openjdk-7 (7u211-2.6.17-0ubuntu0.1) trusty-security; urgency=medium

  * IcedTea release 2.6.17 (based on 7u211).
  * Security fixes:
    - S8206290, CVE-2019-2422: Better FileChannel transfer performance.
    - S8209094, CVE_2019-2426: Improve web server connections.
    - S8210866, CVE-2018-11212: Improve JPEG processing.
    - S8199156: Better route routing.
    - S8199161: Better interface enumeration.
    - S8199166: Better interface lists.
    - S8199552: Update to build scripts.
    - S8200659: Improve BigDecimal support.
    - S8203955: Improve robot support.
    - S8204895: Better icon support.
    - S8205356: Choose printer defaults.
    - S8205709: Proper allocation handling.
    - S8205714: Initial class initialization.
    - S8206295: More reliable p11 transactions.
    - S8206301: Improve NIO stability.
    - S8208585: Make crypto code more robust.
    - S8210094: Better loading of classloader classes.
    - S8210606: Improved data set handling.
    - S8210610: Improved LSA authentication.
    - S8210870: Libsunmscapi improved interactions.
  * debian/patches/hotspot-S8207151-fix-bad-klassoop.patch,
    debian/patches/openjdk-jdk7u191-b01-jaxp.patch
    debian/patches/openjdk-jdk7u191-b01-jdk.patch
    debian/patches/openjdk-jdk7u201-b00-hotspot.patch
    debian/patches/openjdk-jdk7u201-b00-jaxp.patch
    debian/patches/openjdk-jdk7u201-b00-jdk.patch: removed, applied upstream.
  * debian/patches/zero-sparc.diff: updated to fix merge failure in
    file hotspot/src/share/vm/c1/c1_LIRAssembler.cpp.

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Wed, 20 Mar 2019 05:22:37 +0000

openjdk-7 (7u181-2.6.14-0ubuntu0.3) trusty-security; urgency=medium

  * Apply 7u201-b00 security patches.
  * Security fixes:
    - CVE-2018-3136, S8194534: Manifest better support.
    - CVE-2018-3139, S8196902: Better HTTP redirection support.
    - CVE-2018-3149, S8199177: Enhance JNDI lookups.
    - CVE-2018-3169, S8199226: Improve field accesses.
    - CVE-2018-3180, S8202613: Improve TLS connections stability.
  * debian/patches/jdk-freetypeScaler-crash.diff: removed, it caused
    a memory leak and has been fixed upstream already, albeit in a
    different way. Closes: #910672.
  * debian/patches/jdk-8132985-backport-double-free.patch,
    debian/patches/jdk-8139803-backport-warning.patch: fix crash in
    freetypescaler due to double free, thanks to Heikki Aitakangas for
    the report and patches. (Closes: #911847)
  * debian/rules: run only the hotspot testsuite for jamvm and zero
    alternative vms to make build faster.

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Thu, 11 Oct 2018 01:47:12 +0000

openjdk-7 (7u181-2.6.14-0ubuntu0.2) trusty-security; urgency=medium

  * Apply 8u181 security backports.
  * Security fixes:
    - CVE-2018-2938, S8197871: Support Derby connections.
    - CVE-2018-2952, S8199547: Exception to Pattern Syntax.
    - S8191239: Improve desktop file usage.
    - S8193419: Better Internet address support.
    - S8197925: Better stack walking.
    - S8200666: Improve LDAP support.
  * debian/patches/hotspot-S8207151-fix-bad-klassoop.patch: fix bug introduced
    by the backport of S8189123. LP: #1778930.

