freerdp3 (3.28.0+dfsg-2) unstable; urgency=medium

  * d/tests/connect: stop enforcing TLS security
    apparently xrdp does not work with TLS at all, see #1138658.

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 12 Jul 2026 00:44:33 +0300

freerdp3 (3.28.0+dfsg-1) unstable; urgency=medium

  * new upstream release, fixing a number of (security) issues
  * d/copyright: remove stale entry from Files-Excluded
  * d/*.symbols: add new symbols

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 06 Jul 2026 11:06:13 +0300

freerdp3 (3.27.1+dfsg-1) unstable; urgency=medium

  [ Jeremy Bícha ]
  * Don't build sso-mib feature on i386

  [ Grayson Wolf ]
  * fix test failures by enforcing TLS security

  [ Michael Tokarev ]
  * Revert "Don't build sso-mib feature on i386"
  * stop disabling PKCS11 on ubuntu (Closes: #1140689)
  * new upstream bugfix release 3.27.1
    Hopefully closes: #1138658 (xrdp debci failure)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 30 Jun 2026 09:34:23 +0300

freerdp3 (3.27.0+dfsg-1) unstable; urgency=medium

  * a major feature/bugfix/cleanup upstream release, including:
   - TLS seclevel now defaults to 2 and a minimum of TLS 1.2 is required
   - Enhancements with Azure/Entra support
   - keyboard mapping
   - Allow RDPDR channel to pass additional arguments to the channel
   - Some client side statistics logging API was added
   - security fixes:
    - Heap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly
      due to alloc_hint capacity mismatch
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx
    - Heap-buffer-overflow write in TS Gateway RPC fragment receive
      due to uncapped bind_ack max_xmit_frag
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rp4-66mc-j9vx
    - Out-of-bounds read in H.264 YUV-to-RGB conversion
      due to decoder/surface dimension mismatch
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6
    - Heap-buffer-overflow write in AVC444 YUV buffer allocation
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr
    - integer Overflow in `freerdp_image_copy_from_icon_data`
      Bypasses Bounds Check
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-h2f6
  * add new symbols to: libfreerdp, libfreerdp-client, libfreerdp-server-proxy,
    libwinpr
  * Revert "d/rules: -DWITH_INTERNAL_MD4=ON, due to libssl/libcrypto does not
    provide it (anymore?)" -- this was an issue in freerdp, now fixed
  * update previous changelog entry to include mentions of security fixes

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 16 Jun 2026 09:02:32 +0300

freerdp3 (3.26.0+dfsg-1) unstable; urgency=medium

  * new upstream release, with 3 High ranking vulnerability fixes:
    CVE-2026-44420 FreeRDP cliprdr server heap-buffer-overflow
      via undersized capabilitySetLength in CB_CLIP_CAPS
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvpx-xj7r-3p3r
    FreeRDP RDPGFX CacheToSurface heap-buffer-overflow via
      clamped-rectangle validation bypass
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r2-4hgm-m6ff
    CVE-2026-45700 Heap-buffer-overflow write in planar bitmap decoder
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mpxh-8fq3-x8mh
    Use After Free and Concurrent Execution using Shared Resource with
      Improper Synchronization ('Race Condition') in FreeRDP
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mv2-5q57-2v8h
    FreeRDP RDPEAR NDR ref-id aliasing causes client-side UAF/double-free
      and type confusion
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j9q5-7g8m-jc9v
  * d/copyright: remove Files-Excluded: scripts/android-*
  * d/patches/: remove
  * d/control,d/rules: drop sdl2 support (pkg.freerdp3.sdl2 build profile)
  * d/rules: -DWITH_INTERNAL_MD4=ON (enable internal md4),
    due to libssl/libcrypto does not provide it (anymore?)
  * d/libfreerdp-client3-3.symbols: add new symbol

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 06 May 2026 12:32:12 +0300

freerdp3 (3.25.0+dfsg-5) unstable; urgency=medium

  * core-instance-fix-deprecation-guards.patch: another fix
    for deprecated symbols
  * 2 patches from upstream to fix linking with libsso-mib (Closes: #1135164)
  * fuse is linux-only

