dcmtk (3.7.0+really3.7.0-6) unstable; urgency=medium

  * CVE-2026-12805.patch: new: fix CVE-2026-12805.
    This patch fixes a risk of buffer overflow by ensuring negative error
    codes in XMLNode::parseFile are properly handled, as well a NULL
    values. (Closes: #1140562)

 -- Étienne Mollier <emollier@debian.org>  Mon, 22 Jun 2026 22:22:11 +0200

dcmtk (3.7.0+really3.7.0-5) unstable; urgency=high

  * CVE-2026-10194.patch: new: fix CVE-2026-10194. (Closes: #1139181)
  * d/control: add myself to uploaders.

 -- Étienne Mollier <emollier@debian.org>  Mon, 08 Jun 2026 19:14:40 +0200

dcmtk (3.7.0+really3.7.0-4) unstable; urgency=medium

  * Team upload.
  * Revert "CVE-2026-10528-partial.patch: new: fix needed by orthanc."
    The change is causing an ABI breakage that is going to require a
    transition.  It is probably more appropriate to wait for the 3.7.1
    release and coordinate the transition on a sane basis.  In the
    meantime the change is undone.

 -- Étienne Mollier <emollier@debian.org>  Thu, 04 Jun 2026 22:13:25 +0200

dcmtk (3.7.0+really3.7.0-3) unstable; urgency=medium

  * Team upload.

  [ Pino Toscano ]
  * d/patches/hurd.patch: new, fix the build on GNU/Hurd.

  [ Étienne Mollier ]
  * CVE-2026-5663.patch: new: fix CVE-2026-5663.
    This change introduces guardrails to prevent risks of shell code
    injection. (Closes: #1133001)
  * CVE-2026-10528-partial.patch: new: fix needed by orthanc.
    This patch introduce the part of the mitigation against CVE-2026-10528
    affecting orthanc that needs to be applied on the side of dcmtk.  See
    also Debian bug #1138713.

 -- Étienne Mollier <emollier@debian.org>  Wed, 03 Jun 2026 21:54:21 +0200

dcmtk (3.7.0+really3.7.0-2) unstable; urgency=medium

  * Team upload.
  * Use dh-cruft to register obsolete files to purge
  * Update standards version to 4.7.4, no changes needed.

  [ Luca Boccassi ]
  * Stop deleting system user/group on remove/purge
  * Install and use sysusers.d/tmpfiles.d config files

 -- Alexandre Detiste <tchet@debian.org>  Thu, 14 May 2026 19:57:27 +0200

dcmtk (3.7.0+really3.7.0-1) unstable; urgency=medium

  * Team upload.
  * Migrate from experimental to unstable after the Go for transition.
  * d/copyright: provide working links to the AFPL.
    The original link from the legal text broke some time ago.
    The AFPL does not have to apply in that context anyways.
  * skip-bigendian-roundtrip-failure.patch: short form BTS URI.
  * d/u/metadata: eprint → Eprint.
  * d/control: drop libdcmtk20 breaking and replacing libdcmtk19.
    After examination of the situation, the stanza was needed against the
    faulty 3.7.0-1, but it is not needed on 3.7.0+really3.6.9-1.

 -- Étienne Mollier <emollier@debian.org>  Fri, 10 Apr 2026 19:41:34 +0200

dcmtk (3.7.0+really3.7.0-0+exp1) experimental; urgency=medium

  * Team upload
  * d/rules: guard against accidental ABI breakages.
  * New upstream version 3.7.0: fixes CVE-2025-14607 and CVE-2025-14841.
    (Closes: #1122926, #1123584, #1060677)
  * d/*: soname bump to libdcmtk20.
  * d/control: libdcmtk20 replaces libdcmtk19.
  * skip-bigendian-roundtrip-failure.patch: new: skip test failure on s390x.
    The correction is work in progress upstream.

