openjdk-6 (6b41-1.13.13-0ubuntu0.14.04.1) trusty-security; urgency=medium

  * IcedTea 1.13.12 release.
  * Security fixes backported from 8u121:
    - S8168714, CVE-2016-5546: ECDSA will accept signatures that have various
      extraneous bytes added to them whereas the signature is supposed to be
      unique.
    - S8166988, CVE-2017-3253: The PNG specification allows the [iz}Txt
      sections to be 2^32-1 bytes long so these should not be uncompressed
      unless the user explicitly requests it.
    - S8168728, CVE-2016-5548: DSA signing exhibits a timing bias that may
      leak information about k.
    - S8161743, CVE-2017-3252: LdapLoginModule incorrectly tries to
      deserialize responses from an LDAP server when an LDAP context is
      expected.
    - S8167223, CVE-2016-5552: Parsing of URLs can be inconsistent with how
      users or external applications would interpret them leading to possible
      security issues.
    - S8164147, CVE-2017-3261: An integer overflow exists in
      SocketOutputStream which can lead to memorydisclosure.
    - S8151934, CVE-2017-3231: Under some circumstances URLClassLoader will
      dispatch HTTP GET requests where the invoker does not have permission.
    - S8165071, CVE-2016-2183: 3DES can be exploited for block collisions when
      long running sessions are allowed.
    - S8165344, CVE-2017-3272: A protected field can be leveraged into type
      confusion.
    - S8156802, CVE-2017-3241: RMI deserialization should limit the types
      deserialized to prevent attacks that could escape the sandbox.
  * debian/patches/it-add-cpp-flags.patch: refreshed.
  * debian/patches/it-jamvm-2.0.0.patch: refreshed.
  * debian/patches/it-emacs-mode.patch: refreshed.
  * debian/patches/hotspot-disable-arm32-jit.diff: removed, ARM32 JIT is now
    disabled by default on icedtea.
  * debian/patches/zero-missing-headers.diff: removed, fix applied upstream.
  * debian/repack: fix jamvm url.

 -- Tiago Stürmer Daitx <tiago.daitx@canonical.com>  Tue, 14 Feb 2017 02:27:53 +0000

openjdk-6 (6b40-1.13.12-0ubuntu0.14.04.3) trusty-security; urgency=medium

  * Backported security fixes from 8u111:
    - CVE-2016-5582, S8160591: Improve internal array handling.
    - CVE-2016-5573, S8159519: Reformat JDWP messages.
    - CVE-2016-5597, S8160838: Better HTTP service.
    - CVE-2016-5554, S8157739: Classloader Consistency Checking.
    - CVE-2016-5542, S8155973: Tighten jar checks.

 -- Tiago Stürmer Daitx <tiago.daitx@canonical.com>  Wed, 30 Nov 2016 23:44:53 +0000

openjdk-6 (6b40-1.13.12-0ubuntu0.14.04.2) trusty-security; urgency=medium

  * Disable precompiled header for arm64 (LP: #1617379)
    - debian/rules: replace DISABLE_PRECOMPILED_HEADER=1 with
      USE_PRECOMPILED_HEADER=0 and apply no-pch-build.diff as 
      well as zero-missing-headers.diff
    - debian/patches/no-pch-build.diff: include missing psOldGen.hpp to
      various headers
    - debian/patches/zero-missing-headers.diff: missing headers for zero
  * Create watch file for package updates
    - debian/watch: fetch newest icedtea and call debian/repack
    - debian/repack: unpack icedtea tarball, parse the Makefile.am,
      download the right version of openjdk-6-src/cacao/jamvm, repack
  * debian/rules:
    - extract OPENJDK_VERSION from changelog
    - remove dependency on OPENJDK_SRC_ZIP and use OPENJDK_VERSION to
      select the right tarball
    - remove hs20 hotspot rules as we are only relying on "original"
    - call autogen.sh during the build and remove auto-generated files
  * Updated source format to 3.0 (quilt)
    - patches/it-add-cpp-flags.patch: added.
    - patches/it-automake-1.11.patch: added.
    - patches/it-emacs-mode.patch: added.
    - patches/it-enable-aarch64.patch: added.
    - patches/it-jamvm-2.0.0.patch: added.
    - patches/icedtea-patch.diff: removed.