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 30 Apr 2026 20:35:20 +0300

freerdp3 (3.25.0+dfsg-4) unstable; urgency=medium

  * AuthenticateEx-Deprecation.diff: update from the actual upstream commit

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 26 Apr 2026 18:53:50 +0300

freerdp3 (3.25.0+dfsg-3) unstable; urgency=medium

  [ Luca Boccassi ]
  * Enable FIDO2/WebAuthN passthrough

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 25 Apr 2026 19:30:01 +0300

freerdp3 (3.25.0+dfsg-2) unstable; urgency=medium

  * AuthenticateEx-Deprecation.diff: fix wrong deprecation condition

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 25 Apr 2026 19:06:48 +0300

freerdp3 (3.25.0+dfsg-1) unstable; urgency=medium

  * new upstream release, with the following fixes:
    CVE-2026-40254 drive channel path traversal via terminal ..
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx
  * update .symbols files (add new symbols, and drop +dfsg-1 from existing)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 24 Apr 2026 21:30:05 +0300

freerdp3 (3.24.2+dfsg-1) unstable; urgency=medium

  * new upstream bugfix/security release:
    CVE-2026-33952 DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93
    CVE-2026-33977 DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5
    CVE-2026-33995 double free in kerberos_AcceptSecurityContext
      and kerberos_IntitalizeSecurityContextA
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx
    CVE-2026-33984 ClearCodec resize_vbar_entry() Heap OOB Write
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8469-2xcx-frf6
    CVE-2026-33983 Progressive Codec Quant BYTE Underflow - UB + CPU DoS
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gfm-4p52-h478
    CVE-2026-33985 ClearCodec Glyph Cache Count Desync - Heap OOB Read
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x6gr-8p7h-5h85
    CVE-2026-33986 H.264 YUV Buffer Dimension Desync - Heap OOB Write
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h6qw-wxvm-hf97
    CVE-2026-33987 Persistent Cache bmpSize Desync - Heap OOB Write
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ff8h-p5vc-wcwc
    CVE-2026-33982 Persistent Cache Allocator Mismatch - Heap OOB Read
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jm9-2925-g4v2

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 25 Mar 2026 20:00:40 +0300

freerdp3 (3.24.1+dfsg-1) unstable; urgency=medium

  * new upstream bugfix release
  * remove patches

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 18 Mar 2026 13:14:14 +0300

freerdp3 (3.24.0+dfsg-2) unstable; urgency=medium

  * winpr-sam-fix-reading-SAM-entries.patch:
    fix regression with gnome-remote-desktop testsuite

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 15 Mar 2026 00:04:01 +0300

freerdp3 (3.24.0+dfsg-1) unstable; urgency=medium

  * new upstream release, with enhancements, bugfixes, and more security fixes:
    CVE-2026-29774 Heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5q35-hv9x-7794
    CVE-2026-29775 Heap-buffer-overflow in bitmap_cache_put via OOB cacheId
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h666-rfw3-jhvj
    CVE-2026-29776 Integer Underflow in update_read_cache_bitmap_order
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c747-x4wf-cqrr
    CVE-2026-31806 (HIGH) Heap Buffer Overflow in nsc_process_message()
      via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrqm-46rj-cmx2
    CVE-2026-31883 `size_t` underflow in ADPCM decoder leads to
      heap-buffer-overflow write
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5
    CVE-2026-31884 Division-by-zero in ADPCM decoders when `nBlockAlign` is 0
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jp7m-94ww-p56r
    CVE-2026-31885 Out-of-bounds read in ADPCM decoders
      due to missing predictor/step_index bounds checks
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h23r-3988-3wf3
    CVE-2026-31897 Out-of-bounds read in `freerdp_bitmap_decompress_planar`
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xgv6-r22m-7c9x
  * d/libfreerdp3-3.symbols,d/libwinpr3-3.symbols: add new symbols
  * d/libfreerdp-client3-3.symbols: REMOVE unused symbols
     add_device del_device msusb_*
    These are internal symbols which should not be used
  * d/control, d/rules: libfuse is linux-only

