lrzip (0.616-1ubuntu0.1~esm2) trusty-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2020-25467.patch: fixed a null pointer dereference 
      that was discovered in lzo_decompress_buf function.
    - CVE-2020-25467 
  * SECURITY UPDATE: Memory Corruption
    - debian/patches/CVE-2022-28044.patch: fixed a heap memory corruption
      discovered in initialize_control function.
    - CVE-2022-28044

 -- Amir Naseredini <amir.naseredini@canonical.com>  Fri, 27 Jan 2023 14:47:20 +0000

lrzip (0.616-1ubuntu0.1~esm1) trusty-security; urgency=medium

  * SECURITY UPDATE: Fix infinity loop issues among others.
    - d/p/0002-Use-dealloc-wrapper-to-minimise-risk-of-local-use-af.patch: Use
      dealloc in local use.
    - d/p/0003-Fix-assignment-to-deallocated-buffer-in-failed-decom.patch: Fix
      deallocated assigment with an else.
    - d/p/0004-Minor-memory-cleanups-for-failed-decompressions.patch: Memory
      cleanup.
    - d/p/0005-Cope-with-compressed-length-being-longer-than-uncomp.patch: Cope
      with compressed length being longer than uncompressed and rounding up,
      attending to CVE-2017-8844.
    - d/p/0006-Further-s_buf-dealloc-fixes-on-failed-decompression.patch:
      Deallocation fix.
    - d/p/0007-Missed-one-decomp-clean-up.patch: Complementary fix.
    - d/p/0008-Avoid-crash-from-corrupt-archive-reading-matches-bey.patch:
      Avoid crash from corrupt archive reading matches beyond end of stream.
    - d/p/0009-Add-invalid-chunk-data-testing-in-info-mode.patch: Invalid
      chunk test.
    - d/p/0010-Add-sanity-checking-on-chunk-data-on-decompression.patch:
      Sanity check.
    - d/p/0011-Add-sanity-check-for-invalid-values-during-decompres.patch:
      More sanity checks.
    - d/p/0012-Add-sanity-checking-for-chunk-data-in-the-file-heade.patch:
      More sanity checks.
    - d/p/0013-Add-more-sanity-checks-for-chunk-data.patch: More sanity
      checks.
    - d/p/0014-Clean-up-error-warnings.patch: Changing warning messages.
    - d/p/0015-Prevent-infinite-loop-in-runzip_fd-with-crafted-dama.patch
      Prevent infinite loop in runzip_fd with crafted/damaged archive.
    - d/p/0016-Prevent-infinite-loop-from-crafted-corrupt-archive-i.patch:
      Prevent infinite loop from crafted/corrupt archive in unzip_match.
    - d/p/0017-Silence-possibly-inadequate-space-warning-with-f-and.patch:
      Change warning in arguments.
    - d/p/0018-Silence-tiny-leak-warning.patch: Changing warning messages.
    - d/p/0019-Fix-zero-sized-archive-decompression.patch: Zero size check.
    - d/p/0020-Check-for-invalid-last_head-entries-avoiding-infinit.patch:
      Avoid infinity loop for invalid entries.
    - d/p/0021-Fix-failure-to-pthread-join-on-corrupt-archives-call.patch: Fix
      failure to pthread join on corrupt archives calling fill_buffer again at
      the end of a stream.
    - d/p/0022-Fix-lrztar-error-when-no-arguments-given.patch: Check fix.
    - d/p/0023-Check-for-invalid-expected-sizes-and-abort.patch: Invalid size
      fix.
    - d/p/0024-Minor-memleak-clean-ups-on-failures.patch: memory leak fix.
    - d/p/0025-Cope-with-corrupt-crafted-archive-stream-overruns.patch: Avoid
      corrupt overruns.
    - CVE-2018-5650
    - CVE-2018-5747
    - CVE-2018-5786
    - CVE-2018-9058
    - CVE-2018-10685
    - CVE-2018-11496

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Wed, 23 Jan 2019 17:24:15 -0200

lrzip (0.616-1) unstable; urgency=low

  * New upstream release, fixes manpage typos (closes: #655295).
  * Use dh-autoreconf to update config.{sub,guess} (closes: #727925).
  * Update Standards-Version to 3.9.5 .
  * New maintainer (closes: #742878).

 -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Fri, 28 Mar 2014 18:38:44 +0100

lrzip (0.608-2) unstable; urgency=low

  * debian/compat
    - Update to 9
  * debian/control
    - (Build-Depends): update to debhelper 9, dpkg-dev 1.16.1.
  * debian/copyright
    - (Source, X-Upstream-Vcs-Git): Update location.
    - (debian/*): Update year.
  * debian/rules
    - Use hardened CFLAGS (release goal).
      http://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags

 -- Jari Aalto <jari.aalto@cante.net>  Wed, 08 Feb 2012 17:25:07 -0500

lrzip (0.608-1) unstable; urgency=low

  * New upstream release.

 -- Jari Aalto <jari.aalto@cante.net>  Mon, 24 Oct 2011 17:22:16 +0300

lrzip (0.607+20110921+gita28def8-1) unstable; urgency=low

  * New upstream release
    - On hurd-i386 missing mremap (FTBFS; Closes: #642271).
  * debian/patches
    - (bash completion.d): Delete; accepted upstream.

