libonig (6.1.3-2+deb9u2) stretch-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Revert patch for CVE-2020-26159. It was a false-positive.
    https://github.com/kkos/oniguruma/issues/221

 -- Markus Koschany <apo@debian.org>  Sat, 30 Jan 2021 22:28:38 +0100

libonig (6.1.3-2+deb9u1) stretch-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Fix CVE-2019-13224:
    A use-after-free in onig_new_deluxe() in regext.c allows
    attackers to potentially cause information disclosure, denial of service,
    or possibly code execution by providing a crafted regular expression. The
    attacker provides a pair of a regex pattern and a string, with a multi-byte
    encoding that gets handled by onig_new_deluxe().
  * Fix CVE-2019-16163:
    Oniguruma allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
  * Fix CVE-2019-19012:
    An integer overflow in the search_in_range function in regexec.c in
    Onigurama leads to an out-of-bounds read, in which the offset of this read
    is under the control of an attacker. (This only affects the 32-bit compiled
    version). Remote attackers can cause a denial-of-service or information
    disclosure, or possibly have unspecified other impact, via a crafted
    regular expression.
  * Fix CVE-2019-19203:
    An issue was discovered in Oniguruma. In the function gb18030_mbc_enc_len
    in file gb18030.c, a UChar pointer is dereferenced without checking if it
    passed the end of the matched string. This leads to a heap-based buffer
    over-read.
  * Fix CVE-2019-19204:
    An issue was discovered in Oniguruma. In the function
    fetch_interval_quantifier (formerly known as fetch_range_quantifier) in
    regparse.c, PFETCH is called without checking PEND. This leads to a
    heap-based buffer over-read.
  * Fix CVE-2019-19246:
    Oniguruma has a heap-based buffer over-read in str_lower_case_match in
    regexec.c.
  * Fix CVE-2020-26159:
    In Oniguruma an attacker able to supply a regular expression for
    compilation may be able to overflow a buffer by one byte in
    concat_opt_exact_str in src/regcomp.c

 -- Markus Koschany <apo@debian.org>  Wed, 04 Nov 2020 22:45:44 +0100

libonig (6.1.3-2) unstable; urgency=high

  * New debian/patches/0500-CVE-2017-922[4-9].patch:
    - Cherrypicked from upstream to correct:
      + CVE-2017-9224 (Closes: #863312)
      + CVE-2017-9225 (Closes: #863313)
      + CVE-2017-9226 (Closes: #863314)
      + CVE-2017-9227 (Closes: #863315)
      + CVE-2017-9228 (Closes: #863316)
      + CVE-2017-9229 (Closes: #863318)

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sat, 27 May 2017 12:05:50 +0200

libonig (6.1.3-1) unstable; urgency=medium

  * New upstream release.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Thu, 15 Dec 2016 09:23:30 +0100

libonig (6.1.2-1) unstable; urgency=medium

  * New upstream release.
  * debian/control:
    - Bump debhelper B-D minimum version to 10.
  * New debian/patches/0100-source_typos.patch.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 09 Nov 2016 23:16:44 +0100

libonig (6.1.1-2) unstable; urgency=medium

  * Upload to unstable.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sun, 04 Sep 2016 21:26:20 +0200

libonig (6.1.1-1) experimental; urgency=medium

  * New upstream release.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sat, 03 Sep 2016 02:42:58 +0200

libonig (6.1.0-1) experimental; urgency=medium

  * New upstream release.
    - NEW API: onig_scan().
  * debian/control:
    - To match with the soname rename packages from liboing3 to libonig4.
  * debian/rules:
    - Rename liboing3 to libonig4.
  * Renew debian/symbols.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 31 Aug 2016 04:18:16 +0200

libonig (6.0.0-1) experimental; urgency=medium

  * New upstream release.
  * debian/control:
    - Remove dpkg from libonig2-dbg Pre-Depends because redundance
      with ${misc:Pre-Depends}.
    - Replace homepage to the new loacation.
    - To match with the soname rename packages from liboing2 to libonig3.
    - Bump Standards-Version to 3.9.8 (no changes required).
    - Change Vcs-* to secure URIs.
  * debian/rules:
    - Rename liboing2 to libonig3.
  * debian/watch:
    - Move to github.
    - Bump version to 4 (no changes required).
  * debian/copyright:
    - Replace homepage and upstream mail address.
    - Add year 2016.
  * Remove the not Multi-Arch conform file /usr/bin/onig-config and
    the man page.
  * Remove now useless debian/libonig3-dbg.maintscript.
  * Set compat level to 10.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sat, 14 May 2016 17:53:39 +0200

