libxml2 (2.14.5+dfsg-0.2ubuntu0.2) questing-security; urgency=medium

  * SECURITY UPDATE: Denial of service in xmllint.
    - debian/patches/CVE-2026-1757.patch: Free the cmdline when it only
      contains whitespace in shell.c
    - CVE-2026-1757
  * SECURITY UPDATE: Denial of service in parser.
    - debian/patches/CVE-2026-6732.patch: Pass userData instead of ctxt in
      parser.c
    - CVE-2026-6732

 -- Kyle Kernick <kyle.kernick@canonical.com>  Fri, 19 Jun 2026 11:46:21 -0600

libxml2 (2.14.5+dfsg-0.2ubuntu0.1) questing-security; urgency=medium

  * SECURITY UPDATE: Infinite recursion with SGML catalogs.
    - debian/patches/CVE-2025-8732.patch: Add catalog depth and checks in
      catalog.c. Add test files in result/catalogs/recursive and
      test/catalogs/recursive.sgml.
    - CVE-2025-8732
  * SECURITY UPDATE: Infinite recursion when resolving include directives in
    RelaxNG parser.
    - debian/patches/CVE-2026-0989.patch: Add xmlRelaxParserSetIncLImit in
      include/libxml/relaxng.h. Add include limit and checks in relaxng.c. Add
      test and test files in runtest.c,
      test/relaxng/include/include-limit.rng,
      test/relaxng/include/include-limit_1.rng,
      test/relaxng/include/include-limit_2.rng, and
      test/relaxng/include/include-limit_3.rng.
    - debian/libxml2-16.symbols: Add new xmlRelaxParserSetIncLImit symbol.
    - CVE-2026-0989
  * SECURITY UPDATE: Infinite recursion in URI dereferencing.
    - debian/patches/CVE-2026-0990.patch: Add MAX_CATAL_DEPTH and other checks
      in catalog.c.
    - CVE-2026-0990
  * SECURITY UPDATE: Uncontrolled resource consumption in catalogs.
    - debian/patches/CVE-2026-0992.patch: Add catalog duplication checks in
      catalog.c.
    - CVE-2026-0992

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Wed, 21 Jan 2026 11:05:54 -0330

libxml2 (2.14.5+dfsg-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Update to the 2.14 branch 20250826. Closes: #1111626, #1111803.
  * Fix nopython build profile (Helmut Grohne). Closes: #1078673.

 -- Matthias Klose <doko@debian.org>  Tue, 26 Aug 2025 09:31:15 +0200

libxml2 (2.14.5+dfsg-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Update to the 2.14 branch 20250812.
    - CVE-2025-7425: tree: Guard against atype corruption.

 -- Matthias Klose <doko@debian.org>  Wed, 13 Aug 2025 11:52:25 +0200

libxml2 (2.14.5+dfsg-0exp2) experimental; urgency=medium

  * Non-maintainer upload.
  * Explicity configure with --enable-static and install the static
    libxml2.a library. LP: #2118828.

 -- Matthias Klose <doko@debian.org>  Mon, 28 Jul 2025 13:55:39 +0200

libxml2 (2.14.5+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Sat, 19 Jul 2025 11:38:53 +0200

libxml2 (2.14.4+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Sat, 05 Jul 2025 20:59:44 +0200

libxml2 (2.14.3+dfsg-0exp3) experimental; urgency=medium

  * Non-maintainer upload.
  * parser: Fix custom SAX parsers without cdataBlock handler.
    Patch taken from the 2.14 branch. Closes: #1106645.

 -- Matthias Klose <doko@debian.org>  Tue, 03 Jun 2025 21:43:20 +0200

libxml2 (2.14.3+dfsg-0exp2) experimental; urgency=medium

  * Non-maintainer upload.
  * Explicity configure --with-http --with-lzma.
  * Update symbols file.