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 13 Mar 2026 21:23:00 +0300

freerdp3 (3.23.0+dfsg-1) unstable; urgency=medium

  * new upstream release, with enhancements and more security fixes:
    CVE-2026-25941 Out-of-bounds read in rdpgfx_recv_wire_to_surface_2_pdu
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3546-x645-5cf8
    CVE-2026-25942 Global-buffer-overflow in xf_rail_server_execute_result
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78q6-67m7-wwf6
    CVE-2026-25952 Heap-use-after-free in xf_SetWindowMinMaxInfo
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x
    CVE-2026-25953 Heap-use-after-free in xf_AppUpdateWindowFromSurface
      (freed appWindow)
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6rq-rxpc-rh3p
    CVE-2026-25954 Heap-use-after-free in xf_rail_server_local_move_size
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6j
    CVE-2026-25955 Heap-use-after-free in xf_AppUpdateWindowFromSurface
      (stale XImage)
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x
    CVE-2026-25959 Heap-use-after-free in xf_cliprdr_provide_data_
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3c
    CVE-2026-25997 Heap-use-after-free in xf_clipboard_format_equal
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5j3-m6jf-3jq4
    CVE-2026-26271 Buffer Overread in FreeRDP Icon Processing
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hr4m-ph4g-48j6
      (note: there's apparently some issue linking the CVE# to this advisory)
    CVE-2026-26986 Heap-use-after-free in rail_window_free
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47
    CVE-2026-27015 Smartcard NDR Alignment Padding Triggers Reachable
      WINPR_ASSERT Abort (Client DoS)
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7g72-39pq-4725
    CVE-2026-26955 Heap Out-of-Bounds Write in ClearCodec Surface Command
      Handler via Missing Bounds Validation
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mr6w-ch7c-mqqj
    CVE-2026-26965 Heap Out-of-Bounds Write in Planar Bitmap RLE Decompression
      via Destination Offset
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5vgf-mw4f-r33h
  * libwinpr3-3.symbols, libfreerdp3-3.symbols,
    libfreerdp-server-proxy3-3.symbols: add newly appeared symbols
  * libfreerdp-shadow3-3.symbols: remove rdtk_* symbols.
    rdtk is now optional and defaults-off because it is unmaintained.
    It weren't used much anyway.  In debian, this library has no reverse
    dependencies outide of freerdp3.  So let's just drop these symbols for now,
    and if a problem occurs, we can fix it later

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 25 Feb 2026 17:24:26 +0300

freerdp3 (3.22.0+dfsg-3) unstable; urgency=medium

  * d/control: add libwinpr3-3:Replaces: libwinpr2-2 to override wlog.7.
    There's no upgrade path from freerdp2 in bookworm to freerdp3 in trixie,
    so if the user had freerdp2 installed in bookworm and upgraded the system
    to trixie, it is very likely they still have freerdp2 installed (obsolete
    package).  And the new libwinp3-3 ships the same manpage as the old
    libwinpr2-2.  Allow replacing this file when installing new libwinpr3-3.
    Do not add Breaks: though, since this way, all freerdp2 packages has to
    be removed (which might be a good thing in the end, but for that we ought
    to provide xfreerdp2 etc binaries too).  Also Breaks libwinpr2-2t64, since
    apparently some users managed to install the t64 packages on a bookworm
    system somehow.  (Closes: #1127622)
  * rename source package back to freerdp3.  It turned out this is too much
    pain (security tracker, bug reports, autopkgtests, etc) for nothing.
    Suggest renaming it to freerdp at freerdp4 time.

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 11 Feb 2026 12:08:45 +0300

freerdp (3.22.0+dfsg-2) unstable; urgency=medium

  * package rename.  We had freerdp, freerdp2, freerdp3, - due to big rewrite
    upstream from 1.x to 2.x which was going in parallel with 1.x, and it was
    unclear when 2.x will be ready.  Next, during 2.x to 3.x, it was a steady
    update, which stayed compatible with 2.x series.  But the project itself
    is named "freerdp" without any version suffix.  And we had no upgrade path
    from bookworm (which has freerdp2 only) to trixie (freerdp3 only).  There's
    no actual reason to carry the suffix, at least not anymore.  Let's name it
    "freerdp" without any suffix, and provide compatibility end-user packages
    with compatibility naming.  Rename source package from freerdp3 to freerdp
  * rename end-user binary packages: freerdp3-x11, freerdp3-sdl,
    freerdp3-wayland, freerdp3-proxy, freerdp3-proxy-modules, winpr3-utils
    to drop the "3" version suffix from both the name of the package and
    the name of the binary.  Provide transitional packages with old names,
    containing symlinks to new binaries
  * update CVE references in the previous changelog entry

