screen (4.9.1-1ubuntu1) noble-security; urgency=medium

  * SECURITY UPDATE: incorrect PTY permissions
    - debian/patches/CVE-2025-46802.patch: prevent temporary 0666 mode on
      PTYs in attacher.c, screen.c.
    - CVE-2025-46802
  * SECURITY UPDATE: minor information leak
    - debian/patches/CVE-2025-46804.patch: avoid file existence test
      information leaks in screen.c, socket.c.
    - CVE-2025-46804
  * SECURITY UPDATE: TOCTOU allowing to send SIGHUP, SIGCONT
    - debian/patches/CVE-2025-46805.patch: don't send signals with root
      privileges in socket.c.
    - CVE-2025-46805

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 22 Jan 2026 14:59:29 -0500

screen (4.9.1-1build1) noble; urgency=high

  * No change rebuild for 64-bit time_t and frame pointers.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 18:18:59 +0200

screen (4.9.1-1) unstable; urgency=low

  * Update upstream's PGP keys to sport the currently published keys.
  * New upstream bugfix release 4.9.1.
    + Refresh patches where needed.
    + Drop 90_fix_man_page_bash_example.patch, applied upstream.
    + Supports stop/parity bits on serial port. (Closes: #492741)
    + Avoid zombies after shell exit. (Closes: #991715)
    + [CVE-2023-24626] Fixes missing signal sending permission check on
      failed query messages when running setuid or setgid.
    + Multiple Unicode/UTF-8 fixes.

 -- Axel Beckert <abe@debian.org>  Thu, 07 Sep 2023 00:10:56 +0200

screen (4.9.0-4) unstable; urgency=medium

  [ Aurelien Jarno ]
  * Add patch to replace hardcoded Unicode wide character list with a
    dynamic check based on the current glibc's Unicode wide character
    knowledge. (Closes: #1027733)

  [ Unit 193 ]
  * Add patch from upstream bug report #62102 to support bracketed paste
    mode and cursor-style manipulation in Screen v4 as well. (Closes:
    #1019576)

  [ Axel Beckert ]
  * Declare compliance with Debian Policy 4.6.2. (No changes needed.)
  * Bump packaging copyright years in debian/control. Thanks Lintian!
  * Declare 60-screen-4.2.1-debian4.1.0-compatibility.patch as
    debian-specific.

 -- Axel Beckert <abe@debian.org>  Mon, 09 Jan 2023 04:56:37 +0100

screen (4.9.0-3) unstable; urgency=medium

  [ Helmut Grohne ]
  * Update /etc/shells using dpkg triggers. (Closes: #1023318)

  [ Axel Beckert ]
  * Update Helmut's patch to use more debhelper style file installing.
  * Drop lintian overrides for false positives fixed in Lintian.

 -- Axel Beckert <abe@debian.org>  Sun, 13 Nov 2022 05:09:57 +0100

screen (4.9.0-2) unstable; urgency=medium

  * Add patch to fix bash example in man page. (LP: #1986839) Thanks to
    Tired Sysadmin on Launchpad for the bug report and initial patch!
  * Bracketize lintian overrides.
  * Add lintian overrides for binary files in utf8encodings/.
  * Declare compliance with Debian Policy 4.6.1. (No changes needed.)

 -- Axel Beckert <abe@debian.org>  Wed, 24 Aug 2022 03:45:18 +0200

screen (4.9.0-1) unstable; urgency=low

  * Update debian/upstream/signing-key.asc with upstream PGP keys from
    https://savannah.gnu.org/project/memberlist-gpgkeys.php?group=screen
    + Remove C714ACA0297D9992 (Micah Cowan)
    + Replace 21F968DEF747ABD7 with 933AD21886F69FBF (Alexander Naumov)
    + Keep B708A383C53EF3A4 (Amadeusz Sławiński)
  * Import new upstream release 4.9.0.
    + Drop the following patches which were all applied upstream:
      - 52fix_screen_utf8_nfd.patch
      - 58-show-encoding-hardstatus.patch
      - 64-fix-manpage-typos-reported-by-lintian.patch
      - 90_Expand-d_xtermosc-array-in-struct-display.patch
      - 91_TERMCAP_BUF-is-used-in-place-of-TERMCAP_BUFSIZE.patch
      - 99_CVE-2021-26937.patch
    + Refresh the remaining patches as needed.
  * debian/copyright: Update copyright years based on section COPYLEFT in
    screen(1). Also update packaging copyright years. Thanks Lintian!
  * Update lintian overrides wrt. to new tag formatting.
  * Add lintian overrides for new very-long-line-length-in-source-file
    false positives.

 -- Axel Beckert <abe@debian.org>  Wed, 02 Feb 2022 04:38:15 +0100

screen (4.8.0-7) unstable; urgency=medium

  * Replace versioned build-dependency on transitional package
    libncursesw5-dev with unversioned build-dependency on
    libncurses-dev. Thanks Vincent Lefevre! (Closes: #991916)
  * Drop override_dh_strip: --dbgsym-migration is no more needed as
    screen-dbgsym was already in Debian 9 Stretch. (Thanks Lintian!)
  * Declare compliance with Debian Policy 4.6.0. (No changes needed.)