 -- Matthias Klose <doko@debian.org>  Mon, 02 Jun 2025 13:38:30 +0200

libxml2 (2.14.3+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Tue, 20 May 2025 07:13:43 +0200

libxml2 (2.14.2+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Matthias Klose <doko@debian.org>  Wed, 23 Apr 2025 07:52:17 +0200

libxml2 (2.14.1+dfsg-0exp1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release. Addresses: #1102294.
  * New package libxml2-16 with new soname.
  * No more conflicts/breaks replaces with libxml2.
  * Update symbols file.
  * Refresh patches.
  * Configure without ICU, see 2.12.7+dfsg+really2.9.14-0.4.
  * Configure --with-readline; --with-history requires it.

 -- Matthias Klose <doko@debian.org>  Mon, 07 Apr 2025 13:48:29 +0200

libxml2 (2.13.3+dfsg-0exp2) experimental; urgency=medium

  * d/control: add Provides: libxml2 (= ${source:Version})
    temporarily to reduce breakage during transition

 -- Aron Xu <aron@debian.org>  Sat, 24 Aug 2024 18:13:02 +0800

libxml2 (2.13.3+dfsg-0exp1) experimental; urgency=medium

  * New upstream release
  * Rename binary package libxml2 to libxml2n for new ABI without
    bumping the actual library SONAME

 -- Aron Xu <aron@debian.org>  Fri, 16 Aug 2024 22:13:37 +0800

libxml2 (2.13.1+dfsg-0exp1) experimental; urgency=medium

  * New upstream release
  * d/libxml2.symbols: update symbols

 -- Aron Xu <aron@debian.org>  Sat, 29 Jun 2024 14:45:40 +0800

libxml2 (2.12.7+dfsg-3) unstable; urgency=medium

  * d/control: replace pkg-config with pkgconf
  * source: override invalid-profile-name-in-source-relation noi18n
  * d/control: versioned Breaks at libxml-libxml-perl

 -- Aron Xu <aron@debian.org>  Wed, 29 May 2024 21:25:11 +0800

libxml2 (2.12.7+dfsg-2) unstable; urgency=medium

  * d/control: Depends on liblzma-dev and zlib1g-dev explicitly
    (Closes: #1071834)

 -- Aron Xu <aron@debian.org>  Sat, 25 May 2024 22:51:40 +0800

libxml2 (2.12.7+dfsg-1) unstable; urgency=medium

  * New upstream version 2.12.7+dfsg
  * CVE-2024-34459: buffer over-read in xmlHTMLPrintFileContext
    (Closes: 1071162).

 -- Aron Xu <aron@debian.org>  Sat, 25 May 2024 11:38:42 +0800

libxml2 (2.12.6+dfsg-0exp2) experimental; urgency=medium

  * Really fix libxml2mod import problem

 -- Aron Xu <aron@debian.org>  Tue, 19 Mar 2024 01:26:06 +0800

libxml2 (2.12.6+dfsg-0exp1) experimental; urgency=medium

  * New upstream version 2.12.6+dfsg
  * d/patches: add python-libadd-fix.patch (Closes: #1059094)
  * d/control: add python3-setuptools to B-D
  * d/rules: disable config.cache caching to make it happy to switch among Python versions
  * d/rules: build extensions for all supported Python3 versions

 -- Aron Xu <aron@debian.org>  Tue, 19 Mar 2024 01:09:12 +0800

libxml2 (2.12.5+dfsg-0exp1) experimental; urgency=medium

  * New upstream version 2.12.5+dfsg
  * d/rules: configure with --with-legacy --with-ftp --with-xptr-locs
    (Closes: #1059040)
  * d/libxml2.symbols: update
  * d/libxml2-doc.doc-base: update html path
  * d/control: remove M-A: same from python3-libxml2

 -- Aron Xu <aron@debian.org>  Thu, 15 Feb 2024 17:44:46 +0800

libxml2 (2.12.3+dfsg-0exp1) experimental; urgency=medium

  [ Mattia Rizzolo ]
  * simplify list of html to install

  [ Bastian Germann ]
  * No icu dependency with noi18n build profile (Closes: #962464)