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 10 Feb 2026 12:24:09 +0300

freerdp3 (3.22.0+dfsg-1) unstable; urgency=medium

  * new upstream major bugfix release, with overhaul of SDL3 client and
    multiple security fixes for the following client-side vulnerabilities:
    CVE-2026-23948 NULL Pointer Dereference in rdp_write_logon_info_v2()
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6f3c-qvqq-2px5
    CVE-2026-24491 Heap-use-after-free in video_timer
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4x6j-w49r-869g
    CVE-2026-24675 Heap-use-after-free in urb_select_interface
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x9jr-99h2-g7mj
    CVE-2026-24676 Heap-use-after-free in audio_format_compatible
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qh5p-frq4-pgxj
    CVE-2026-24677 Heap-buffer-overflow in ecam_encoder_compress_h264
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xw37-j744-f8v7
    CVE-2026-24678 Heap-use-after-free in cam_v4l_stream_capture_thread
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6gvg-29wx-6v7h
    CVE-2026-24679 Heap-buffer-overflow in urb_select_interface
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2jp4-67x6-gv7x
    CVE-2026-24680 Heap-use-after-free in update_pointer_new(SDL)
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j893-9wg8-33rc
    CVE-2026-24681 Heap-use-after-free in urb_bulk_transfer_cb
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ccvv-hg2w-6x9j
    CVE-2026-24682 Heap-buffer-overflow in audio_formats_free
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcw2-pqgw-mx6g
    CVE-2026-24683 Heap-use-after-free in ainput_send_input_event
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-45pf-68pj-fg8q
    CVE-2026-24684 Heap-use-after-free in play_thread
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vcgv-xgjp-h83q
  * update libfreerdp symbols file (add new symbols)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 29 Jan 2026 11:22:26 +0300

freerdp3 (3.21.0+dfsg-1) unstable; urgency=medium

  * new upstream release, with multiple security fixes for the following
    client-side vulnerabilities (medium):
    CVE-2026-23530: Heap buffer overflow in planar_decompress_plane_rle
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p
    CVE-2026-23531: Heap buffer overflow in clear_decompress
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xj5h-9cr5-23c5
    CVE-2026-23532: Heap buffer overflow in gdi_SurfaceToSurface
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fq8c-87hj-7gvr
    CVE-2026-23533: Heap buffer overflow in clear_decompress_residual_data
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-32q9-m5qr-9j2v
    CVE-2026-23534: Heap buffer overflow in clear_decompress_bands_data
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3frr-mp8w-4599
    CVE-2026-23732: Heap buffer overflow in Glyph_Alloc
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7qxp-j2fj-c3pp
    CVE-2026-23883: Heap use after free in update_pointer_new
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qcrr-85qx-4p6x
    CVE-2026-23884: Heap use after free in gdi_set_bounds
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cfgj-vc84-f3pp
  * d/libfreerdp3-3.symbols: add 3 new symbols

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 19 Jan 2026 22:46:38 +0300

freerdp3 (3.20.2+dfsg-1) unstable; urgency=medium

  * new upstream release, with multiple security fixes for the following
    client-side vulnerabilities (medium):
    CVE-2026-22851: RDPGFX ResetGraphics race leads to use after free
      in SDL client (sdl->primary)
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8g87-6pvc-wh99
    CVE-2026-22852: Heap buffer overflow in audin_process_formats
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9chc-g79v-4qq4
    CVE-2026-22853: Heap buffer overflow in ndr_read_uint8Array
     https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47v9-p4gp-w5ch
    CVE-2026-22854: Heap buffer overflow in drive_process_irp_read
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47vj-g3c3-3rmf
    CVE-2026-22855: Heap buffer overflow in smartcard_unpack_set_attrib_call
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rwp3-g84r-6mx9
    CVE-2026-22856: Heap use after free in create_irp_thread
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w842-c386-fxhv
    CVE-2026-22857: Heap use after free in irp_thread_func
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4gxq-jhq6-4cr8
    CVE-2026-22858 Global buffer overflow in crypto_base64_decode
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qmqf-m84q-x896
      (this also affects freerdp proxy, not just client)
    CVE-2026-22859: Heap buffer overflow in urb_select_configuration
      https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-56f5-76qv-2r36