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Mon, 23 Jul 2018 20:03:03 +0000

openjdk-7 (7u181-2.6.14-0ubuntu0.1) trusty-security; urgency=medium

  * IcedTea release 2.6.14 (based on 7u181). Closes: #898976.
  * Security fixes:
    - S8162488: JDK should be updated to use LittleCMS 2.8
    - S8180881: Better packaging of deserialization
    - S8182362: Update CipherOutputStream Usage
    - S8183032: Upgrade to LittleCMS 2.9
    - S8189123: More consistent classloading
    - S8189969, CVE-2018-2790: Manifest better manifest entries
    - S8189977, CVE-2018-2795: Improve permission portability
    - S8189981, CVE-2018-2796: Improve queuing portability
    - S8189985, CVE-2018-2797: Improve tabular data portability
    - S8189989, CVE-2018-2798: Improve container portability
    - S8189993, CVE-2018-2799: Improve document portability
    - S8189997, CVE-2018-2794: Enhance keystore mechanisms
    - S8190478: Improved interface method selection
    - S8190877: Better handling of abstract classes
    - S8191696: Better mouse positioning
    - S8192025, CVE-2018-2814: Less referential references
    - S8192030: Better MTSchema support
    - S8192757, CVE-2018-2815: Improve stub classes implementation
    - S8193409: Improve AES supporting classes
    - S8193414: Improvements in MethodType lookups
    - S8193833, CVE-2018-2800: Better RMI connection support
  * debian/patches/hotspot-disable-exec-shield-workaround.patch: removed,
    upstream fixed i386 stack guard support in S8197429 (hotspot's mercurial
    commit 6636:d673ec579604).
  * debian/patches/hotspot-powerpcspe.diff: removed, support added upstream by
    S8186461 in hotspot's mercurial commit 6638:7517e77dd338.
  * debian/patches/it-patch-updates.diff: remove unnecessary hunks.
  * debian/rules: remove hotspot-powerpcspe.diff and
    hotspot-disable-exec-shield-workaround.patch from applied patches.
  
 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Mon, 04 Jun 2018 23:11:45 +0000

openjdk-7 (7u171-2.6.13-1) experimental; urgency=high

  [ Tiago Stürmer Daitx ]
  * IcedTea release 2.6.13 (based on 7u171). Closes: #891330.
  * Security fixes:
    - S8160104: CORBA communication improvements
    - S8172525, CVE-2018-2579: Improve key keying case
    - S8174756: Extra validation for public keys
    - S8175932: Improve host instance supports
    - S8176458: Revise default document styling
    - S8178449, CVE-2018-2588: Improve LDAP logins
    - S8178458: Better use of certificates in LDAP
    - S8178466: Better RSA parameters
    - S8179536: Cleaner print job handling
    - S8179990: Cleaner palette entry handling
    - S8180011: Cleaner native graphics device handling
    - S8180015: Cleaner AWT robot handling
    - S8180020: Improve SymbolHashMap entry handling
    - S8180433: Cleaner CLR invocation handling
    - S8180877: More deeply colored ICC spaces
    - S8181664: Improve JVM UTF String handling
    - S8181670: Improve implementation of keystores
    - S8182125, CVE-2018-2599: Improve reliability of DNS lookups
    - S8182387, CVE-2018-2603: Improve PKCS usage
    - S8182601, CVE-2018-2602: Improve usage messages
    - S8185292, CVE-2018-2618: Stricter key generation
    - S8185325, CVE-2018-2641: Improve GTK initialization
    - S8186080: Transform XML interfaces
    - S8186212, CVE-2018-2629: Improve GSS handling
    - S8186600, CVE-2018-2634: Improve property negotiations
    - S8186606, CVE-2018-2633: Improve LDAP lookup robustness
    - S8186867: Improve native glyph layouts
    - S8186998, CVE-2018-2637: Improve JMX supportive features
    - S8189284, CVE-2018-2663: More refactoring for deserialization cases
    - S8190289, CVE-2018-2677: More refactoring for client deserialization cases
    - S8191142, CVE-2018-2678: More refactoring for naming deserialization cases
  * Remove multiarch-support pre-dependency. Closes: #887858.