  [ Aron Xu ]
  * New upstream version 2.12.3+dfsg
  * Remove not needed patches
  * Refresh xml2-config-fix.patch
  * Update d/libxml2-dev.{install,manpages}
  * d/rules: update * remove __pycache__ directory from d/tmp *
    no need to remove files from dh_auto_install-indep
  * d/libxml2.symbols: update symbols
  * Update std-ver to 3.6.2, no change required
  * add source lintian override for documentation HTMLs
  * Update doc-base file to current location
  * Remove links that are not needed anymore
  * Remove lintian overrides that are not needed
  * d/rules: add a dfsg-source-tree target to clean up upstream tree

 -- Aron Xu <aron@debian.org>  Thu, 14 Dec 2023 11:55:58 +0800

libxml2 (2.9.14+dfsg-1) unstable; urgency=high

  * Team upload.
  * New upstream version 2.9.14+dfsg.
    + Integer overflows in xmlBuf/xmlBuffer.  CVE-2022-29824 Closes: #1010526

 -- Mattia Rizzolo <mattia@debian.org>  Thu, 05 May 2022 14:43:51 +0200

libxml2 (2.9.13+dfsg-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 2.9.13+dfsg.
    + Convert devhelp to version2.  Closes: #955205
    + Use-after-free of ID and IDREF attrs.  CVE-2022-23308; Closes: #1006489
  * Bump my copyright for debian/*.
  * d/watch: move download sourceto https://download.gnome.org/.

 -- Mattia Rizzolo <mattia@debian.org>  Sun, 27 Feb 2022 19:57:48 +0100

libxml2 (2.9.12+dfsg-6) unstable; urgency=medium

  * Team upload.
  * d/control:
    + Use the new Description field in the source paragraph and add references
      to the binary paragraphs.  This is a new feature since dpkg 1.19.0
      (from 2017).  Policy is not yet updated, see #998165.
    + Drop Build-Depends on python3-all-dbg, not used since the last revision.
  * Add patches from upstream to fix:
    + return code of xmllint when incorrectly called.  Closes: #727075
    + regression with entity references in external DTDs.  Closes: #994765

 -- Mattia Rizzolo <mattia@debian.org>  Sat, 19 Feb 2022 13:11:26 +0100

libxml2 (2.9.12+dfsg-5) unstable; urgency=medium

  * Team upload.
  * Stop building the python3-libxml2-dbg package.  Closes: #994307
  * Add a Conflicts against the old w3c-dtd-xhtml, that contains a .dtd that
    is not validating anymore.  Closes: #993638
  * Remove lintian override that was fixed in lintian for
    debian-rules-uses-supported-python-versions-without-python-all-build-depends

 -- Mattia Rizzolo <mattia@debian.org>  Mon, 20 Sep 2021 15:06:01 +0200

libxml2 (2.9.12+dfsg-4) unstable; urgency=medium

  * Team upload.
  * Add a few patches from upstream:
    + Work around lxml API abuse.
    + Fix regression in xmlNodeDumpOutputInternal.  LP: #1943277
    + Fix whitespace when serializing empty HTML documents.
    + Forbid epsilon-reduction of final states.
    + Fix buffering in xmlOutputBufferWrite.

 -- Mattia Rizzolo <mattia@debian.org>  Fri, 10 Sep 2021 22:13:09 +0200

libxml2 (2.9.12+dfsg-3) unstable; urgency=medium

  * Team upload.
  * Upload to unstable.
  * Add patch from upstream to fix a regression in the recursion limit for
    complex XSLT documents.  This also fixed the ruby-nokogiri test failure,
    so drop the previously introduced Breaks.
  * d/control: Bump Standards-Version to 4.6.0, no changes needed.

