mercurial (2.8.2-1ubuntu1.4) trusty-security; urgency=medium

  * SECURITY UPDATE: Remote attackers can execute arbitrary code via a
    crafted git ext:: URL when cloning a subrepository.
    - debian/patches/CVE-2016-3068.patch: set GIT_ALLOW_PROTOCOL to limit
      git clone protocols.
    - CVE-2016-3068
  * SECURITY UPDATE: Remote attackers can execute arbitrary code via a crafted
    name when converting a Git repository.
    - debian/patches/CVE-2016-3069_part1.patch: add new, non-clowny interface
      for shelling out to git.
    - debian/patches/CVE-2016-3069_part2.patch: rewrite calls to Git to use
      the new shelling mechanism.
    - debian/patches/CVE-2016-3069_part3.patch: dead code removal - old git
      calling functions
    - debian/patches/CVE-2016-3069_part4.patch: test for shell injection in
      git calls
    - CVE-2016-3069
  * SECURITY UPDATE: The convert extension might allow attackers to
    execute arbitrary code via a crafted git repository name.
    - debian/patches/CVE-2016-3105.patch: Pass absolute paths to git.
    - CVE-2016-3105
  * SECURITY UPDATE: Remote attackers can execute arbitrary code via a clone,
    push or pull command because of a list sizing rounding error and short
    records.
    - debian/patches/CVE-2016-3630_part1.patch: fix list sizing rounding
      error.
    - debian/patches/CVE-2016-3630_part2.patch: detect short records
    - CVE-2016-3630
  * SECURITY UPDATE: hg server --stdio allows remote authenticated users
    to launch the Python debugger and execute arbitrary code.
    - debian/patches/CVE-2017-9462.patch: Protect against malicious hg
      serve --stdio invocations.
    - CVE-2017-9462
  * SECURITY UPDATE: A specially malformed repository can cause GIT
    subrepositories to run arbitrary code.
    - debian/patches/CVE-2017-17458_part1.patch: add test-audit-subrepo.t
      testcase.
    - debian/patches/CVE-2017-17458_part2.patch: disallow symlink
      traversal across subrepo mount point.
    - CVE-2017-17458
  * SECURITY UPDATE: Missing symlink check could be abused to write to files
    outside the repository.
    - debian/patches/CVE-2017-1000115.patch: Fix symlink traversal.
    - CVE-2017-1000115
  * SECURITY UPDATE: Possible shell-injection attack from not adequately
    sanitizing hostnames passed to ssh.
    - debian/patches/CVE-2017-1000116.patch: Sanitize hostnames passed to ssh.
    - CVE-2017-1000116
  * SECURITY UPDATE: Integer underflow and overflow.
    - debian/patches/CVE-2018-13347.patch: Protect against underflow.
    - debian/patches/CVE-2018-13347-extras.patch: Protect against overflow.
    - CVE-2018-13347
  * SECURITY UPDATE: Able to start fragment past of the end of original data.
    - debian/patches/CVE-2018-13346.patch: Ensure fragment start is not past
      then end of orig.
    - CVE-2018-13346
  * SECURITY UPDATE: Data mishandling in certain situations.
    - debian/patches/CVE-2018-13348.patch: Be more careful about parsing
      binary patch data.
    - CVE-2018-13348
  * SECURITY UPDATE: Vulnerability in Protocol server can result in
    unauthorized data access.
    - debian/patches/CVE-2018-1000132.patch: Always perform permissions
      checks on protocol commands.
    - CVE-2018-1000132

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Fri, 16 Nov 2018 16:16:59 -0200

mercurial (2.8.2-1ubuntu1.3) trusty-security; urgency=medium

  [ Jamie Strandboge ]
  * SECURITY UPDATE: fix for improperly handling case-insensitive paths on
    Windows and OS X clients
    - http://selenic.com/repo/hg-stable/rev/885bd7c5c7e3
    - http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e
    - http://selenic.com/repo/hg-stable/rev/6dad422ecc5a
    - CVE-2014-9390
    - LP: #1404035

