radare2 (2.3.0+dfsg-2) unstable; urgency=medium

  * Add missing libcapstone-dev dependency to libradare2-dev
  * Fix Vcs urls

 -- Sebastian Reichel <sre@debian.org>  Fri, 23 Feb 2018 11:38:59 +0100

radare2 (2.3.0+dfsg-1) unstable; urgency=medium

  * New upstream release
  * Switch to package maintence from alioth to salsa
  * Make package team-maintained under pkg-security-team umbrella
  * Update Debian Standards Version to 4.1.3
  * Fix priority-extra-is-replaced-by-priority-optional
  * Update debian/copyright, debian/watch to use native support
    for cleaning up the orig tarball and drop the get-orig-source
    target from debian/rules.

 -- Sebastian Reichel <sre@debian.org>  Wed, 14 Feb 2018 17:48:06 +0100

radare2 (2.1.0+dfsg-1) unstable; urgency=medium

  * New upstream release
   - Fix for CVE-2017-15368 (Closes: #878767)
     The wasm_dis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0
     allows remote attackers to cause a denial of service (stack-based
     buffer over-read and application crash) or possibly have unspecified
     other impact via a crafted WASM file that triggers an incorrect
     r_hex_bin2str call.
   - Fix for CVE-2017-15385 (Closes: #879119)
     The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c
     in radare2 2.0.0 allows remote attackers to cause a denial of service
     (r_read_le16 invalid write and application crash) or possibly have
     unspecified other impact via a crafted ELF file.
   - Fix for CVE-2017-15932 (Closes: #880024)
     In radare2 2.0.1, an integer exception (negative number leading to an
     invalid memory access) exists in store_versioninfo_gnu_verdef() in
     libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF
     version on 32bit systems.
   - Fix for CVE-2017-15931 (Closes: #880025)
     In radare2 2.0.1, an integer exception (negative number leading to an
     invalid memory access) exists in store_versioninfo_gnu_verneed() in
     libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems.
   - Fix for CVE-2017-16359 (Closes: #880616)
     In radare 2.0.1, a pointer wraparound vulnerability exists in
     store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.
   - Fix for CVE-2017-16358 (Closes: #880619)
     In radare 2.0.1, an out-of-bounds read vulnerability exists in
     string_scan_range() in libr/bin/bin.c when doing a string search.
   - Fix for CVE-2017-16357 (Closes: #880620)
     In radare 2.0.1, a memory corruption vulnerability exists in
     store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in
     libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This
     error is due to improper sh_size validation when allocating memory.
   - Fix for CVE-2017-16805 (Closes: #882134)
     In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a
     denial of service (invalid read and application crash) via a crafted
     ELF file, related to r_bin_dwarf_parse_comp_unit in dwarf.c and
     sdb_set_internal in shlr/sdb/src/sdb.c.
  * Update Debian Standards Version to 4.1.1

 -- Sebastian Reichel <sre@debian.org>  Mon, 27 Nov 2017 16:14:43 +0100

radare2 (2.0.0+dfsg-1) unstable; urgency=medium

  * New upstream release
   - Fix for CVE-2017-9761 (Closes: #869428)
     The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote
     attackers to cause a denial of service (heap-based out-of-bounds read
     and application crash) via a crafted binary file.
   - Fix for CVE-2017-9762 (Closes: #869426)
     The cmd_info function in libr/core/cmd_info.c in radare2 1.5.0 allows
     remote attackers to cause a denial of service (use-after-free and
     application crash) via a crafted binary file.
   - Fix for CVE-2017-9763 (Closes: #869423)
     The grub_ext2_read_block function in fs/ext2.c in GNU GRUB before
     2013-11-12, as used in shlr/grub/fs/ext2.c in radare2 1.5.0, allows
     remote attackers to cause a denial of service (excessive stack use and
     application crash) via a crafted binary file, related to use of a
     variable-size stack array.
  * remove broken r2-indent symlink (Closes: #874524)
  * install upstream's zsh completion files

 -- Sebastian Reichel <sre@debian.org>  Wed, 11 Oct 2017 16:20:18 +0200

radare2 (1.6.0+dfsg-1) unstable; urgency=medium

  * New upstream release
   - Fix for CVE-2017-9520 (Closes: #864533)
     The r_config_set function in libr/config/config.c in radare2 1.5.0
     allows remote attackers to cause a denial of service (use-after-free
     and application crash) via a crafted DEX file.
   - Fix for CVE-2017-9949 (Closes: #866068)
     The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0
     allows remote attackers to cause a denial of service (stack-based
     buffer underflow and application crash) or possibly have unspecified
     other impact via a crafted binary file, possibly related to a buffer
     underflow in fs/ext2.c in GNU GRUB 2.02.
   - Fix for CVE-2017-10929 (Closes: #867369)
     The grub_memmove function in shlr/grub/kern/misc.c in radare2 1.5.0
     allows remote attackers to cause a denial of service (heap-based buffer
     overflow and application crash) or possibly have unspecified other
     impact via a crafted binary file, possibly related to a read overflow
     in the grub_disk_read_small_real function in kern/disk.c in GNU GRUB
     2.02.
  * Switch to Debian Standard Version 4.0.0

 -- Sebastian Reichel <sre@debian.org>  Thu, 13 Jul 2017 00:05:39 +0200

radare2 (1.5.0+dfsg-1) experimental; urgency=medium

  * New upstream release

 -- Sebastian Reichel <sre@debian.org>  Wed, 31 May 2017 18:14:20 +0200

radare2 (1.4.0+dfsg-1) experimental; urgency=medium

  * New upstream release
    - Dropped cherry picked patches (applied upstream)

 -- Sebastian Reichel <sre@debian.org>  Tue, 18 Apr 2017 22:34:57 +0200

radare2 (1.3.0+dfsg-2) experimental; urgency=medium

  * Add upstream patch to fix CVE-2017-7274 (Closes: #858873)

 -- Sebastian Reichel <sre@debian.org>  Wed, 29 Mar 2017 00:53:13 +0200

radare2 (1.3.0+dfsg-1) experimental; urgency=low

  * New upstream release
    - Dropped cherry picked patches (applied upstream)

 -- Sebastian Reichel <sre@debian.org>  Mon, 13 Mar 2017 16:14:13 +0100

radare2 (1.2.1+dfsg-5) experimental; urgency=high

  * Add upstream patches to fix security bugs
    - CVE-2017-6415 (Closes: #856572)
      The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2
      1.2.1 allows remote attackers to cause a denial of service (NULL
      pointer dereference and application crash) via a crafted DEX file.
    - CVE-2017-6387 (Closes: #856574)
      The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1
      allows remote attackers to cause a denial of service (out-of-bounds
      read and application crash) via a crafted DEX file.
    - CVE-2017-6319 (Closes: #856579)
      The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2
      1.2.1 allows remote attackers to cause a denial of service (buffer
      overflow and application crash) or possibly have unspecified other
      impact via a crafted DEX file.
  * Add small patch from Graham Inggs to fix FTBFS when
    linked with as-needed (Closes: #856329)

 -- Sebastian Reichel <sre@debian.org>  Fri, 03 Mar 2017 06:24:35 +0100

# For older changelog entries, run 'apt-get changelog libradare2-common'