 -- Mattia Rizzolo <mattia@debian.org>  Wed, 01 Sep 2021 16:45:21 +0200

libxml2 (2.9.12+dfsg-2) experimental; urgency=medium

  * Team upload.
  * d/control: Break ruby-nokogiri (<< 1.11.7).
  * lintian:
    + Add a link from usr/share/doc/libxml2/gtk-doc
      usr/share/gtk-doc/html/libxml2.  See #970275
    + Override for package-contains-documentation-outside-usr-share-doc.
  * Add two patches to refactor how docs are installed.
  * Add a patch to properly install all the documentation we were
    previously manually installing.
  * d/rules: Use the now working --docdir flag to install the documentation
    directly in the right place.
  * Move the documentation and examples from /usr/share/doc/libxml2-doc
    to /usr/share/doc/libxml2/, following Policy v3.9.7 §12.3.

 -- Mattia Rizzolo <mattia@debian.org>  Thu, 29 Jul 2021 12:22:11 +0200

libxml2 (2.9.12+dfsg-1) experimental; urgency=medium

  * Team upload.
  * New upstream version 2.9.12+dfsg.
  * Drop patches applied upstream.
  * d/libxml2.symbols: Add a new symbol.
  * d/control: Bump Standards-Version to 4.5.1, no changes needed.
  * d/rules:
    + Bump shlibs version.
    + Drop the --as-needed linking flag, the default starting from bullseye.

 -- Mattia Rizzolo <mattia@debian.org>  Sun, 18 Jul 2021 15:33:26 +0200

libxml2 (2.9.10+dfsg-6.7) unstable; urgency=medium

  * Non-maintainer upload.
  * Patch for security issue CVE-2021-3541 (Closes: #988603)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 22 May 2021 08:21:29 +0200

libxml2 (2.9.10+dfsg-6.6) unstable; urgency=medium

  * Non-maintainer upload.
  * Upload to unstable.

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 06 May 2021 10:48:16 +0200

libxml2 (2.9.10+dfsg-6.5) experimental; urgency=medium

  * Non-maintainer upload.
  * Propagate error in xmlParseElementChildrenContentDeclPriv (CVE-2021-3537)
    (Closes: #988123)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 06 May 2021 10:28:10 +0200

libxml2 (2.9.10+dfsg-6.4) experimental; urgency=medium

  * Non-maintainer upload.
  * Fix use-after-free with `xmllint --html --push` (CVE-2021-3516)
    (Closes: #987739)
  * Validate UTF8 in xmlEncodeEntities (CVE-2021-3517) (Closes: #987738)
  * Fix user-after-free with `xmllint --xinclude --dropdtd` (CVE-2021-3518)
    (Closes: #987737)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 02 May 2021 16:23:29 +0200

libxml2 (2.9.10+dfsg-6.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Remove the Python2 autopkg test.

 -- Matthias Klose <doko@debian.org>  Sun, 29 Nov 2020 11:58:00 +0100

libxml2 (2.9.10+dfsg-6.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix out-of-bounds read with 'xmllint --htmlout' (CVE-2020-24977)
    (Closes: #969529)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 25 Oct 2020 13:56:23 +0100

libxml2 (2.9.10+dfsg-6.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix build with Python 3.9. Closes: #972022.

 -- Matthias Klose <doko@debian.org>  Wed, 14 Oct 2020 08:45:25 +0200

libxml2 (2.9.10+dfsg-6) unstable; urgency=medium

  * Team upload.

  [ Mattia Rizzolo ]
  * Drop Python2 support.  Closes: #936941
  * Use dh-sequence-python3 to at least simplify one line of d/rules.
  * Bump debhelper compat level to 13.
    + Drop dh_missing override, dh13 defaults to --fail-missing.

  [ Debian Janitor ]
  * Use correct machine-readable copyright file URI.
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.
  * Rely on pre-initialized dpkg-architecture variables.

 -- Mattia Rizzolo <mattia@debian.org>  Fri, 04 Sep 2020 23:05:12 +0200

libxml2 (2.9.10+dfsg-5) unstable; urgency=medium

  * Team upload.

