tigervnc (1.10.1+dfsg-3ubuntu0.20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: Enforce building of TigerVNC against a version of
    xorg-server-source that is not vulnerable to CVE-2023-1393.
    (LP: #2048442)

 -- Aaron Rainbolt <arraybolt3@ubuntu.com>  Tue, 23 Jan 2024 14:31:07 -0600

tigervnc (1.10.1+dfsg-3) unstable; urgency=medium

  [ Joachim Falk ]
  * Fixed issue "Authentication failure: Out of memory" when
    saving server certificate exceptions
    (https://github.com/TigerVNC/tigervnc/issues/915).

 -- Joachim Falk <joachim.falk@gmx.de>  Thu, 09 Apr 2020 08:49:31 +0200

tigervnc (1.10.1+dfsg-2) unstable; urgency=medium

  [ Joachim Falk ]
  * Build fix for xorg-server-source 1.20.7, which moved ddxInputThread
    call from os layer into ddx layer (Closes: #951938).

 -- Joachim Falk <joachim.falk@gmx.de>  Thu, 12 Mar 2020 18:57:16 +0100

tigervnc (1.10.1+dfsg-1) unstable; urgency=high

  [ Joachim Falk ]
  * Fresh upstream TigerVNC 1.10.1 fixes CVE-2019-15691, CVE-2019-15692,
    CVE-2019-15693, CVE-2019-15694, and CVE-2019-15695 (Closes: #947428)
  * Fixed bug in PlatformPixelBuffer::setupShm to use correct width and height
    methods.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 30 Dec 2019 15:38:21 +0100

tigervnc (1.9.0+dfsg-4) unstable; urgency=medium

  [ Joachim Falk ]
  * Fix gnome shell integration of xtigervncviewer by updating
    xtigervncviewer.desktop and WM_CLASS of xtigervncviewer. (Closes: #905905)
  * Added missing dependencies to enable RANDR support in x0tigervncserver,
    i.e., tigervnc-scraping-server. Also ensure that dropping these
    dependencies will lead to a fatal build error in the future. (Closes:
    #929410)
  * Bumped version number in Debian provided man pages to TigerVNC 1.9
    (Closes: #932264).
  * Fixed two typos in Debian provided tigervncserver man page.
  * Fix crash on disconnect for TigerVNC 1.9 if internal http server used
    (Closes: #932832).
  * Added missing dependency on netbase for tigervnc-standalone-server
    to enable perl function getprotobyname() (Closes: #939055).

  [ Mike Gabriel ]
  * debian/control:
    + Bump Standards-Version: to 4.4.0. No changes needed.

 -- Mike Gabriel <sunweaver@debian.org>  Sat, 28 Sep 2019 12:06:12 +0200

tigervnc (1.9.0+dfsg-3) unstable; urgency=medium

  [ Joachim Falk ]
  * Add missing dependency on libunwind-dev according to xorg-server-1.20.3
    control file. (Closes: #911712).
  * Fixed linitian complaints about patches/series.
  * Replace media/icons/tigervnc_16.png of wrong dimensions 20x20 by our fixed
    version.
  * Added debian/upstream/metadata.
  * Updated debian/copyright with excluded files and reason as well as
    refreshed TigerVNC homepage URL.
  * Updated debian/watch to correctly repack into a +dfsg.orig.tar.xz
    excluding files specified in debian/copyright.
  * Updated xtigervncviewer.desktop to shut up AppStream hint errors.

  [ Mike Gabriel ]
  * debian/patches:
    + Add patch headers to all patches currently in use.
  * debian/control:
    + Turn versioned Conflicts: into Breaks:/Replaces: relation.
    + Bump Standards-Version: to 4.2.1. No changes needed.
    + Use my @debian.org mail address in Uploaders: field.
    + Drop B-D on dh-autoreconf. Not required for DH compat level 10 and above.
  * debian/rules:
    + Enable all hardening build flags.
    + Remove empty line at EOF.
  * debian/{control,compat}:
    + Bump DH compat level to version 10 (for now, as CDBS does not yet
      support version 11).