 -- Étienne Mollier <emollier@debian.org>  Wed, 18 Feb 2026 21:22:40 +0100

dcmtk (3.7.0+really3.6.9-1) unstable; urgency=medium

  * Team upload.
  * Undo upload of version 3.7.0 that caused ABI breakage by rolling
    back to the state of 3.6.9-6.  Note this undoes mitigations against
    CVE-2025-14607 and CVE-2025-14841 (and reopens #1122926, #1123584,
    #1060677) (Closes: #1127756)

 -- Étienne Mollier <emollier@debian.org>  Thu, 12 Feb 2026 19:47:48 +0100

dcmtk (3.7.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 3.7.0: fixes CVE-2025-14607 and CVE-2025-14841.
    (Closes: #1122926, #1123584, #1060677)
  * d/copyright: refresh following new upstream release.
  * *-CVE-*.patch: delete: all security issues are fixed upstream.
  * 07_dont_export_all_executables.patch: unfuzz.
  * d/control: drop redundant Priority: optional.
  * d/control: declare compliance to standards version 4.7.3.
  * d/dcmtk-doc.doc-base: update upstream version.

 -- Étienne Mollier <emollier@debian.org>  Wed, 11 Feb 2026 18:32:36 +0100

dcmtk (3.6.9-6) unstable; urgency=medium

  * Team upload.
  * d/rules: cleanup a stray "noname" file. (Closes: #1122403)
  * d/patches/*-CVE-2025-9732.patch: new.
    These changes pulled from dcmtk upstream address CVE-2025-9732.
    (Closes: #1113993)
  * d/watch: convert to v5 Github template.
  * d/control: drop redundant Rules-Requires-Root: no.
  * d/control: declare compliance to standards version 4.7.2.
  * d/libdcmtk19.lintian-overrides: fix typo caught by lintian.

 -- Étienne Mollier <emollier@debian.org>  Wed, 10 Dec 2025 22:34:17 +0100

dcmtk (3.6.9-5) unstable; urgency=medium

  * d/control: relax dependency on dcmtk-data. Closes: #1098944
  * 0012-CVE-2025-2357.patch: new: fix CVE-2025-2357. (Closes: #1100724)
  * documentation: Spring cleanups. Closes: #1095639

 -- Mathieu Malaterre <malat@debian.org>  Fri, 21 Mar 2025 12:45:44 +0100

dcmtk (3.6.9-4) unstable; urgency=medium

  * Team upload.
  * Reinstate 0007-CVE-2024-47796.patch and 0008-CVE-2024-52333.patch.
    These were not part of dcmtk 3.6.9 upstream and still apply.
    Thanks to Salvatore Bonaccorso
  * 0009-CVE-2025-25475.patch: new: fix CVE-2025-25475. (Closes: #1098373)
  * 0010-CVE-2025-25474.patch: new: fix CVE-2025-25474. (Closes: #1098374)
  * 0011-CVE-2025-25472.patch: new: fix CVE-2025-25472.

 -- Étienne Mollier <emollier@debian.org>  Wed, 19 Feb 2025 22:30:57 +0100

dcmtk (3.6.9-3) unstable; urgency=medium

  * d/patches: Remove old unused patches
  * d/doc: Make sure to reference 3.6.9 path
  * d/watch: Properly watch upstream on github

 -- Mathieu Malaterre <malat@debian.org>  Tue, 18 Feb 2025 12:05:41 +0100

dcmtk (3.6.9-2) experimental; urgency=medium

  * d/t/run-unit-test: Adapt to new installation

 -- Mathieu Malaterre <malat@debian.org>  Tue, 11 Feb 2025 08:12:50 +0100

dcmtk (3.6.9-1) experimental; urgency=medium

  * New upstream version 3.6.9
  * d/install: Migrate to new SOVERSION
  * d/patches: Refresh patches

 -- Mathieu Malaterre <malat@debian.org>  Thu, 30 Jan 2025 13:16:59 +0100

dcmtk (3.6.8-7) unstable; urgency=medium

  * Team upload.
  * 0001-Fixed-unchecked-typecasts-of-DcmItem-search-results.patch.
    Patch refreshed.
  * 0004-Fixed-two-segmentation-faults.patch: unfuzz.
  * 0007-CVE-2024-47796.patch: new.
    This patch addresses CVE-2024-47796. (Closes: #1093043)
  * 0008-CVE-2024-52333.patch: new.
    This patch addresses CVE-2024-52333. (Closes: #1093047)