 -- Tiago Stürmer Daitx <tiago.daitx@canonical.com>  Fri, 26 Aug 2016 15:36:38 +0000

openjdk-6 (6b40-1.13.12-0ubuntu0.14.04.1) trusty-security; urgency=low

  * IcedTea 1.13.12 release.
  * Security fixes
    - S8079718, CVE-2016-3458: IIOP Input Stream Hooking
    - S8145446, CVE-2016-3485: Perfect pipe placement (Windows only)
    - S8147771: Construction of static protection domains under Javax
      custom policy
    - S8148872, CVE-2016-3500: Complete name checking
    - S8149962, CVE-2016-3508: Better delineation of XML processing
    - S8150752: Share Class Data
    - S8151925: Font reference improvements
    - S8152479, CVE-2016-3550: Coded byte streams
    - S8155981, CVE-2016-3606: Bolster bytecode verification
  * icedtea-patch.diff: updated to use new build variables; removed ecj
    override as it is applied upstream
  * debian/patches/icedtea-pretend-memory.diff: updated patch to reflect
    changes in openjdk-6
  * debian/rules: disable headers for arm64; updated to use new 
    openjdk-6-6b40 tarball

 -- Tiago Stürmer Daitx <tiago.daitx@canonical.com>  Thu, 25 Aug 2016 04:28:18 +0000

openjdk-6 (6b39-1.13.11-0ubuntu0.14.04.1) trusty-security; urgency=medium

  * Backport to Ubuntu 14.04.

 -- Tiago Stürmer Daitx <tiago.daitx@canonical.com>  Fri, 06 May 2016 14:43:44 +0000

openjdk-6 (6b39-1.13.11-0ubuntu0.15.10.2) wily-security; urgency=medium

  [ Tiago Stürmer Daitx ]
  * IcedTea 1.13.11 release.
  * Security fixes:
    - S8129952, CVE-2016-0686: Ensure thread consistency
    - S8132051, CVE-2016-0687: Better byte behavior
    - S8138593, CVE-2016-0695: Make DSA more fair
    - S8139008: Better state table management
    - S8143167, CVE-2016-3425: Better buffering of XML strings
    - S8144430, CVE-2016-3427: Improve JMX connections
    - S8146494: Better ligature substitution
    - S8146498: Better device table adjustments
  * debian/rules: remove deprecated dh_desktop call. Closes #817302

  [ Matthias Klose ]
  * Fix handling of /usr/lib/jvm/*/jre/lib/zi if internal tzdata is used.
    Addresses: #821858.
  * Build on ARM using the zero port (without the ARM assembler interpreter).
    Broken in the security update.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 06 May 2016 21:32:49 +0200

openjdk-6 (6b38-1.13.10-1) experimental; urgency=medium

  [ Tiago Stürmer Daitx ]
  * IcedTea 1.13.10 release.
  * Security fixes:
    - S8059054, CVE-2016-0402: Better URL processing
    - S8130710, CVE-2016-0448: Better attributes processing
    - S8133962, CVE-2016-0466: More general limits
    - S8137060: JMX memory management improvements
    - S8139012: Better font substitutions
    - S8139017, CVE-2016-0483: More stable image decoding
    - S8140543, CVE-2016-0494: Arrange font actions
    - S8143185: Cleanup for handling proxies
    - S8143941, CVE-2015-8126, CVE-2015-8472: Update splashscreen displays
  * Other fixes:
    - S7169111, PR2757: Unreadable menu bar with Ambiance theme in GTK L&F 
      (LP: #932274)
  * debian/rules: removed old @op@, @pkg_version@, and @pkg_sversion@
  * debian/control.in: replaced @op@ with =, @pkg_version@ with 
    ${binary:Version}, and @pkg_sversion@ by ${source:Version}
  * debian/control.cacao-jre: same
  * debian/control.jamvm-jre: same
  * debian/control.zero-jre: same