 -- Mike Gabriel <sunweaver@debian.org>  Sat, 01 Dec 2018 22:51:29 +0100

tigervnc (1.9.0+dfsg-2) unstable; urgency=medium

  [ Christoph Biedl ]
  * Add missing dependency on libunwind-dev. (Closes: #911712).

  [ Joachim Falk ]
  * Add missing .desktop file and icons for xtigervncviewer. (Closes: #905905).

  [ Mike Gabriel ]
  * debian/*: White-space clean up.
  * debian/control: Comment out one occursion of dh-autoreconf. Thanks lintian.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 29 Oct 2018 10:42:06 +0100

tigervnc (1.9.0+dfsg-1) unstable; urgency=high

  [ Joachim Falk ]
  * Fixed typo in tigervncserver wrapper script (Closes: #881276).
  * In /etc/X11/Xvnc-session, $SHELL should be quoted (Closes: #866061).
  * Updated Vcs-* fields in control to use new gitlab at salsa.debian.org.
  * Fixed underlying reason for bug #880308. Unfortunately, quoting in
    /usr/share/xserver-xorg/configure_flags.mk is fucked up in buster and
    ${xxx} is not escaped correctly. We now work around this problem
    and now again use consistent configure flags to build Xtigervnc.
  * Fresh upstream TigerVNC 1.9 (Closes: #877780 and Closes: #873151).

  [ Philipp Wolski ]
  * Added rfbport to supported commandline arguments for
    tightvncserver wrapper (Closes: #867175)

 -- Yaroslav Halchenko <debian@onerussian.com>  Sun, 29 Jul 2018 09:31:03 -0400

tigervnc (1.7.0+dfsg-8) unstable; urgency=high

  [ Joachim Falk ]
  * Applied patch from Chris Lamb to enable reproducible builds
    for TigerVNC (Closes: #865753).

  [ Ola Lundqvist ]
  * Build fix to move lib to usr/lib. A bit tricky case. Closes: #880308.

 -- Ola Lundqvist <opal@debian.org>  Mon, 04 Dec 2017 10:39:19 +0100

tigervnc (1.7.0+dfsg-7) unstable; urgency=high

  [ Joachim Falk ]
  * Fixed the following security vulnerabilities (Closes: #859259):
  - Fix SSecurityVeNCrypt.cxx; SSecurityVeNCrypt::SSecurityVeNCrypt.
    An unauthenticated client can cause a small memory leak in the server.
    (CVE-2017-7392)
  - Fix VNCSConnectionST.cxx VNCSConnectionST::fence. An authenticated client
    can cause a double free, leading to denial of service or potentially code
    execution. (CVE-2017-7393)
  - Fix SSecurityPlain.cxx SSecurityPlain::processMsg. An unauthenticated
    users can crash the server by sending long usernames. (CVE-2017-7394)
  - Fix SMsgReader.cxx SMsgReader::readClientCutText. An authenticated client
    can crash the server by causing an integer overflow. (CVE-2017-7395)
  - Fix CConnection.cxx CConnection::CConnection. An unauthenticated client
    can cause a small memory leak in the server. (CVE-2017-7396)
  * The tigervncserver wrapper script gives up and kills the server it
    just started if it doesn't have its VNC-TCP and X11-unix sockets up and
    running within a second. However, if a machine is a bit bogged down,
    this can prevent starting the server at all, for no good reason.
    Thus, the timeout has been increased to 30 seconds. (Closes: #859141)
  * Refreshed dependencies for Xtigervnc server build from xorg-server-1.19.2
    used in stretch. (Closes: #858048)

 -- Yaroslav Halchenko <debian@onerussian.com>  Sun, 09 Apr 2017 10:38:13 -0400

# For older changelog entries, run 'apt-get changelog tigervnc-viewer'