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 14 Jan 2026 16:36:18 +0300

freerdp3 (3.20.0+dfsg-1) unstable; urgency=medium

  * new upstream release

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 18 Dec 2025 07:55:19 +0300

freerdp3 (3.19.1+dfsg-1) unstable; urgency=medium

  * new upstream release

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 12 Dec 2025 15:54:04 +0300

freerdp3 (3.19.0+dfsg-1) unstable; urgency=medium

  * new upstream release
  * d/copyright: remove .github from Files-Excluded
    (not shipped in tarball anymore)
  * remove patches
  * d/libfreerdp3-3.symbols: add new symbol

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 05 Dec 2025 16:35:16 +0300
freerdp3 (3.18.0+dfsg-1) unstable; urgency=medium

  * new upstream release
  * removed all patches
  * d/libfreerdp3-3.symbols,d/libwinpr3-3.symbols add new symbols
  * +client-common-fix-retry-counter.patch (upstream patch)
  * d/copyright: remove removed file

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 15 Nov 2025 02:57:23 +0300

freerdp3 (3.17.2+dfsg-3) unstable; urgency=medium

  * cmake-pkg-config-properly-set-requires-fields.patch
  * codec-planar-fix-datatypes-in-plane-encode.patch

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 23 Sep 2025 11:50:02 +0300

freerdp3 (3.17.2+dfsg-2) unstable; urgency=medium

  * winpr-path-fix-endianness-issues.patch: fix tests failure on various
    architectures
  * core-arm-extract-redirected-username.patch

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 20 Sep 2025 00:54:08 +0300

freerdp3 (3.17.2+dfsg-1) unstable; urgency=medium

  * new upstream release
  * d/rules: build rdp2tcp channels (Closes: #1106607)
  * remove drop-TestFileFindFirstFile.diff

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 19 Sep 2025 22:14:07 +0300

freerdp3 (3.17.1+dfsg-2) unstable; urgency=medium

  * d/control: add explicit versioned deps on libwinpr3 for freerdp-dev and
    freerdp-wayland (to ensure the right library is used, and for doc links)
  * d/lib*.install: s|/usr/lib/*/|/usr/lib/${DEB_HOST_MULTIARCH}/|
  * d/*-dev.install: reduce/fixup
  * d/rules: stop running dh* in verbose mode
  * drop TestFileFindFirstFile test for now (falis on s390x ppc & sparc64)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 06 Sep 2025 11:11:19 +0300

freerdp3 (3.17.1+dfsg-1) unstable; urgency=medium

  * new upstream release
  * d/watch: use pub.freerdp.com/releases/ as the base URL for upstream
    tarballs, not the github autogenerated tarballs
  * add upstream gpg signing key
  * d/freerdp3-proxy-modules.install: accomodate for modules rename,
    and use ${DEB_HOST_MULTIARCH}
  * d/rules: link /usr/share/doc/* for all packages to libwinpr3-3,
    since all packages depends on exact same version of it

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 01 Sep 2025 12:04:40 +0300

freerdp3 (3.17.0+dfsg-1) unstable; urgency=medium

  [ Michael Tokarev ]
  * new upstream release
  * d/patches/*: remove
  * d/libfreerdp-client3-3.symbols,d/libwinpr3-3.symbols: add new symbols

  [ Bernhard Miklautz ]
  * d/copyright: regenerate and update copyright

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 22 Aug 2025 12:02:00 +0300

freerdp3 (3.16.0+dfsg-2) unstable; urgency=medium

  * common-settings-fix-int-casts.patch (fix test failure on BE hosts)
  * 4 more fixes from upstream

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 14 Jul 2025 10:05:25 +0300

freerdp3 (3.16.0+dfsg-1) unstable; urgency=medium

  * new upstream bugfix release with (again) much improved SDL3 and X11 client
  * d/patches/: remove all patches (all were taken from upstream)
  * d/lib*.symbols: add new symbols

