lighttpd (1.4.35-4ubuntu2.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Fix vulnerability in HTTPoxy.
    - debian/patches/CVE-2016-1000212.patch: Mitigation for HTTPoxy
      vulnerability.
    - CVE-2016-1000212

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Thu, 31 Jan 2019 14:20:05 -0200

lighttpd (1.4.35-4ubuntu2) xenial; urgency=medium

  * Rebuild for libmysqlclient20.
  * Add build dependency on libcgi-pm-perl to fix FTBFS. Taken from
    Debian with thanks to gregor herrmann.

 -- Robie Basak <robie.basak@ubuntu.com>  Mon, 18 Apr 2016 15:26:03 +0000

lighttpd (1.4.35-4ubuntu1) vivid; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/patches/add-lighttpd.pc-configure.patch:
      + Add lighttpd.pc to ac_config_files to fix FTBFS: make[3]:
        *** No rule to make target `lighttpd.pc', needed by `all-am'.
    - debian/patches/build-dev-package.patch,
      debian/control, debian/lighttpd-dev.install:
      + Add lighttpd-dev package.
    - debian/index.html:
      + Corrected BTS Ubuntu link and branding on the default page.
    - debian/lighttpd.conf:
      + Comment 'use-ipv6.pl' by default, which causes failure
        to bind port in ipv4.
    - debian/control:
      + Build-Depends on libgamin-dev rather than libfam-dev
        to fix startup warning.
    - debian/rules:
      + Add override_dh_installinit to set "defaults 91 09" to not
        start before apache2 but in the same runlevel with
        the same priority.
    - debian/lighttpd.dirs, debian/control, debian/rules,
      debian/lighttpd.ufw.profile:
      + Add the UFW profile.

 -- Artur Rona <ari-tczew@ubuntu.com>  Mon, 26 Jan 2015 02:36:43 +0100

lighttpd (1.4.35-4) unstable; urgency=medium

  * Disable SSLv3 by default (closes: #765702).

 -- Michael Gilbert <mgilbert@debian.org>  Sun, 02 Nov 2014 02:49:09 +0000

lighttpd (1.4.35-3) unstable; urgency=medium

  * Support building with dpkg-buildpackage -g.
  * Drop libmemcache-dev build-dependency (closes: #748809).

 -- Michael Gilbert <mgilbert@debian.org>  Mon, 18 Aug 2014 03:42:29 +0000

lighttpd (1.4.35-2) unstable; urgency=medium

  * Fix a spelling error.
  * Add a lintian override.
  * Make VCS field canonical.
  * Add myself to the uploaders.
  * Use dh-autoreconf (closes: #726394, #731104).
  * Disable indeterminant test on kfreebsd (closes: #731074).

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 05 Apr 2014 18:12:03 +0000

lighttpd (1.4.35-1) unstable; urgency=low

  * New upstream version (fixes CVE-2014-2323, CVE-2014-2324)
    + Delete patches: cve-2013-4508.patch, cve-2013-4559.patch,
      cve-2013-4560.patch. Those are all cumulative included since
      lighttpd 1.4.34
  * Acknowledge NMUs by the security team
  * Make the init script wait until lighttpd really terminates.
  * Change the default document root /var/www/html (Closes: #730379), add a
    Lintian override for it
  * Bump the debhelper dependency to >= 9.20130624 to ensure dh_installinit is
    recent enough for systemd (Closes: #713860)
  * Reorder LSB init dependencies, add $local_fs to it
  * Add hardening flags to lighttpd. Thanks to Michael Gilbert
    for providing a patch (Closes: #741497)
  * Remove W3C logo from index.html to avoid inclusion of images hosted
    elsewhere
  * Push standards version to 3.9.5 (no changes needed).

 -- Arno Töll <arno@debian.org>  Sat, 22 Mar 2014 03:06:59 -1100

lighttpd (1.4.33-1+nmu2ubuntu2) trusty; urgency=medium

  * Use dh-autoreconf to regenerate autotools files, fixes FTBFS with 
    automake 1.14.1 (Closes: #726934)
  * Add lighttpd.pc to ac_config_files to fix FTBFS:
    make[3]: *** No rule to make target `lighttpd.pc', needed by `all-am'.

 -- Andreas Moog <andreas.moog@warperbbs.de>  Tue, 28 Jan 2014 18:08:02 +0100

lighttpd (1.4.33-1+nmu2ubuntu1) trusty; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/index.html: corrected BTS Ubuntu link for lighttpd.
    - debian/index.html: s/Debian/Ubuntu/g branding on the default page.
    - debian/lighttpd.conf: Comment 'use-ipv6.pl' by default, which causes
      failure to bind port in ipv4.
    - Add lighttpd-dev package:
      + debian/control: Added lighttpd-dev package; Build-depends on
        automake (>=1.14), libtool.
      + debian/lighttpd-dev.install: Added.
    - debian/control: libgamin-dev rather than libfam-dev to fix startup warning.
    - debian/rules: Add override_dh_installinit to set "defaults 91 09" to not
      start before apache2 but in the same runlevel with the same priority.
    - Added a UFW profile set:
      + debian/lighttpd.dirs: added etc/ufw/applications.d
      + debian/rules: install the ufw profile.
      + debian/control: Suggests on ufw.

 -- Mahyuddin Susanto <udienz@ubuntu.com>  Wed, 18 Dec 2013 14:30:01 +0700

lighttpd (1.4.33-1+nmu2) unstable; urgency=high

  * Non-maintainer upload by the Security Team.
  * Fix regression caused by the fix for cve-2013-4508 (closes: #729480).

 -- Michael Gilbert <mgilbert@debian.org>  Sat, 16 Nov 2013 22:29:07 +0000

# For older changelog entries, run 'apt-get changelog lighttpd-doc'
