python3.5 (3.5.2-2ubuntu0~16.04.4~14.04.1) trusty; urgency=medium

  * Backport python3.5 to trusty for building Firefox

  * Don't perform a PGO build, as it causes crashes during the build
  * Drop the libpython3.5-stdlib Breaks on libmpdec2 (<< 2.4.2), as this
    doesn't appear to be needed. Python 3.5 and 3.4 are both bundled with the
    same version, and trusty's Python 3.4 is already built against and using
    2.4.0

 -- Chris Coulson <chris.coulson@canonical.com>  Tue, 03 Apr 2018 20:16:03 +0100

python3.5 (3.5.2-2ubuntu0~16.04.4) xenial-security; urgency=medium

  * SECURITY UPDATE: integer overflow in the PyBytes_DecodeEscape
    function
    - debian/patches/CVE-2017-1000158.patch: fix this integer overflow
      in Objects/bytesobject.c.
    - CVE-2017-1000158

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Thu, 23 Nov 2017 13:37:01 -0300

python3.5 (3.5.2-2ubuntu0~16.04.3) xenial; urgency=medium

  * Explicitly use the system python for byte compilation in postinst scripts.
    (LP: #1682934)

 -- Brian Murray <brian@ubuntu.com>  Thu, 14 Sep 2017 15:51:06 -0700

python3.5 (3.5.2-2ubuntu0~16.04.2) xenial; urgency=medium

  * SRU: LP: #1711724 Fix dict segfault. Issue #27945.

 -- Clint Byrum <clint@ubuntu.com>  Fri, 18 Aug 2017 10:48:00 -0700

python3.5 (3.5.2-2ubuntu0~16.04.1) xenial-security; urgency=medium

  * SECURITY UPDATE: use of HTTP_PROXY flag supplied by attacker in CGI
    scripts (aka HTTPOXY attack)
    - debian/patches/CVE-2016-1000110.patch: if running as CGI
      script, forget HTTP_PROXY in Lib/urllib.py, add test to
      Lib/test/test_urllib.py, add documentation.
    - CVE-2016-1000110
  * NOTE: backport of 3.5.2 to Ubuntu 16.04 LTS also addresses:
    - CVE-2016-0772: StartTLS stripping attack
    - CVE-2016-5636: Integer overflow when handling zipfiles

 -- Steve Beattie <sbeattie@ubuntu.com>  Thu, 17 Nov 2016 09:05:23 -0800

python3.5 (3.5.2-2~16.04) xenial-proposed; urgency=medium

  * SRU: LP: #1620754: Fix invalid code in pyhash/siphash24. Issue #28055.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 10 Sep 2016 10:21:44 +0200

python3.5 (3.5.2-2~16.01) xenial-proposed; urgency=medium

  * SRU: LP: #1591887. Backport 3.5.2 to 16.04 LTS.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 05 Jul 2016 14:43:10 +0200

python3.5 (3.5.2-2) unstable; urgency=medium

  * asyncio: Fix callbacks race in SelectorLoop.sock_connect, proposed patch
    taken from https://github.com/python/asyncio/pull/366.
  * asyncio: Fix NameError in asyncio.sslproto. Closes: #827453.

 -- Matthias Klose <doko@debian.org>  Tue, 05 Jul 2016 13:33:36 +0200

python3.5 (3.5.2-1) unstable; urgency=medium

  * Python 3.5.2 release.
    - Issue #26867: Ubuntu's openssl OP_NO_SSLv3 is forced on by default;
      fix test.
    - Issue #27365: Allow non-ascii in idlelib/NEWS.txt.

 -- Matthias Klose <doko@debian.org>  Mon, 27 Jun 2016 08:22:49 +0200

python3.5 (3.5.2~rc1-3) unstable; urgency=medium

  * Fix building with the wheel files in the source package.

 -- Matthias Klose <doko@debian.org>  Mon, 13 Jun 2016 11:33:26 +0200

# For older changelog entries, run 'apt-get changelog libpython3.5-minimal'