  [ Marc Deslauriers ]
  * SECURITY UPDATE: arbitrary command exection via crafted repository
    name in a clone command
    - d/p/from_upstream__sshpeer_more_thorough_shell_quoting.patch: add
      more thorough shell quoting to mercurial/sshpeer.py.
    - CVE-2014-9462
  * debian/patches/fix_ftbfs_patchbomb_test.patch: fix patchbomb test.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 17 Jun 2015 10:51:42 -0400

mercurial (2.8.2-1ubuntu1) trusty; urgency=medium

  * debian/tests/control:
    - Add "allow-stderr" restriction to "testsuite" as it prints out a "Tested
      with unexpected mercurial lib:" warning.
    - Disable hgsubversion test as it needs access to anonscm.debian.org which
      we don't have in Ubuntu CI.

 -- Martin Pitt <martin.pitt@ubuntu.com>  Thu, 16 Jan 2014 17:25:51 +0100

mercurial (2.8.2-1) unstable; urgency=medium

  * New upstream release
  * Drop for_upstream__fix_i18n.patch as it's now included upstream
  * Make uscan verify the signature of downloaded tarballs

 -- Javi Merino <vicho@debian.org>  Thu, 02 Jan 2014 17:31:05 +0100

mercurial (2.8.1-2) unstable; urgency=low

  * Pass -f to rm so that repeated builds succeed (Closes: #731623).
  * Fix installation in the case where there is more than one supported
    version of Python (Closes: #729153).
    - Thanks to Faheem Mitha <faheem@faheem.info> for the patch.
  * Make test-shelve.t more lenient. This should hopefully fix the
    semi-intermittent build failures on some architectures with slower
    buildds.

 -- Tristan Seligmann <mithrandi@debian.org>  Sun, 08 Dec 2013 02:03:54 +0200

mercurial (2.8.1-1) unstable; urgency=low

  * New upstream release (Closes: #731471)
  * Add myself to Uploaders.
  * Add patch to fix test-i18n.
  * Remove pyflakes test to avoid build failures when pyflakes is installed.

 -- Tristan Seligmann <mithrandi@debian.org>  Fri, 06 Dec 2013 01:14:40 +0200

mercurial (2.8-3) unstable; urgency=low

  * Fix mercurial-git autopkg test
  * Add missing deps to run the testsuite with autopkgtest
  * Increment testsuite timeout to 1440 to prevent timeouts in mips
  * Move wish to Recommends as it's needed for hg view

 -- Javi Merino <vicho@debian.org>  Sun, 17 Nov 2013 10:13:23 +0000

mercurial (2.8-2) unstable; urgency=medium

  * Increment testsuite timeout to 720 as test-gendoc.t takes a
    loooong time on armel
  * Don't run pyflakes on the autopkgtest for the testsuite, it fails to
    see the pyflakes error it's expecting (but it's not our job to fix
    python lint issues)

 -- Javi Merino <vicho@debian.org>  Fri, 15 Nov 2013 14:10:00 +0000

mercurial (2.8-1) unstable; urgency=low

  * New upstream release
  * Fix mercurial-git and hgsubversion autopkgtest by loading the
    appropriate extension
  * Bump standards-version to 3.9.5 (no change needed)

 -- Javi Merino <vicho@debian.org>  Fri, 01 Nov 2013 23:19:57 +0000

mercurial (2.8~rc1-1) experimental; urgency=low

  * New upstream release
  * Fix patches deb_specific__install-help-separately,
    deb_specific__install-help-separately and
    deb_specific__install-mo-fhs.patch so that we can run the full
    testsuite when building
  * Build-depend on netbase to make test-serve.t work

 -- Javi Merino <vicho@debian.org>  Mon, 21 Oct 2013 22:35:36 +0100

# For older changelog entries, run 'apt-get changelog mercurial'