 -- Étienne Mollier <emollier@debian.org>  Sat, 18 Jan 2025 16:30:29 +0100

dcmtk (3.6.8-6) unstable; urgency=medium

  * d/t/run-unit-test: Fix unit-test for new release. Closes: #1075917
  * d/patches: Fixed possible overflows when allocating memory. Closes: #1074483

 -- Mathieu Malaterre <malat@debian.org>  Mon, 08 Jul 2024 13:31:04 +0200

dcmtk (3.6.8-5) unstable; urgency=medium

  * Upload 3.6.8 to unstable
  * d/control: Bump Std-Vers to 4.7.0 no changes needed

 -- Mathieu Malaterre <malat@debian.org>  Fri, 05 Jul 2024 11:24:00 +0200

dcmtk (3.6.8-4) experimental; urgency=medium

  * d/rules: Add dcmtk-data package
  * d/control: Add missing dependency on libjs-jquery. Closes: #989108
  * d/control: Reduce number of dependencies for -dev package
  * New upstream version 3.6.8

 -- Mathieu Malaterre <malat@debian.org>  Mon, 24 Jun 2024 20:43:54 +0200

dcmtk (3.6.7-15) unstable; urgency=medium

  * Team upload.
  [ Adrian Bunk ]
  * Update two of the previously applied patches to avoid breaking the ABI.
    Closes: #1070207.

 -- Santiago Vila <sanvila@debian.org>  Mon, 24 Jun 2024 12:30:00 +0200

dcmtk (3.6.7-14) unstable; urgency=medium

  * Team upload.
  [ Emanuele Rocca ]
  * Do not drop graphviz from build-depends-indep for armhf and armel.
  [ Adrian Bunk ]
  * CVE-2024-28130: Segmentation faults due to incorrect typecast
    (Closes: #1070207)
  * CVE-2024-34508: Segmentation fault via invalid DIMSE message
  * CVE-2024-34509: Segmentation fault via invalid DIMSE message

 -- Santiago Vila <sanvila@debian.org>  Wed, 05 Jun 2024 14:30:00 +0200

dcmtk (3.6.7-13) unstable; urgency=medium

  * Team upload.
  * Marked Debian-specific patches as not needing forwarding to
    upstream.
  * d/control: add explicit dependency on libnsl-dev. Closes: #1066422.

 -- Michael R. Crusoe <crusoe@debian.org>  Tue, 19 Mar 2024 15:24:15 +0100

dcmtk (3.6.7-12) unstable; urgency=medium

  * Team upload.

  [ Emanuele Rocca ]
  * Do not build-depend on graphviz on armhf and armel. The package is
    currently not installable on those arches due to the ongoing t64
    transition. Closes: #1067147

 -- Michael R. Crusoe <crusoe@debian.org>  Tue, 19 Mar 2024 12:30:03 +0100

dcmtk (3.6.7-11) unstable; urgency=medium

  * Fix typo in target distribution during upload.

 -- Sebastien Jodogne <s.jodogne@gmail.com>  Tue, 19 Mar 2024 11:54:38 +0100

dcmtk (3.6.7-10) unreleased; urgency=medium

  * Fix build on armel.  Closes: #1060104

 -- Sebastien Jodogne <s.jodogne@gmail.com>  Tue, 19 Mar 2024 11:03:28 +0100

dcmtk (3.6.7-9.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1062022

 -- Michael Hudson-Doyle <mwhudson@debian.org>  Wed, 28 Feb 2024 01:17:02 +0000

dcmtk (3.6.7-9) unstable; urgency=medium

  * Team upload.
  * Fix postrm
    Closes: #1038776

 -- Andreas Tille <tille@debian.org>  Thu, 22 Jun 2023 09:53:48 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog dcmtk-data`.