  [ Matthias Klose ]
  * Bump standards version.
  * Disable bootstrap on sid/buster, gcj is removed.
  * Remove Damien Raude-Morvan as uploader. Closes: #889378.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 02 Apr 2018 10:36:32 +0200

openjdk-7 (7u171-2.6.13-0ubuntu0.14.04.2) trusty-security; urgency=medium

  * IcedTea release 2.6.13 (based on 7u171). (Closes: #891330).
  * Security fixes:
    - S8160104: CORBA communication improvements
    - S8172525, CVE-2018-2579: Improve key keying case
    - S8174756: Extra validation for public keys
    - S8175932: Improve host instance supports
    - S8176458: Revise default document styling
    - S8178449, CVE-2018-2588: Improve LDAP logins
    - S8178458: Better use of certificates in LDAP
    - S8178466: Better RSA parameters
    - S8179536: Cleaner print job handling
    - S8179990: Cleaner palette entry handling
    - S8180011: Cleaner native graphics device handling
    - S8180015: Cleaner AWT robot handling
    - S8180020: Improve SymbolHashMap entry handling
    - S8180433: Cleaner CLR invocation handling
    - S8180877: More deeply colored ICC spaces
    - S8181664: Improve JVM UTF String handling
    - S8181670: Improve implementation of keystores
    - S8182125, CVE-2018-2599: Improve reliability of DNS lookups
    - S8182387, CVE-2018-2603: Improve PKCS usage
    - S8182601, CVE-2018-2602: Improve usage messages
    - S8185292, CVE-2018-2618: Stricter key generation
    - S8185325, CVE-2018-2641: Improve GTK initialization
    - S8186080: Transform XML interfaces
    - S8186212, CVE-2018-2629: Improve GSS handling
    - S8186600, CVE-2018-2634: Improve property negotiations
    - S8186606, CVE-2018-2633: Improve LDAP lookup robustness
    - S8186867: Improve native glyph layouts
    - S8186998, CVE-2018-2637: Improve JMX supportive features
    - S8189284, CVE-2018-2663: More refactoring for deserialization cases
    - S8190289, CVE-2018-2677: More refactoring for client deserialization cases
    - S8191142, CVE-2018-2678: More refactoring for naming deserialization cases
  * Remove multiarch-support pre-dependency. (Closes: #887858).

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Sat, 03 Mar 2018 01:32:58 +0000

openjdk-7 (7u161-2.6.12-1) experimental; urgency=medium

  * IcedTea release 2.6.12 (based on 7u161).
  * Disable Hotspot workaround for Exec Shield (Debian only).
    Addresses: #876051.
  * Build-depend on g++-4.7 on wheezy. This is the default on some
    architectures such as amd64 or i386, but not on armhf or armel,
    which default to 4.6. There the build was working before because
    the bootstrap build pulled gcj-jdk, which depends on gcj-4.7-jdk
    and that in turn depends on g++-4.7. However since we have
    disabled the bootstrap build now, g++-4.7 is no longer installed
    on arm* builds, causing the build failure which couldn't be seen
    on amd64 (Emilio Pozuelo Monfort).

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Dec 2017 09:12:51 +0100

openjdk-7 (7u151-2.6.11-3) experimental; urgency=medium

  [ Matthias Klose ]
  * Disable bootstrap on wheezy, it currently fails due to the last round
    of 8u151 security patches (Emilio Pozuelo Monfort).

  [ Tiago Stürmer Daitx ]
  * debian/patches/hotspot-aarch64-S8145438-fix-field-too-big-for-insn.patch:
    the S8144028 fix was incomplete and followed up by S8145438; without it
    aarch64 JVM can fail with "Internal Error, failed: Field too big for
    insn".

