to the
    upstream sources.
    - debian/patches/CVE-2026-56001.patch,
      debian/patches/CVE-2026-56002.patch,
      debian/patches/CVE-2026-56003.patch: add the patch files, which
      2ubuntu0.1 referenced in its changelog but did not ship.
    - debian/patches/series: list the three patches (was "# placeholder").
    - debian/control, debian/rules: build-depend on quilt and pass
      --with quilt to dh so the patches are applied at build time.
  * debian/patches/CVE-2026-56001.patch: additionally convert the
    "Couldn't allocate bitmaps" fprintf() to %zu instead of %d.

 -- John Breton <john.breton@canonical.com>  Thu, 16 Jul 2026 07:44:32 -0400

libxfont (1:2.0.6-2ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2026-56001.patch: Bitscale: fix integer overflow in
      BitmapScaleBitmaps bytestoalloc
    - CVE-2026-56001
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2026-56002.patch: Pcfread: validate bitmap sizes and
      offsets against per-glyph metrics
    - CVE-2026-56002
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2026-56003.patch: Bitscale: add bounds check to
      computeProps for property buffer
    - CVE-2026-56003

 -- John Breton <john.breton@canonical.com>  Wed, 15 Jul 2026 19:44:54 -0400

libxfont (1:2.0.6-2) unstable; urgency=medium

  * Team upload

  [ Debian Janitor ]
  * Remove constraints unnecessary since buster (oldstable):
    + Build-Depends: Drop versioned constraint on libfontenc-dev (>= 1:1.0.5-2).
    + Build-Depends: Drop versioned constraint on xutils-dev (>= 1:7.5+4).
    + Build-Depends: Drop versioned constraint on xorg-sgml-doctools (>= 1:1.7).
    + libxfont-dev: Drop versioned constraint on libfontenc-dev (>= 1:1.0.1-1)
      in Depends.
  * Bump debhelper from old 12 to 13.
    + debian/rules: Drop --fail-missing argument to dh_missing, which is now the
      default.
  * Use canonical URL in Vcs-Git
  * Update standards version to 4.7.3

  [ Jeremy Bícha ]
  * Add debian/gbp.conf
  * Use Build-Depends: lynx instead of w3m

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 24 Dec 2025 20:01:23 -0500

libxfont (1:2.0.6-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 01 Sep 2022 14:03:08 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libxfont2`.