 -- Jari Aalto <jari.aalto@cante.net>  Wed, 21 Sep 2011 10:01:26 +0300

lrzip (0.607+20110917+git79c2e9a-2) unstable; urgency=low

  * debian/rules:
   - (override_dh_auto_install): do not install bash completion; already
     in package bash-completion (Closes: #642062).

 -- Jari Aalto <jari.aalto@cante.net>  Mon, 19 Sep 2011 12:39:37 +0300

lrzip (0.607+20110917+git79c2e9a-1) unstable; urgency=low

  [Jari Aalto]
  * New upstream release.
    - Packaged from upstream VCS due to fixed in the build system.
  * debian/copyright
    - (Format): update URL.
    - (debian/*): Add license.
  * debian/rules
    - (override_dh_auto_configure): Simplify if-test.
    - (override_dh_auto_install): remove ChangeLog as this is already
      handled by dh_installchangelogs; would cause duplicate (lintian).

  [tony mancill]
  * add completion.d.patch

 -- Jari Aalto <jari.aalto@cante.net>  Sun, 18 Sep 2011 10:22:48 +0300

lrzip (0.603+2011.0423+git7ed977b-1) unstable; urgency=low

  * New upstream snapshot.
    - Fix failure to compress big files (Closes: #623745).
  * debian/control
    - (Build-Depends): Add automake, autoconf, libtool.
  * debian/rules
    - (override_dh_auto_configure): New. For snapshot packaging.

 -- Jari Aalto <jari.aalto@cante.net>  Tue, 26 Apr 2011 10:30:59 +0300

lrzip (0.602-1) unstable; urgency=low

  * New upstream release.
  * debian/control
    - (Standards-Version): 3.9.2.
  * debian/copyright
    - Update to official DEP5.
    - Clarify LZMA licence.

 -- Jari Aalto <jari.aalto@cante.net>  Thu, 21 Apr 2011 19:54:41 +0300

lrzip (0.552+20110217+gitcd8b086-1) unstable; urgency=low

  * Snapshot from upstream version control repository.
    - Fix FTBFS on kFreeBSD (Closes: #607978).

 -- Jari Aalto <jari.aalto@cante.net>  Thu, 17 Feb 2011 15:19:46 +0200

lrzip (0.552-1) unstable; urgency=low

  * New upstream release
    - Fix data loss with large files (Closes: #611980).

 -- Jari Aalto <jari.aalto@cante.net>  Thu, 17 Feb 2011 15:18:28 +0200

lrzip (0.551-1) unstable; urgency=low

  * New upstream release (Closes: #607063).

 -- Jari Aalto <jari.aalto@cante.net>  Tue, 14 Dec 2010 17:43:54 +0200

lrzip (0.530-1) unstable; urgency=low

  * New upstream release.
  * debian/*.mk
    - Remove. File no longer needed or accepted upstream.
  * debian/patches
    - Remove. Included in upstream sources.
  * debian/rules
    - Clean up targets due to removed *.mk files.

 -- Jari Aalto <jari.aalto@cante.net>  Sat, 13 Nov 2010 18:28:36 +0200

lrzip (0.47-1) unstable; urgency=low

  * New upstream release.
  * debian/rules:
    - (override_dh_auto_build): New.
  * debian/patches
    - (10): Refresh. Define NO_ASSEMBLER.
    - (20): Remove. Accepted upstream.

 -- Jari Aalto <jari.aalto@cante.net>  Wed, 27 Oct 2010 19:35:52 +0300

lrzip (0.46-1) unstable; urgency=low

  * New upstream release.
  * debian/compat
    - Update to 8.
  * debian/control
    - (Build-Depends): update to debhelper 8.
    - (Standards-Version): 3.9.1.
  * debian/copyright
    - Cosmetic changes.
  * debian/patches
    - (20): New. Rewrite symlink handling in Makefile.in::install target.
  * debian/rules
    - Remove extra targets that can be handled by dh(1).

 -- Jari Aalto <jari.aalto@cante.net>  Tue, 26 Oct 2010 18:55:29 +0300

lrzip (0.45-1) unstable; urgency=low

  * New upstream release.
  * debian/*.pod
    - Delete files. Accepted by upstream.
  * debian/copyright
    - (X-Upstream-Vc-Git): New field.
  * debian/patches
    - (Number 00, 01, 20): Delete files. Accepted by upstream
      (Closes: #573204, #573203, #573200, #573198, #573197).
  * debian/rules
    - (man): Delete target. Upstream accepted all manual pages.
    - (override_dh_auto_install): New; convert from 'install'.

 -- Jari Aalto <jari.aalto@cante.net>  Tue, 30 Mar 2010 16:26:08 +0300

lrzip (0.44-2) unstable; urgency=medium

  * debian/debian-autotools.mk
    - New helper macros.
  * debian/control
    - (Build-Depends): update to 7.1.
    - (Standards-Version): update to 3.8.4.
  * debian/license.sh
    - Update find options.
  * debian/pod2man.mk
    - Add PODDATE
  * debian/repack.sh
    - Adjust comments.
  * debian/rules
    - (override_dh_auto_configure): New rule. Use new config.{sub,guess}
      files at configure time. (FTBFS AVR32; Closes: #566652).
    - (override_dh_auto_clean): Preserve original files.

 -- Jari Aalto <jari.aalto@cante.net>  Tue, 09 Mar 2010 22:12:00 +0200

lrzip (0.44-1) unstable; urgency=low

  * Initial release (Closes: #455457).

 -- Jari Aalto <jari.aalto@cante.net>  Sat, 09 Jan 2010 19:31:52 +0200
