ring (20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1) focal-security; urgency=medium

  * fake sync from Debian

 -- Amir Naseredini <amir.naseredini@canonical.com>  Wed, 04 Oct 2023 18:06:53 +0100

ring (20190215.1.f152c98~ds1-1+deb10u2) buster-security; urgency=high

  * Non-maintainer upload by the LTS Team.
  * CVE-2021-37706
    The header length of an incoming STUN message, containing an 
    ERROR-CODE attribute, must not be negative.
  * CVE-2021-43299
    CVE-2021-43300
    CVE-2021-43301
    CVE-2021-43302
    CVE-2021-43303
    The length of an attacker controlled filename needs to be checked.
  * CVE-2021-43804
    Check declared length of incoming RTCP BYE message with actual
    received packet size.
  * CVE-2021-43845
    Check length of data field in incoming RTCP XR message with actual
    received packet size.
  * CVE-2022-21722
    incoming RTP/RTCP packets might cause out-of-bound read access
  * CVE-2022-21723
    an incoming SIP message that contains a malformed multipart might
    cause out-of-bound read access
  * CVE-2022-23537
    A buffer overread might be possible when parsing a crafted
    STUN message with unknown attribute
  * CVE-2022-23608
    A buffer overread might be possible when parsing a crafted
    STUN message with unknown attribute
  * CVE-2022-24754
    stack-buffer overflow vulnerability which only impacts PJSIP users
    who accept hashed digest credentials (credentials with data_type
    `PJSIP_CRED_DATA_DIGEST`).
  * CVE-2022-24763
    denial-of-service vulnerability when using PJSIP's XML parsing
  * CVE-2022-24764
    stack buffer overflow vulnerability in pjmedia_sdp_print() and
    pjmedia_sdp_media_print()
  * CVE-2022-24793
    buffer overflow vulnerability affects applications that use
    PJSIP DNS resolution. This vulnerability is related to
    CVE-2023-27585 but appears in a different function.
    parse_rr() <-> parse_query()
  * CVE-2022-31031
    a stack buffer overflow vulnerability affects applications
    that use STUN
  * CVE-2022-39244
    buffer overflow vulnerability in the PJSIP parser,
    PJMEDIA RTP decoder, and PJMEDIA SDP parser
  * CVE-2023-27585
    buffer overflow vulnerability affects applications that use
    PJSIP DNS resolution. This vulnerability is related to
    CVE-2022-24793 but appears in a different function.
    parse_query() <-> parse_rr()
  * CVE-2022-23547
    Possible buffer overread when parsing a certain STUN message
    This issue is similar to CVE-2022-23537

 -- Thorsten Alteholz <debian@alteholz.de>  Mon, 28 Aug 2023 23:03:02 +0200

ring (20190215.1.f152c98~ds1-1+deb10u1) buster; urgency=high

  * Non-maintainer upload by the LTS Team.
  * CVE-2021-21375 (Closes: #986815)
    The embedded copy of pjproject is affected by this CVE.
    Due to bad handling of two consecutive crafted answers to an INVITE,
    the attacker is able to crash the server resulting in a denial of
    service.

 -- Thorsten Alteholz <debian@alteholz.de>  Thu, 22 Apr 2021 19:03:02 +0200

ring (20190215.1.f152c98~ds1-1) unstable; urgency=medium

  * New upstream version.
  * Refresh patches.

 -- Alexandre Viau <aviau@debian.org>  Mon, 18 Feb 2019 22:46:25 -0500

ring (20190110.1.e572469~ds1-1) unstable; urgency=medium

  * New upstream version.

 -- Alexandre Viau <aviau@debian.org>  Mon, 14 Jan 2019 10:23:11 -0500

ring (20190101.3.5315d84~ds1-2) unstable; urgency=medium

  * Remove unused libsrtp dependency. (Closes: 918543)

 -- Alexandre Viau <aviau@debian.org>  Mon, 14 Jan 2019 10:08:09 -0500

ring (20190101.3.5315d84~ds1-1) unstable; urgency=medium

  * New upstream version.
  * Rename binary packages to jami. Upstream has not fully completed
    the transition yet and there are still things that use the Ring
    name. However, this is a step in the right direction.

 -- Alexandre Viau <aviau@debian.org>  Sat, 05 Jan 2019 21:53:29 -0500

ring (20181001.4.a99aaec~ds6-2) unstable; urgency=medium

  * Build with LFS. (Closes: #913186)

 -- Alexandre Viau <aviau@debian.org>  Thu, 08 Nov 2018 13:02:52 -0500

ring (20181001.4.a99aaec~ds6-1) unstable; urgency=medium

  * Exclude graddle jar.

 -- Alexandre Viau <aviau@debian.org>  Thu, 08 Nov 2018 11:55:47 -0500

ring (20181001.4.a99aaec~ds5-1) unstable; urgency=medium

  * New upstream version.

 -- Alexandre Viau <aviau@debian.org>  Thu, 08 Nov 2018 11:46:08 -0500

# For older changelog entries, run 'apt-get changelog jami-daemon'
