libjpeg-turbo (1.5.2-0ubuntu5.18.04.6) bionic-security; urgency=medium

  * SECURITY UPDATE: large loop because read_pixel mishandles EOF
    - debian/patches/CVE-2018-11813.patch: fix read handling in rdtarga.c.
    - CVE-2018-11813
  * SECURITY UPDATE: stack-based buffer overflow in the "transform"
    component
    - debian/patches/CVE-2020-17541.patch: fix very rare local buffer
      overrun in jchuff.c.
    - CVE-2020-17541
  * SECURITY UPDATE: null pointer dereference
    - debian/patches/CVE-2020-35538-pre1.patch: fix jpeg_skip_scanlines()
      segfault w/merged upsamp in jdapistd.c.
    - debian/patches/CVE-2020-35538.patch: fix jpeg_skip_scanlines()
      segfault w/merged upsamp in jdapistd.c, jdmerge.c, jdmerge.h,
      jdmrg565.c, jdmrgext.c.
    - debian/patches/CVE-2020-35538-2.patch: further jpeg_skip_scanlines()
      fixes in CMakeLists.txt, croptest.in, jdapistd.c.
    - CVE-2020-35538

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 21 Sep 2022 14:07:11 -0400

libjpeg-turbo (1.5.2-0ubuntu5.18.04.4) bionic-security; urgency=medium

  * SECURITY UPDATE: Heap-based buffer over-read
    - debian/patches/CVE-2020-13790.patch: fix buf overrun caused
      by bad binary PPM in rdppm.c.
    - CVE-2020-13790

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Thu, 04 Jun 2020 13:24:18 -0300

libjpeg-turbo (1.5.2-0ubuntu5.18.04.3) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2018-14498.patch: Fix OOB read
      caused by malformed 8-bit BMP in cderror.h, rdbmp.c, rdppm.c.
    - CVE-2018-14498
  * SECURITY UPDATE: Several integer overflow and subsequent
    segfaults
    - debian/patches/CVE-2019-2201.patch: properly handled
      gigapixel images in java/TJBench.java, tjbench.c,
      turbojpeg.c.
    - CVE-2019-2201

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Tue, 12 Nov 2019 10:09:57 -0300

libjpeg-turbo (1.5.2-0ubuntu5.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference via JPEG image
    - debian/patches/CVE-2017-15232-1.patch: exit gracefully with non-PPM
      formats in djpeg.1, djpeg.c.
    - debian/patches/CVE-2017-15232-2.patch: add further partial image
      decompression fixes in cdjpeg.h, djpeg.1, djpeg.c, jdapistd.c,
      wrbmp.c, wrgif.c, wrppm.c, wrppm.h, wrrle.c, wrtarga.c.
    - CVE-2017-15232
  * SECURITY UPDATE: division by zero via BMP image
    - debian/patches/CVE-2018-1152.patch: add size check in rdbmp.c.
    - CVE-2018-1152

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 05 Jul 2018 15:18:48 -0400

libjpeg-turbo (1.5.2-0ubuntu5) artful; urgency=medium

  * Revert the last upload.
  * Move libturbojpeg.a to the libturbojpeg0-dev package.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 11 Oct 2017 07:07:23 +0200

libjpeg-turbo (1.5.2-0ubuntu4) artful; urgency=medium

  * Drop libturbojpeg.a static library in libturbojpeg0-dev package,
    already ship in jpeg-turbo8 package (this fixes the installability
    issue. The static library is still in libjpeg-turbo8-dev
    for retro-compatibility, the dynamic one is in
    libturbojpeg0-dev and libturbojpeg packages.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 10 Oct 2017 16:48:35 +0200

libjpeg-turbo (1.5.2-0ubuntu3) artful; urgency=medium

  * libturbojpeg0-dev: Depend on libturbojpeg0-dev.
  * libturbojpeg0-dev: Include the turbojpeg.h header here.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 18 Sep 2017 18:10:01 +0200

libjpeg-turbo (1.5.2-0ubuntu2) artful; urgency=medium

  * libturbojpeg0-dev: Drop conflict with libjpeg-turbo8-dev, depend
    on it instead, and leave the header files libjpeg-turbo8-dev.
    This stops pulling the legacy turbojpeg API into main. See the README
    in the sources ("Using libjpeg-turbo").
    There is no reason to pull libturbojpeg0-dev and libturbojpeg0 into main.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 18 Sep 2017 12:40:49 +0200

libjpeg-turbo (1.5.2-0ubuntu1) artful; urgency=medium

  * New upstream version.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 12 Sep 2017 14:17:22 +0200

libjpeg-turbo (1.5.1-0ubuntu2) artful; urgency=medium

  * Install turbojpeg development file

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sun, 03 Sep 2017 12:49:04 +0200

# For older changelog entries, run 'apt-get changelog libjpeg-turbo-progs'
