libwebp (0.4.0-4ubuntu0.1~esm1) trusty-security; urgency=medium

  [ Marc Deslauriers ]
  * SECURITY UPDATE: heap-based buffer overflow in GetLE16() and GetLE24()
    - debian/patches/CVE-2018-25009.patch: check data_size in
      src/mux/muxread.c.
    - CVE-2018-25009
    - CVE-2018-25012
  * SECURITY UPDATE: heap-based buffer overflow in PutLE16()
    - debian/patches/CVE-2018-25011.patch: limit number of image chunks in
      src/mux/muxread.c.
    - CVE-2018-25011
  * SECURITY UPDATE: heap-based buffer overflow in ShiftBytes() and in
    ReadSymbol()
    - debian/patches/CVE-2018-25013_4.patch: wait for all threads to be
      done in DecodeRemaining in src/dec/idec_dec.c.
    - CVE-2018-25013
    - CVE-2018-25014
  * SECURITY UPDATE: heap-based buffer overflow in WebPDecode*Into functions
    - debian/patches/CVE-2020-36328.patch: fix buffer size check in
      src/dec/buffer_dec.c.
    - CVE-2020-36328
  * SECURITY UPDATE: use-after-free in EmitFancyRGB()
    - debian/patches/CVE-2020-36329.patch: fix thread race
      heap-use-after-free in src/dec/idec_dec.c.
    - CVE-2020-36329
  * SECURITY UPDATE: heap-based buffer overflow in ChunkVerifyAndAssign()
    - debian/patches/CVE-2020-36330.patch: fix riff size checks in
      src/mux/muxread.c.
    - CVE-2020-36330
  * SECURITY UPDATE: heap-based buffer overflow in ChunkAssignData()
    - debian/patches/CVE-2020-36331.patch: validate chunk_size in
      src/mux/muxi.h, src/mux/muxread.c.
    - CVE-2020-36331

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Tue, 08 Jun 2021 11:49:06 -0300

libwebp (0.4.0-4) unstable; urgency=low

  * Promote from experimental to unstable
  * Begin webp transition, see bug #731168

 -- Jeff Breidenbach <jab@debian.org>  Mon, 13 Jan 2014 10:07:43 -0800

libwebp (0.4.0-3) experimental; urgency=low

  * Add libwebpdemux.so and more binaries at request of upstream

 -- Jeff Breidenbach <jab@debian.org>  Wed, 08 Jan 2014 10:15:12 -0800

libwebp (0.4.0-2) experimental; urgency=low

  * New upstream release
  * Enable metadata support (closes: #728119)

 -- Jeff Breidenbach <jab@debian.org>  Fri, 03 Jan 2014 13:28:23 -0800

libwebp (0.3.0-3) unstable; urgency=low

  * No change, just migrating to unstable

 -- Jeff Breidenbach <jab@debian.org>  Thu, 30 May 2013 14:55:03 -0700

libwebp (0.3.0-1) experimental; urgency=low

  * New upstream release

 -- Jeff Breidenbach <jab@debian.org>  Thu, 11 Apr 2013 12:24:07 -0700

libwebp (0.2.1-3) experimental; urgency=low

  * Fix builds everywhere.
    Was fine if you run 'dh build', but -arch or -indep after clean failed.
    And it worked fine in my experimental pbuilder chroot...
  * Add a dependency on libtiff-dev | libtiff4-dev.

 -- Darren Salt <devspam@moreofthesa.me.uk>  Tue, 12 Feb 2013 15:00:52 +0000

libwebp (0.2.1-2) experimental; urgency=low

  * Add a pkgconfig file (closes: #699285)

 -- Jeff Breidenbach <jab@debian.org>  Tue, 12 Feb 2013 00:50:19 +0000

libwebp (0.2.1-1) experimental; urgency=low

  * New upstream release. (Closes: #684339)
    - libwebp.so.4, so package name bump.
    - Target experimental to avoid disrupting wheezy freeze.
  * Adjust PNG dev dependency. (Closes: #662415)
  * Use dh ... --parallel.
  * Bumped standards version to 3.9.3.
  * Adjusted debian/copyright (lintian boilerplate error).
  * Added myself as an uploader (ref. bug 684339).

 -- Darren Salt <devspam@moreofthesa.me.uk>  Fri, 23 Nov 2012 00:34:46 +0000

libwebp (0.1.3-3) unstable; urgency=low

  * Close dependency bug fixed in last update (closes: #657896)
  * Accept multi-arch support from Felix Geyer (closes: #659027)

 -- Jeff Breidenbach <jab@debian.org>  Wed, 22 Feb 2012 12:00:56 -0800

libwebp (0.1.3-2.1) unstable; urgency=low

  * Non-maintainer upload.
  * Build-Depend on libjpeg-dev instead of libjpeg62-dev, and drop hardcoded
    shared library dependencies from webp.

 -- Julien Cristau <jcristau@debian.org>  Sun, 29 Jan 2012 18:29:55 +0100

libwebp (0.1.3-2) unstable; urgency=low

  * Improve description ever so slightly (closes: #647434)

 -- Jeff Breidenbach <jab@debian.org>  Thu, 08 Dec 2011 16:34:49 -0800

libwebp (0.1.3-1) unstable; urgency=low

  * New upstream release (closes: #645154)
  * Fix typos in description (closes: #637156)

 -- Jeff Breidenbach <jab@debian.org>  Mon, 31 Oct 2011 10:15:38 -0700

libwebp (0.1.2-1) unstable; urgency=low

  * New upstream release
  * Explicit PNG and JPEG dependencies (closes: #622386)
  * Remove .la filse (closes: #622515)

 -- Jeff Breidenbach <jab@debian.org>  Wed, 13 Apr 2011 15:14:03 -0700

libwebp (0.1-1) unstable; urgency=low

  * Initial release.

 -- Jeff Breidenbach <jab@debian.org>  Mon, 28 Feb 2011 17:25:17 -0800