 -- Matthias Klose <doko@ubuntu.com>  Thu, 23 Nov 2017 16:37:21 +0100

openjdk-7 (7u151-2.6.11-2) experimental; urgency=medium

  [ Tiago Stürmer Daitx ]
  * Backport of 8u151 security fixes. Closes: #881764.
  * Security patches:
    - CVE-2017-10274, S8169026: Handle smartcard clean up better. If a
      CardImpl can be recovered via finalization, then separate instances
      pointing to the same device can be created.
    - CVE-2017-10281, S8174109: Better queuing priorities. PriorityQueue's
      readObject allocates an array based on data in the stream which could
      cause an OOM.
    - CVE-2017-10285, S8174966: Unreferenced references. RMI's Unreferenced
      thread can be used as the root of a Trusted Method Chain.
    - CVE-2017-10295, S8176751: Better URL connections. On Ubuntu (and
      possibly other Linux flavors) CR-NL in the host field are ignored and
      can be used to inject headers in an HTTP request stream.
    - CVE-2017-10388, S8178794: Correct Kerberos ticket grants. Kerberos
      implementations can incorrectly take information from the unencrypted
      portion of the ticket from the KDC. This can lead to an MITM attack
      impersonating Kerberos services.
    - CVE-2017-10346, S8180711: Better alignment of special invocations. A
      missing load constraint for some invokespecial cases can allow invoking
      a method from an unrelated class.
    - CVE-2017-10350, S8181100: Better Base Exceptions. An array is allocated
      based on data in the serial stream without a limit onthe size.
    - CVE-2017-10347, S8181323: Better timezone processing. An array is
      allocated based on data in the serial stream without a limit on the
      size.
    - CVE-2017-10349, S8181327: Better Node predications. An array is
      allocated based on data in the serial stream without a limit onthe size.
    - CVE-2017-10345, S8181370: Better keystore handling. A malicious
      serialized object in a keystore can cause a DoS when using keytool.
    - CVE-2017-10348, S8181432: Better processing of unresolved permissions.
      An array is allocated based on data in the serial stream without a limit
      onthe size.
    - CVE-2017-10357, S8181597: Process Proxy presentation. A malicious
      serialized stream could cause an OOM due to lack on checking on the
      number of interfaces read from the stream for a Proxy.
    - CVE-2017-10355, S8181612: More stable connection processing. If an
      attack can cause an application to open a connection to a malicious FTP
      server (e.g., via XML), then a thread can be tied up indefinitely in
      accept(2).
    - CVE-2017-10356, S8181692: Update storage implementations. JKS and JCEKS
      keystores should be retired from common use in favor of more modern
      keystore protections.
    - CVE-2016-10165, S8183028: Improve CMS header processing. Missing bounds
      check could lead to leaked memory contents.
    - CVE-2016-9841, S8184682: Upgrade compression library. There were four
      off by one errors found in the zlib library. Two of them are long typed
      which could lead to RCE.
  * debian/patches/hotspot-aarch64-S8150652-unused-template.diff: unused
    template breaks builds with gcc-6 due to macro conflict.
  * debian/rules: try /etc/os-release before lsb-release; allows one to check
    if patches still apply cleanly across distros from the command line by
    setting distrel.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 20 Nov 2017 21:24:32 +0100

openjdk-7 (7u151-2.6.11-1) experimental; urgency=medium

  * IcedTea release 2.6.11 (based on 7u151). Closes: #869816.
  * Security fixes:
    - S8163958, CVE-2017-10102: Improved garbage collection.
    - S8167228: Update to libpng 1.6.28.
    - S8169209, CVE-2017-10053: Improved image post-processing steps.
    - S8169392, CVE-2017-10067: Additional jar validation steps.
    - S8170966, CVE-2017-10081: Right parenthesis issue.
    - S8172204, CVE-2017-10087: Better Thread Pool execution.
    - S8172461, CVE-2017-10089: Service Registration Lifecycle.
    - S8172465, CVE-2017-10090: Better handling of channel groups.
    - S8172469, CVE-2017-10096: Transform Transformer Exceptions.
    - S8173286, CVE-2017-10101: Better reading of text catalogs.
    - S8173697, CVE-2017-10107: Less Active Activations.
    - S8173770, CVE-2017-10074: Image conversion improvements.
    - S8174098, CVE-2017-10110: Better image fetching.
    - S8174105, CVE-2017-10108: Better naming attribution.
    - S8174113, CVE-2017-10109: Better sourcing of code.
    - S8174770: Check registry registration location.
    - S8174873: Improved certificate processing.
    - S8175106, CVE-2017-10115: Higher quality DSA operations.
    - S8175110, CVE-2017-10118: Higher quality ECDSA operations.
    - S8176055: JMX diagnostic improvements.
    - S8176067, CVE-2017-10116: Proper directory lookup processing.
    - S8176760, CVE-2017-10135: Better handling of PKCS8 material.
    - S8178135, CVE-2017-10176: Additional elliptic curve support.
    - S8181420, CVE-2017-10074: PPC: Image conversion improvements.
    - S8182054, CVE-2017-10243: Improve wsdl support.
    - S8183551, CVE-2017-10074, PR3423: AArch64: Image conversion improvements.
    - S8184119, CVE-2017-10111: Incorrect return processing for the LF editor
      of MethodHandles.permuteArguments.