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 25 Jun 2025 17:01:08 +0300

freerdp3 (3.15.0+dfsg-2) unstable; urgency=medium

  [ Bernhard Miklautz ]
  * d/copyright: regenerate and update copyright
  * d/control: use libjson-c instead of libcjson
  * d/rules: enable AAD support on Ubuntu

  [ Michael Tokarev ]
  * pick numerous fixes from upstream:
    client-sdl-force-primary-monitor-in-windowed-mode.patch
    client-sdl-only-draw-to-window-if-connected.patch
    core-settings-handle-empty-OrderSupport-and-received.patch
    crypto-certificate-Add-a-fallback-for-weak-RSA-keys.patch
    rdpei-server-Fix-incorrect-PDU-length-read.patch
    cmake-json-improve-json-detection.patch
    client-sdl-fix-SDL-ttf-usage.patch
    cache-glyph-fix-GLYPH_FRAGMENT_USE.patch
    winpr-sysinfo-use-a-single-clock-to-provide-System-a.patch
    fix-resources-remove-MimeType-from-desktop-file.patch
    gcc-fix-server-side-connection-with-multiple-monitor.patch

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 24 Apr 2025 12:18:41 +0300

freerdp3 (3.15.0+dfsg-1) unstable; urgency=medium

  [ Bernhard Miklautz ]
  * d/copyright:
     - fix lintian warning "old-fsf-address-in-copyright-file"
     - update files
  * d/control:
     - remove Multi-Arch: same field (for bin:pkg libwinpr3-dev)
       (Closes: #1101910)
     - drop unused build dependency to docbook-xsl

  [ Michael Tokarev ]
  * new upstream version (3.15.0)
  * install .desktop files and FreeRDP.svg icon

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 14 Apr 2025 18:35:14 +0300

freerdp3 (3.14.1+dfsg-2) unstable; urgency=medium

  * d/rules: enable CHANNEL_RDPECAM_CLIENT (it is not enabled implicitly)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 29 Mar 2025 09:14:17 +0300

freerdp3 (3.14.1+dfsg-1) unstable; urgency=medium

  [ Michael Tokarev ]
  * new upstream (minor) release, fixing a number of issues
  * d/control: Standards-Version: 4.7.2 (no changes needed)
  * d/control: add comment about libcairo usage
  * d/control: add ubuntu-related comment about libavcodec-dev &Co

  [ Simon Quigley ]
  * Disable CHANNEL_RDPECAM_CLIENT on Ubuntu, since ubuntu disables FFMPEG
    (Closes: #1098643)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 25 Mar 2025 21:23:12 +0300

freerdp3 (3.14.0+dfsg-1) unstable; urgency=medium

  * new upstream release
  * d/libfreerdp3-3.symbols: add new symbol
  * d/rules: enable regular BUILD_TESTING and stop
    stripping build paths from shipped .h files
  * d/rules: remove --fail-missing override: it is the default now
  * d/rules: drop another now-unneeded override
    (to remove static libs which are not installed anymore)
  * d/rules: remove get-orig-source-target (-lintian)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 13 Mar 2025 12:11:55 +0300

freerdp3 (3.13.0+dfsg-1) unstable; urgency=medium

  * new upstream release
  * remove all patches which are now applied upstream
  * d/libwinpr3-3.symbols, d/libfreerdp3-3.symbols: add new symbols
  * d/rules: enable CHANNEL_RDPEAR (with kerberos)
  * d/control, d/rules: switch to using libsdl3, but keep sdl2
    as a build profile (pkg.freerdp3.sdl2)
  * d/copyright: remove LICENSE file from file list
  * d/control: add myself to uploaders

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 06 Mar 2025 12:03:07 +0300

freerdp3 (3.12.0+dfsg-1) unstable; urgency=medium

  * new upstream release
  * add two patches from upstream to fix symbol visibility
  * d/libfreerdp3-3.symbols: add new symbols
  * d/rules,d/control: enable VAAPI_H264_ENCODING and CHANNEL_RDPECAM
    on linux (libv4l)
  * pick 3 more fixes from upstream

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 15 Feb 2025 15:15:41 +0300

freerdp3 (3.11.1+dfsg-1) unstable; urgency=medium

  * new upstream release
  * d/libwinpr3-3.symbols, d/libfreerdp3-3.symbols: add new symbols
  * d/copyright: fix some file patterns
  * d/control: remove lists of supported windows versions
    from package descriptions

