openjpeg2 (2.1.2-1.1+deb9u6build0.16.04.1) xenial-security; urgency=medium

  * fake sync from Debian

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 15 Mar 2021 11:35:23 +0100

openjpeg2 (2.1.2-1.1+deb9u6) stretch-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Fix CVE-2020-27814: A heap-buffer overflow in the way openjpeg2
    handled certain PNG format files.
  * Fix CVE-2020-27823: Wrong computation of x1,y1 if -d option is used,
    resulting in heap buffer overflow.
  * Fix CVE-2020-27824: avoid global buffer overflow on irreversible conversion when
    too many decomposition levels are specified.
  * Fix CVE-2020-27841: crafted input to be processed by the openjpeg encoder
    could cause an out-of-bounds read.
  * Fix CVE-2020-27844: crafted input to be processed by the openjpeg encoder
    could cause an out-of-bounds write.
  * Fix CVE-2020-27845: crafted input can cause out-of-bounds-read.

 -- Brian May <bam@debian.org>  Thu, 04 Feb 2021 08:18:38 +1100

openjpeg2 (2.1.2-1.1+deb9u5) stretch-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Fix CVE-2020-15389: opj_decompress: fix double-free
    on input directory with mix of valid and invalid image.
  * Fix CVE-2020-8112: opj_tcd_init_tile(): avoid integer
    overflow. (Closes: #950184)
  * Fix CVE-2020-6851: opj_j2k_update_image_dimensions(): reject
    images whose coordinates are beyond INT_MAX. (Closes: #950000)
  * Fix CVE-2019-12973: convertbmp: detect invalid file dimensions
    early and bmp_read_rle4_data(): avoid potential infinite loop.
    (Closes: #931292)

 -- Utkarsh Gupta <utkarsh@debian.org>  Fri, 10 Jul 2020 21:04:00 +0530

openjpeg2 (2.1.2-1.1+deb9u4) stretch; urgency=medium

  * Non-maintainer upload.
  * CVE-2018-21010: heap buffer overflow in color_apply_icc_profile
    (Closes: #939553).
  * CVE-2018-20847: improper computation of values in the function
    opj_get_encoding_parameters, leading to an integer overflow
    (Closes: #931294).
  * CVE-2016-9112: floating point exception or divide by zero in the
    function opj_pi_next_cprl (Closes: #844551).

 -- Hugo Lefeuvre <hle@debian.org>  Tue, 08 Oct 2019 15:20:27 +0200

openjpeg2 (2.1.2-1.1+deb9u3) stretch-security; urgency=medium

  * Non-maintainer upload by the Security Team.
  * CVE-2018-14423: Division-by-zero vulnerabilities in the functions
    pi_next_pcrl, pi_next_cprl, and pi_next_rpcl (closes: #904873).
  * CVE-2018-6616: Excessive Iteration in opj_t1_encode_cblks
    (closes: #889683).
  * CVE-2017-17480: Write stack buffer overflow due to missing buffer
    length formatter in fscanf call (closes: #884738).
  * CVE-2018-18088: Null pointer dereference caused by null image
    components in imagetopnm (closes: #910763).
  * CVE-2018-5785: Integer overflow in convertbmp.c (closes: #888533).

 -- Luciano Bello <luciano@debian.org>  Thu, 07 Mar 2019 16:41:30 -0500

openjpeg2 (2.1.2-1.1+deb9u2) stretch-security; urgency=medium

  * Fix whitespace/indent mess
  * CVE-2017-14039: CVE-2017-14039.patch
  * CVE-2017-14040: 2cd30c2b06ce332dede81cccad8b334cde997281.patch
  * CVE-2017-14041: e5285319229a5d77bf316bb0d3a6cbd3cb8666d9.patch
  * CVE-2017-14151: afb308b9ccbe129608c9205cf3bb39bbefad90b9.patch
  * CVE-2017-14152: dcac91b8c72f743bda7dbfa9032356bc8110098a.patch

 -- Mathieu Malaterre <malat@debian.org>  Mon, 16 Oct 2017 21:15:20 +0200

openjpeg2 (2.1.2-1.1+deb9u1) stretch-security; urgency=medium

  * CVE-2016-9118: c22cbd8bdf8ff2ae372f94391a4be2d322b36b41.patch
  * CVE-2016-5152: 3fbe71369019df0b47c7a2be4fab8c05768f2f32.patch
  * CVE-2016-1628: 11445eddad7e7fa5b273d1c83c91011c44e5d586.patch
  * CVE-2016-10504: 397f62c0a838e15d667ef50e27d5d011d2c79c04.patch

 -- Mathieu Malaterre <malat@debian.org>  Mon, 16 Oct 2017 07:27:49 +0200

openjpeg2 (2.1.2-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add CVE-2016-9572_CVE-2016-9573.patch patch.
    CVE-2016-9572: NULL pointer dereference in input decoding
    CVE-2016-9573: Heap out-of-bounds read due to insufficient check in
    imagetopnm(). (Closes: #851422)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 22 Jan 2017 14:18:13 +0100

openjpeg2 (2.1.2-1) unstable; urgency=medium

  * New upstream. Closes: #839120
  * Fix CVE-2016-7163. Closes: #837604
  * Fix CVE-2016-7445. Closes: #838690
  * Remove patches applied upstream:

 -- Mathieu Malaterre <malat@debian.org>  Thu, 29 Sep 2016 08:11:30 +0200

openjpeg2 (2.1.1-1) unstable; urgency=medium

  * New upstream. Closes: #829734
    + d/watch points toward github now
    + Fix man page typos. Closes: #772889, #784377
    + Raise priority to optional. Closes: #822577
    + Fix multiple CVEs: Closes: #800453, #800149, #818399
  * Fix pc file. Closes: #787383
  * Remove reference to contrib. Closes: #820190
  * Bump Std-Vers to 3.9.8, no changes needed

 -- Mathieu Malaterre <malat@debian.org>  Mon, 11 Jul 2016 09:28:19 +0200

# For older changelog entries, run 'apt-get changelog libopenjp2-7'
