tomcat7 (7.0.78-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 24 May 2017 18:03:19 +0200

tomcat7 (7.0.75-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 24 Jan 2017 13:13:38 +0100

tomcat7 (7.0.73-1) unstable; urgency=medium

  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 16 Nov 2016 10:53:00 +0100

tomcat7 (7.0.72-4) unstable; urgency=medium

  * Depend on libcglib-nodep-java instead of libcglib3-java

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 07 Nov 2016 16:55:48 +0100

tomcat7 (7.0.72-3) unstable; urgency=medium

  * Build only the Servlet API (Closes: #819259, #834680)

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 05 Nov 2016 22:57:29 +0100

tomcat7 (7.0.72-2) unstable; urgency=high

  * Team upload.
  * CVE-2016-1240 follow-up:
    - The previous init.d fix was vulnerable to a race condition that could
      be exploited to make any existing file writable by the tomcat user.
      Thanks to Paul Szabo for the report and the fix.
    - The catalina.policy file generated on startup was affected by a similar
      vulnerability that could be exploited to overwrite any file on the system.
      Thanks to Paul Szabo for the report.
  * Hardened the init.d script, thanks to Paul Szabo
  * Switch to debhelper level 10

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 28 Oct 2016 01:34:22 +0200

tomcat7 (7.0.72-1) unstable; urgency=medium

  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 20 Sep 2016 13:28:54 +0200

tomcat7 (7.0.70-3) unstable; urgency=high

  * Team upload.
  * Fixed CVE-2016-1240: A flaw in the init.d startup script allows local
    attackers who have gained access to the server in the context of the
    tomcat user through a vulnerability in a web application to replace
    the catalina.out file with a symlink to an arbitrary file on the system,
    potentially leading to a root privilege escalation.
    Thanks to Dawid Golunski for the report.

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 14 Sep 2016 10:56:45 +0200

tomcat7 (7.0.70-2) unstable; urgency=medium

  * Team upload.
  * Do not unconditionally override files in /etc/tomcat7. (Closes: #821391)
  * Change file permissions to 640 for Debian files in /etc/tomcat7.

 -- Markus Koschany <apo@debian.org>  Tue, 02 Aug 2016 11:43:11 +0200

tomcat7 (7.0.70-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 20 Jun 2016 10:58:56 +0200

# For older changelog entries, run 'apt-get changelog libservlet3.0-java'