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 07 Feb 2025 16:34:07 +0300

freerdp3 (3.10.3+dfsg-1) unstable; urgency=medium

  * New upstream version 3.10.3+dfsg
  * Revert "Cherry-pick 2 patches from future 3.10.3":
    0001-winpr-sysinfo-fix-use-of-GetComputerNameExA.patch
    0002-cmake-fix-regeneration-of-config-files-after-clean.patch
    are now included in 3.10.3
  * mostly mechanical little d/copyright update (SDL=>SDL2+SDL3)
    (needs a lot more work)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 14 Jan 2025 09:31:32 +0300

freerdp3 (3.10.2+dfsg-1) unstable; urgency=medium

  * Team upload

  [ Jeremy Bícha ]
  * New upstream release
  * Update install file
  * Add new symbols to symbols files
  * Cherry-pick 2 patches from future 3.10.3
  * Release to unstable

  [ Adrien Nader ]
  * d/tests/connect: use /cert:tofu to avoid errors with proxies

 -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 19 Dec 2024 14:29:08 -0500

freerdp3 (3.9.0+dfsg1-1~exp1) experimental; urgency=medium

  * new upstream release
  * remove 2000-skip-failing-test.patch
  * d/*.symbols: add new symbols

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 27 Oct 2024 12:36:53 +0300

freerdp3 (3.6.3+dfsg1-2) unstable; urgency=medium

  * Revert "Add Build-Depends: libmp3lame-dev for MP3 audio codec support":
    the option is disabled by default and the feature is not used bu modern
    operating systems

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 09 Jul 2024 07:37:31 -0400

freerdp3 (3.6.3+dfsg1-1) unstable; urgency=medium

  [ Jeremy Bícha ]
  * Team upload
  * New upstream release
  * debian/*.symbols: Add new symbols
  * Add Build-Depends: libmp3lame-dev for MP3 audio codec support

  [ Michael Tokarev ]
  * d/rules: disable stack unwind (WINPR_HAVE_UNWIND_H=OFF) on armel and armhf

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 08 Jul 2024 18:37:15 +0300

freerdp3 (3.5.1+dfsg1-5) unstable; urgency=medium

  * Add patch to skip a test that fails on 32-bit arm (Closes: #1071949)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 28 May 2024 12:40:03 -0400

freerdp3 (3.5.1+dfsg1-4) unstable; urgency=medium

  * Enable build time tests (LP: #2058401)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Tue, 21 May 2024 11:56:19 -0400

freerdp3 (3.5.1+dfsg1-3) unstable; urgency=high

  [ Bernhard Miklautz ]
  * Performance improvements
    - Set -DNDEBUG (automatically set for Release but not for RelWithDebInfo)
    - Set -DWITH_VERBOSE_WINPR_ASSERT=OFF

  [ Nathan Pratta Teodosio ]
  * Add autopkgtest

  [ Jeremy Bícha ]
  * debian/*.symbols: Add new symbols
  * Release to unstable

 -- Jeremy Bícha <jbicha@ubuntu.com>  Wed, 01 May 2024 16:32:21 -0400

freerdp3 (3.5.1+dfsg1-2) experimental; urgency=medium

  * Enable proxy support
  * Enable the SDL client

 -- Bernhard Miklautz <bernhard.miklautz@shacknet.at>  Mon, 29 Apr 2024 15:07:11 -0400

freerdp3 (3.5.1+dfsg1-1) unstable; urgency=high

  [ Jeremy Bícha ]
  * New upstream release (Closes: #1069752)
    - CVE-2024-32658 [Low] ExtractRunLengthRegular* out of bound read
    - CVE-2024-32659 [Low] freerdp_image_copy out of bound read
    - CVE-2024-32660 [Low] zgfx_decompress out of memory
    - CVE-2024-32661 [Low] rdp_write_logon_info_v1 NULL access
    - CVE-2024-32662 [Low] rdp_redirection_read_base64_wchar out of bound read
  * Fix typo in enabling smartcard emulation
  * Update symbols files
  * Set symbols check level to 4