  [ Matthias Klose ]
  * Fix clean-up of dependency generation.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 26 Jan 2016 12:46:18 +0100

openjdk-6 (6b37-1.13.9-1) experimental; urgency=medium

  [ Tiago Stürmer Daitx ]
  * IcedTea 1.13.9 release.
  * Security fixes:
    - S8048030, CVE-2015-4734: Expectations should be consistent
    - S8068842, CVE-2015-4803: Better JAXP data handling
    - S8076339, CVE-2015-4903: Better handling of remote object invocation
    - S8076383, CVE-2015-4835: Better CORBA exception handling
    - S8076387, CVE-2015-4882: Better CORBA value handling
    - S8076392, CVE-2015-4881: Improve IIOPInputStream consistency
    - S8076413, CVE-2015-4883: Better JRMP message handling
    - S8078427, CVE-2015-4842: More supportive home environment
    - S8078440: Safer managed types
    - S8080541: More direct property handling
    - S8080688, CVE-2015-4860: Service for DGC services
    - S8081760: Better group dynamics
    - S8086733, CVE-2015-4893: Improve namespace handling
    - S8087350: Improve array conversions
    - S8103671, CVE-2015-4805: More objective stream classes
    - S8103675: Better Binary searches
    - S8130078, CVE-2015-4911: Document better processing
    - S8130193, CVE-2015-4806: Improve HTTP connections
    - S8130864: Better server identity handling
    - S8130891, CVE-2015-4843: (bf) More direct buffering
    - S8131291, CVE-2015-4872: Perfect parameter patterning
    - S8132042, CVE-2015-4844: Preserve layout presentation

 -- Matthias Klose <doko@ubuntu.com>  Thu, 19 Nov 2015 01:12:55 +0100

openjdk-6 (6b36-1.13.8-1) experimental; urgency=medium

  * IcedTea 1.13.8 release.
  * Security fixes:
    - S8043202, CVE-2015-2808: Prohibit RC4 cipher suites.
    - S8067694, CVE-2015-2625: Improved certification checking.
    - S8071715, CVE-2015-4760: Tune font layout engine.
    - S8071731: Better scaling for C1.
    - S8072490: Better font morphing redux.
    - S8072887: Better font handling improvements.
    - S8073334: Improved font substitutions.
    - S8073773: Presume path preparedness.
    - S8073894: Getting to the root of certificate chains.
    - S8074330: Set font anchors more solidly.
    - S8074335: Substitute for substitution formats.
    - S8074865, CVE-2015-2601: General crypto resilience changes.
    - S8074871: Adjust device table handling.
    - S8075374, CVE-2015-4748: Responding to OCSP responses.
    - S8075378, CVE-2015-4749: JNDI DnsClient Exception Handling.
    - S8075738: Better multi-JVM sharing.
    - S8075838: Method for typing MethodTypes.
    - S8075853, CVE-2015-2621: Proxy for MBean proxies.
    - S8076328, CVE-2015-4000: Enforce key exchange constraints.
    - S8076376, CVE-2015-2628: Enhance IIOP operations.
    - S8076397, CVE-2015-4731: Better MBean connections.
    - S8076401, CVE-2015-2590: Serialize OIS data.
    - S8076405, CVE-2015-4732: Improve serial serialization.
    - S8076409, CVE-2015-4733: Reinforce RMI framework.
    - S8077520, CVE-2015-2632: Morph tables into improved form.
    - PR2488, CVE-2015-4000: Make jdk8 mode the default for
      jdk.tls.ephemeralDHKeySize.
  * Refresh patches.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 31 Jul 2015 16:24:22 +0200

openjdk-6 (6b35-1.13.7-1) unstable; urgency=medium

  * IcedTea 1.13.7 release.
  * Security fixes:
    - S8059064: Better G1 log caching.
    - S8060461: Fix for JDK-8042609 uncovers additional issue.
    - S8064601, CVE-2015-0480: Improve jar file handling.
    - S8065286: Fewer subtable substitutions.
    - S8065291: Improved font lookups.
    - S8066479: Better certificate chain validation.
    - S8067050: Better font consistency checking.
    - S8067684: Better font substitutions.
    - S8067699, CVE-2015-0469: Better glyph storage.
    - S8068320, CVE-2015-0477: Limit applet requests.
    - S8068720, CVE-2015-0488: Better certificate options checking.
    - S8069198: Upgrade image library.
    - S8071726, CVE-2015-0478: Better RSA optimizations.
    - S8071818: Better vectorization on SPARC.
    - S8071931, CVE-2015-0460: Return of the phantom menace.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 15 Apr 2015 16:18:56 +0200

# For older changelog entries, run 'apt-get changelog openjdk-6-jre-headless'