libonig (5.9.6-1) unstable; urgency=medium

  * New upstream release.
  * Refresh debian/patches/001-changes_build_sys.diff.
  * Refresh debian/symbols.
  * debian/rules:
    - rewrite override_dh_strip.
    - Add dpkg-gensymbols to generate symbol file(s) 
      on every build.
  * debian/copyright:
    Add year 2015 to my entry at debian/*.
  * debian/control:
    - Remove useless Depends ${shlibs:Depends} from libonig2-dbg
      and libonig-dev
    - Add dpkg and ${misc:Pre-Depends} to Depends of libonig2-dbg 
      to prevent error on upgrade wheezy to jessie (Closes: #769556).
    - Bump Standards-Version to 3.9.6 (no changes required).
    - Add Vcs-* fields pointed to alioth.
    - Remove deprecated hardening-wrapper from Build-Depends
      (Closes: #774485).
    - Rewrite Descriptions (Closes: #774520).
  * debian/*.postrm, debian/*.postinst, debian/*.preinst:
    - Delete them and move the dpkg-maintscript-helper to
      debian/libonig2-dbg.maintscript.
  * New debian/libonig2-dbg.maintscript:
    - Add symlink_to_dir calls.
    - Change version in calls of symlink_to_dir to 5.9.6-1~.
  * Add Vcs
  * Add missing MNU changelog entries. Both don't provide a patch with
    the changes and the first one causes a new RC-Bug.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Mon, 05 Jan 2015 10:49:52 +0100

libonig (5.9.5-3.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix version for calls to dpkg-maintscript-helper symlink_to_dir.
    (closes: #769556).

 -- Ivo De Decker <ivodd@debian.org>  Sun, 28 Dec 2014 12:11:12 +0100

libonig (5.9.5-3.1) unstable; urgency=high

  * Non-maintainer upload.
  * Add missing pre-dependency on dpkg for dpkg-maintscript-helper
    symlink_to_dir (closes: #769556).

 -- Julien Cristau <jcristau@debian.org>  Sat, 15 Nov 2014 11:53:45 +0100

libonig (5.9.5-3) unstable; urgency=medium

  * Add debian/libonig2-dbg.(preinst|postinst|postrm) to prevent
    error on upgrade wheezy to jessie. (Closes: #768267)

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Thu, 06 Nov 2014 21:32:20 +0100

libonig (5.9.5-2) unstable; urgency=medium

  * rename debian/*.doc-base
  * add html files to doc
  * change debian/rules for hardening
  * remove Multi-Arch from libonig-dev (Closes: #747897)

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Tue, 13 May 2014 10:25:38 +0200

libonig (5.9.5-1) unstable; urgency=medium

  * remove *.so.* files from libonig2-dbg
    (same files as in libonig2)
  * add debian/libonig-dev.doc-base
  * add debian/symbols
  * rewrite debian/copyright
  * rewrite debian/rules (Closes: #645940)
  * patch buildsystem (Closes: #734683)
  * change lib version to 2.1.0
  * Bump compat to 9
  * Update to upstream version 5.9.5 (Closes: #661616)
  * Bump Standarts to 3.9.5
  * New Maintainer (Closes: #747187)

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 07 May 2014 16:39:54 +0200

libonig (5.9.1-1) unstable; urgency=low

  [ Max Kellermann ]
  * new upstream release
  * acknowledge NMU, thanks Laurent (closes: #426355)
  * run test suite after build
  * added watch file
  * bumped Standards-Version to 3.7.3
  * added homepage header to debian/control
  * priority "extra"

 -- Alexander Wirt <formorer@debian.org>  Mon, 07 Jan 2008 11:46:27 +0100

libonig (5.9.0-0.1) unstable; urgency=low

  * Non-maintainer upload.
  * New upstream release (Closes: #426355)
  * debian/control:
    - Use binary:Version instead of Source-Version
  * debian/rules:
    - Don't hide make distclean error
    - Fix copy of config.{sub,guess}
    - Remove deprecated DH_COMPAT and use compat file instead

 -- Laurent Bigonville <bigon@bigon.be>  Sat, 04 Aug 2007 15:07:34 +0200

libonig (5.5.2-1) unstable; urgency=low

  * new upstream release

 -- Max Kellermann <max@duempel.org>  Wed, 14 Feb 2007 23:12:29 +0100

libonig (5.5.0-1) unstable; urgency=low

  [ Max Kellermann ]
  * new upstream release
  * update config.{sub,guess} in debian/rules
  * removed libonig.la

 -- Alexander Wirt <formorer@debian.org>  Wed,  6 Dec 2006 20:51:10 +0100

libonig (5.2.0-1) unstable; urgency=low

  * new upstream release
  * updated copyright file since license has been changed to BSD

 -- Max Kellermann <max@duempel.org>  Wed, 15 Nov 2006 09:32:24 +0100

libonig (4.4.4-1) unstable; urgency=low

  * initial debian release (Closes: #388412)

 -- Max Kellermann <max@duempel.org>  Wed, 20 Sep 2006 12:17:40 +0200