  [ Mattia Rizzolo ]
  * d/rules:
    + Drop --disable-silent-rules, already passed by dh_auto_configure.
    + Drop --parallel, now default with debhelper compat > 10.
    + Use dh_installdocs and dh_installexamples to install docs and examples.
    + Use dh_missing --fail-missing (and add the relevant d/not-installed).
    + Minimize indep build to build only the docs.
  * d/watch: fix an option to avoid a warning message.
  * d/control:
    + Move most of the build-deps to Build-Depends-Arch.
    + Use ${python:Depends} also for python-libxml2-dbg.
  * Add a lintian override for
    debian-rules-uses-supported-python-versions-without-python-all-build-depends

  [ Gunnar Hjalmarsson ]
  * d/p/python3-unicode-errors.patch:
    Fix segfault issue with itstool and py3.  LP: #1869814

 -- Mattia Rizzolo <mattia@debian.org>  Fri, 10 Apr 2020 14:53:23 +0200

libxml2 (2.9.10+dfsg-4) unstable; urgency=medium

  * Team upload.
  * Add patch from upstream to prevent a segfault in some platforms with
    illegal documents.

 -- Mattia Rizzolo <mattia@debian.org>  Thu, 27 Feb 2020 19:21:45 +0100

libxml2 (2.9.10+dfsg-3) unstable; urgency=medium

  * Team upload.
  * Add patch so that xml2-config only disaplys libraries needed for dynamic
    linking.  Closes: #952115

 -- Mattia Rizzolo <mattia@debian.org>  Sun, 23 Feb 2020 12:08:21 +0100

libxml2 (2.9.10+dfsg-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix memory leak in xmlSchemaValidateStream (CVE-2019-20388)
    (Closes: #949583)
  * Fix infinite loop in xmlStringLenDecodeEntities (CVE-2020-7595)
    (Closes: #949582)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 22 Feb 2020 23:36:57 +0100

libxml2 (2.9.10+dfsg-2) unstable; urgency=medium

  * Team upload
  * Re-instate Python2 support for now, the rev-deps are not ready.
    Re-opens: #936941
  * python-libxml2-dbg: Depend on python2-dbg instead of python-dbg.
    Closes: #948493
  * d/control: Bump Standards-Version 4.5.0, no changes needed.
  * Re-instnate the xml2-config script for now.
  * Upload to unstable.

 -- Mattia Rizzolo <mattia@debian.org>  Fri, 21 Feb 2020 14:45:03 +0100

libxml2 (2.9.10+dfsg-1) experimental; urgency=medium

  * Team upload.
  * New upstream version 2.9.10+dfsg.
    + Fix memory leak.  CVE-2019-19956
  * Drop all patches.
  * d/control:
    + Bump debhelper compat level to 12.
    + Bump Standards-Version to 4.4.1, no changes needed.
  * d/libxml2.symbols: add Build-Depends-Package field, by lintian.

 -- Mattia Rizzolo <mattia@debian.org>  Mon, 25 Nov 2019 16:48:13 +0100

libxml2 (2.9.9+dfsg1-1~exp2) experimental; urgency=medium

  * Team upload.
  * Merge the lost uploads 2.9.7+dfsg-1 and 2.9.8+dfsg-1.

 -- Mattia Rizzolo <mattia@debian.org>  Tue, 19 Nov 2019 14:53:11 +0100

libxml2 (2.9.9+dfsg1-1~exp1) experimental; urgency=medium

  [ Rene Engelhard ]
  * actually remove the override_dh_gencontrol (thanks mattia)...

  [ Aron Xu ]
  * New upstream version 2.9.9+dfsg1
    + Fix infinite loop in LZMA decompression.  CVE-2018-9251; Closes: #895195
    + Fix (another) infinite loop in LZMA decompression.  CVE-2018-14567
    + Fix nullptr deref with XPath logic ops.  CVE-2018-14404; Closes: #901817
  * Remove patches merged upstream
  * Update symbols
  * Remove python2 support  Closes: #936941

 -- Aron Xu <aron@debian.org>  Tue, 29 Oct 2019 10:08:51 +0000

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libxml2-doc`.