  [ Tiago Stürmer Daitx ]
  * d/control.in:
    - remove @bd_compress@ dependency.
    - replace @bd_autotools@ with fixed dependencies.
  * d/control.tests: package to hold all tests artifacts and logs.
  * d/repack: fixed and simplified download script.
  * d/rules:
    - include openjdk-7-tests package on Ubuntu derivatives only.
    - only save the full jtreg results when the openjdk-7-tests package
      is being built, otherwise stick to old behaviour (keep compressed
      test summaries + failed test results). Closes: #863007, #865533.
    - only run the long jdk testsuite when default vm is a hotspot.
    - only run the full testsuite for zero alternative vm on very fast
      systems, otherwise stick to the hotspot testsuite to avoid long
      build times.
    - remove with_nss as all supported releases have it now.
    - remove gcc/g++ configurations for EOL releases.
    - keep libjpeg8 dependency on wheezy, replace it with libjpeg62-turbo
      on other Debian releases and libjpeg-turbo8 on Ubuntu. Closes: #766601.
    - remove old logic to depend on libcupsys2.
    - always set rhino_source, all supported releases have dpkg > 1.16.2.
    - remove bd_compress and pkg_compress as they haven't been used for
      quite a while.
    - remove with_wgy_zenhai logic, lenny is EOL.
    - remove bd_autotools logic if/then, call dh_autoreconf and
      dh_autoreconf_clean.
    - simplify bootstrap dependency logic and remove EOL releases.
    - remove EOL releases from gcc/g++ dependency logic.
    - remove unused jamvm_defaults and simplify jamvm_archs logic.
    - use ttf-indic-fonts for trusty, otherwise stick to fonts-indic.
    - patch configure after dh_autoreconf call to include additional
      /usr/lib/jvm directories; setting DEB_HOST_ARCH=alpha to check
      if patches apply correctly fails because alpha requires a jdk for
      bootstrap and IcedTea does not look into our usual directories.
  * d/p/fontconfig-arphic-uming.diff: removed, not used since lenny.
  * d/p/jdk-getAccessibleValue.diff: libatk-wrapper-java: File selection
    dialog not refreshed when changing directory. Kindly provided by
    Samuel Thibault. Closes: #827741.
  * d/p/jdk-S8173783-fix-illegalargumentexception-regression.patch:
    deleted, included in IcedTea 2.6.10.
  * d/p/kfreebsd-support-jdk.diff: updated, was failing to apply due to
    jdk changes in NetworkInterface.c.
  * d/p/sec-webrev-8u131-*.patch: deleted, included in IcedTea 2.6.10.
  * d/p/zero-sparc.diff: commented out chaitin.hpp hunk #1 as that #ifdef
    has been removed by JDK-8011621 (backported by IcedTea 2.6.10); this 
    was also backported to 7u131 through JDK-8160961 but then backed out,
    better keep the hunk in case IcedTea decides to back it out as well.

  [ Matthias Klose ]
  * Build using gcc-6 on recent releases.
  * Fix libjvm.so's .debug file names. Closes: #865749. LP: #1548434.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 23 Aug 2017 16:02:57 +0200

# For older changelog entries, run 'apt-get changelog openjdk-7-jre-lib'
