musl (1.1.9-1ubuntu0.1~esm3) xenial-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds writes possible in certain i386 math
    functions
    - debian/patches/CVE-2019-14697.patch: removes underflow check code
      which could write out-of-bounds 
    - CVE-2019-14697
  * SECURITY UPDATE: wide-character conversion could become stuck in an
    infinite loop or write out-of-bounds
    - debian/patches/CVE-2020-28928.patch: sets max loops and limits
    - CVE-2020-28928

 -- Mark Esler <mark.esler@canonical.com>  Thu, 30 Mar 2023 11:57:02 -0500

musl (1.1.9-1ubuntu0.1~esm2) xenial-security; urgency=medium

  * SECURITY UPDATE: Buffer Underflow and Code Execution
    - debian/patches/CVE-2018-1000001.patch: make getcwd fail if it cannot
      obtain an absolute path
    - CVE-2018-1000001

  * SECURITY UPDATE: Buffer Overflow
    - debian/patches/CVE-2017-15650.patch: in dns parsing callback, enforce
      MAXADDRS to preclude overflow
    - CVE-2017-15650

  * SECURITY UPDATE: Integer Overflow
    - debian/patches/CVE-2016-8859-1.patch: Fix missing integer overflow
      checks in regexec buffer size computations
    - debian/patches/CVE-2016-8859-2.patch: Fix regexec with haystack strings
      longer than INT_MAX
    - debian/patches/CVE-2016-8859-3.patch: Fix free of uninitialized buffer
      pointer on error in regexec
    - CVE-2016-8859
 
  * Resolve FTBFS on ARM architectures (Debian 812278). Use
    the --enable-gcc-wrapper option to include the musl-gcc wrapper.

 -- Mike Salvatore <mike.salvatore@canonical.com>  Fri, 12 Apr 2019 09:29:05 -0400

musl (1.1.9-1) unstable; urgency=low

  [ Kevin Bortis ]
  * Import upstream version 1.1.9 
  * Provide linux-libc-dev on musl-linux-any
  
  [ Helmut Grohne ]
  * Build musl for the corresponding musl-linux-any (Closes: #783078)
  * Provide libc-dev on musl-linux-any

 -- Kevin Bortis <pkgs@bortis.ch>  Wed, 29 Apr 2015 18:16:36 +0200

musl (1.1.8-1~exp1) experimental; urgency=low

  * Import upstream version 1.1.8
  * Fixes possible stack-based buffer overflow CVE-2015-1817
  * Includes new aarch64 port

 -- Kevin Bortis <pkgs@bortis.ch>  Tue, 31 Mar 2015 19:49:20 +0200

musl (1.1.5-1) unstable; urgency=low

  [ Kevin Bortis ]
  * Import upstream version 1.1.5
  * New library-level C11 support

  [ Anton Gladky ]
  * Set Standards-Version: 3.9.6. No changes.

 -- Kevin Bortis <pkgs@bortis.ch>  Tue, 14 Oct 2014 21:13:35 +0200

musl (1.1.4-1) unstable; urgency=low

  * Import upstream version 1.1.4. (Closes: #754758)
  * Fixes possible stack-based buffer overflow CVE-2014-3484 (Closes: #750815) 
  * Includes fix for build regression on armhf and armel

 -- Kevin Bortis <pkgs@bortis.ch>  Mon, 26 May 2014 22:45:52 +0200

musl (1.1.0-1) unstable; urgency=low

  [ Kevin Bortis ]
  * Import upstream version 1.1.0

  [ Anton Gladky ]
  * Add autopkgtest according to DEP-8

 -- Kevin Bortis <pkgs@bortis.ch>  Fri, 25 Apr 2014 19:49:40 +0000

musl (1.0.0-1) unstable; urgency=medium

  * Import upstream version 1.0.0
  * Provide musl-ldd (Closes: #732169)
  * Arch independent ld-musl-config (Closes: #739205)

 -- Kevin Bortis <pkgs@bortis.ch>  Sat, 22 Mar 2014 09:39:56 +0100

musl (0.9.15-1) unstable; urgency=low

  * Import upstream version 0.9.15
  * Do no longer provide libc-dev (Closes: #725376)
  * Make runtime package multi-arch (Closes: #732170)

 -- Kevin Bortis <pkgs@bortis.ch>  Sun, 05 Jan 2014 20:11:11 +0100

musl (0.9.14-2) unstable; urgency=low

  * Make musl-tools depend on musl-dev (Closes: #725060)
  * Place each package in the correct section (Closes: #725148)

 -- Kevin Bortis <pkgs@bortis.ch>  Fri, 04 Oct 2013 21:45:54 +0200

musl (0.9.14-1) unstable; urgency=low

  * Import upstream version 0.9.14
  * Only build on fully supported architectures
  * Point to new homepage in control file (Closes: #724277)
  * Revorked debian/rules
  * Solved possible problem with postrm script (Closes: #724247)

 -- Kevin Bortis <pkgs@bortis.ch>  Fri, 27 Sep 2013 23:47:18 +0200

musl (0.9.13-3) unstable; urgency=low

  * Ready for Debian upload  (Closes: #713072) 
  * Respect user set CC
  * Reworked package according to feedback given
    by Anton Gladky. See #721839 for reference.
  * Reworked debian/copyright file according to
    feedback given by Paul Richards Tagliamonte

 -- Kevin Bortis <pkgs@bortis.ch>  Fri, 20 Sep 2013 20:54:14 +0200

musl (0.9.13-2) unstable; urgency=low

  * Added preliminary manpages for ld-musl-config and musl-gcc

 -- Kevin Bortis <pkgs@bortis.ch>  Fri, 20 Sep 2013 19:20:33 +0200

musl (0.9.13-1) unstable; urgency=low

  * Import upstream version 0.9.13

 -- Kevin Bortis <pkgs@bortis.ch>  Sun, 01 Sep 2013 22:20:46 +0200

musl (0.9.12-2) unstable; urgency=low

  * Corrected lintian error "description-starts-with-package-name"
  * Corrected lintian warning "shared-lib-without-dependency-information" 

 -- Kevin Bortis <pkgs@bortis.ch>  Fri, 02 Aug 2013 15:22:17 +0200

musl (0.9.12-1) unstable; urgency=low

  * Import upstream version 0.9.12
  * New LDSO_PATHNAME for armhf (/etc/ld-musl-armhf.path)

 -- Kevin Bortis <pkgs@bortis.ch>  Mon, 29 Jul 2013 15:46:21 +0000

musl (0.9.11-1) unstable; urgency=low

  * Import upstream version 0.9.11

 -- Kevin Bortis <pkgs@bortis.ch>  Sun, 30 Jun 2013 18:16:00 +0200

musl (0.9.10-1) unstable; urgency=low

  * Initial release (Closes: #713072)

 -- Kevin Bortis <pkgs@bortis.ch>  Fri, 21 Jun 2013 17:12:20 +0200