  [ Bernhard Miklautz ]
  * Update symbol files
  * debian/[control|rules]: enable WEBP, JPEG and PNG support for clipboard
  * debian/copyright[.in]: update copyright files
  * debian/control: update pkg-config binary package name

 -- Jeremy Bícha <jbicha@ubuntu.com>  Mon, 29 Apr 2024 14:50:09 -0400

freerdp3 (3.5.0+dfsg1-1) unstable; urgency=medium

  * Team upload
  * New upstream release (LP: #2061907)
    - CVE-2024-32039 [Moderate] Integer overflow & OutOfBound Write in
      clear_decompress_residual_data
    - CVE-2024-32040 [Low] integer underflow in nsc_rle_decode
    - CVE-2024-32041 [Low] OutOfBound Read in zgfx_decompress_segment
    - CVE-2024-32458 [Low] OutOfBound Read in planar_skip_plane_rle
    - CVE-2024-32459 [Low] OutOfBound Read in ncrush_decompress
    - CVE-2024-32460 [Low] OutOfBound Read in interleaved_decompress
  * Add freerdp3-dev Depends: libcjson-dev, libfuse3-dev
  * Release to unstable

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 15 Mar 2024 06:36:44 -0400

freerdp3 (3.3.0+dfsg1-1) experimental; urgency=medium

  * Team upload
  * New upstream release (Closes: #1056992)
  * Rename source package & update binary package names
  * Update symbols files
  * Add Build-Depends: libcjson-dev, libfuse3-dev, libopus-dev,
    libpkcs11-helper1-dev, libswresample-dev, liburiparser-dev
  * Add Build-Depends dpkg-dev >= 1.22.5
  * Compile libuwac as static to avoid conflict with freerdp2

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sun, 10 Mar 2024 18:22:28 -0400

freerdp2 (2.11.2+dfsg1-1) unstable; urgency=medium

  * New upstream release. (Closes: #1051638).
  * Fixed security issues since v2.11.0:
    - CVE-2023-40589: [codec,ncrush] fix index checks properly verify all
      offsets while decoding data.
    - CVE-2023-40567: Fix out-of-bounds write in the
      `clear_decompress_bands_data` function.
    - CVE-2023-40188: Fix out-of-bounds read in the `general_LumaToYUV444`
      function.
    - CVE-2023-40186: Fix out-of-bounds write in the `gdi_CreateSurface`
      function.
    - CVE-2023-40181: Fix out-of-bounds read in the `zgfx_decompress_segment`
      function.
    - CVE-2023-39356: Fix out-of-bounds read in the `gdi_multi_opaque_rect`
      function.
    - CVE-2023-39355: Fix use-after-free in processing
      `RDPGFX_CMDID_RESETGRAPHICS` packets.
    - CVE-2023-39354: Fix out-of-bounds read in the `nsc_rle_decompress_data`
      function.
    - CVE-2023-39353: Fix missing offset validation leading to out-of-bounds
      read in the `libfreerdp/codec/rfx.c` file.
    - CVE-2023-39352: Fix invalid offset validation leading to out-of-bounds
      write.
    - CVE-2023-39351: Fix null-pointer-dereference leading a crash in the
      RemoteFX (rfx) handling.
    - CVE-2023-39350: Fix integer underflow leading to DOS (e.g. abort due to
      `WINPR_ASSERT` with default compilation flags).
  * debian/patches:
    + Drop 0001_fix_ftbfs_1041377.patch. Applied upstream.
  * debian/control:
    + Add B-D: libkrb5-dev.
  * debian/rules:
    + Add -DWITH_KERBEROS=ON configure option. (Closes: #1036095).
  * debian/watch:
    + Rework file. Find all released versions of freerdp2. (Closes: #1053317).
      Thanks to Tobias Frost for sending a patch.

 -- Mike Gabriel <sunweaver@debian.org>  Sun, 01 Oct 2023 23:21:15 +0200

freerdp2 (2.10.0+dfsg1-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * debian/patches/0001_fix_ftbfs_1041377.patch:
    - include upstream fix for FTBFS with FFmpeg 6.0
      (Closes: #1041377)

 -- Héctor Orón Martínez <zumbi@debian.org>  Fri, 04 Aug 2023 04:08:40 -0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog winpr3-utils`.