 -- Axel Beckert <abe@debian.org>  Thu, 02 Sep 2021 02:25:13 +0200

screen (4.8.0-6) unstable; urgency=medium

  * autopkgtest: Add a "sleep 1" before "Session is gone" check. Avoids
    a race condition on heavily loaded systems.
  * Replace 52fix_screen_utf8_nfd.patch with a patch by Michael Schröder
    and reenable it. (Closes: #600246 without reopening #677512; Culrpit
    was the same upstream commit as the one which caused CVE-2021-26937.)
  * Add additional autopkgtests, testing for regressions of #600246,
    #677512, #982435 (CVE-2021-26937) and some other regressions found in
    earlier patch propositions for CVE-2021-26937.
  * Update cause and impact description of CVE-2021-26937 in 4.8.0-4 with
    a shortened variant of the wording that is used by MITRE.

 -- Axel Beckert <abe@debian.org>  Sat, 27 Feb 2021 01:52:03 +0100

screen (4.8.0-5) unstable; urgency=medium

  * Replace my homegrown patch for CVE-2021-26937 (#982435) with the third
    incarnation of the patch proposed by Michael Schröder of SUSE.  It's
    the first proposed patch which so far showed no regressions.

 -- Axel Beckert <abe@debian.org>  Fri, 12 Feb 2021 00:07:18 +0100

screen (4.8.0-4) unstable; urgency=low

  * Update URL in 52fix_screen_utf8_nfd.patch by following the redirect.
  * [CVE-2021-26937] Fix invalid write access and crash or possibly
    unspecified other impact via a crafted UTF-8 character sequence.
    (Closes: #982435; urgency=low to get more exposure for that patch.)

 -- Axel Beckert <abe@debian.org>  Wed, 10 Feb 2021 22:25:44 +0100

screen (4.8.0-3) unstable; urgency=medium

  * Declare compliance with Debian Policy 4.5.1. (No changes needed.)
  * Drop lintian overrides for no more emitted hyphen-used-as-minus-sign.
  * Add lintian overrides for new false positives of:
    + bogus-mail-host-in-debian-changelog (see #966295)
    + national-encoding (on purpose, documentation on national encoding)
  * Bump debian/watch version from 3 to 4. Thanks Lintian!
  * Retroactively mention #915121 in the 4.7.0-1 debian/changelog entry.

 -- Axel Beckert <abe@debian.org>  Mon, 14 Dec 2020 03:21:06 +0100

screen (4.8.0-2) unstable; urgency=medium

  * Add CVE number to previous changelog entry.
  * Add a debian/gitlab-ci.yml.
  * Bump debhelper-compat to 13.
    + Rename debian/screen.screen-cleanup.tmpfile to
      debian/screen.screen-cleanup.tmpfiles.
    + Replace override_dh_installsystemd with override_dh_installtmpfiles.
  * Cherry-pick the two one-line upstream fixes from the screen-v4 branch.
  * Drop preinst needed for some path migration in 2007.
    + Drop related lintian override.

 -- Axel Beckert <abe@debian.org>  Tue, 26 May 2020 03:50:33 +0200

screen (4.8.0-1) unstable; urgency=medium

  * Import new upstream release 4.8.0.
    + CVE-2020-9366: Fixes out of bounds access when setting w_xtermosc
      after OSC 49. (Closes: #950896)
    + Refresh patches where needed.
  * Declare compliance with Debian Policy 4.5.0. (No changes needed.)

 -- Axel Beckert <abe@debian.org>  Sat, 08 Feb 2020 02:16:54 +0100

screen (4.7.0-1) unstable; urgency=low

  * Add a bug script to answer the most common questions to screen bug
    reports automatically.
  * Follow lintian tag renaming in lintian overrides.
  * Override init.d-script-does-not-source-init-functions for
    screen-cleanup, too. Its function on the systemd side is covered by
    /etc/tmpfiles.d/screen-cleanup.conf and
    /lib/systemd/system/screen-cleanup.service.
  * Add comments on top of /etc/tmpfiles.d/screen-cleanup.conf stating
    that this file is generated by maintainer scripts. (Closes: #890823)
  * Import new upstream release 4.7.0.
    + Drop 90_cherrypick-d340b02c_do-not-liunk-against-libelf.patch.
    + Refresh remaining patches as necessary.
    + Updates Unicode support to 12.1.0. (Closes: #882340)
    + Fixes cross-compilation support. (Closes: #917627)
    + Adds support for SGR (1006) mouse mode. (Closes: #850962)
    + Contains a revamped man page. (Closes: #915121)
  * Declare compliance with Debian Policy 4.4.1. (No changes needed.)
  * Bump debhelper compatibility level to 12.
    + Build-depend on "debhelper-compat (= 12)" to replace debian/compat.

 -- Axel Beckert <abe@debian.org>  Wed, 02 Oct 2019 02:14:56 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog screen`.
