cjson (1.7.15-1ubuntu0.1+esm1) jammy-security; urgency=medium

  [Allen Huang <allen.huang@canonical.com>]
  * SECURITY UPDATE: null pointer dereference
    - debian/patches/CVE-2023-50471-50472-1.patch: add NULL checks in
      cJSON_InsertItemInArray and cJSON_SetValuestring.
    - debian/patches/CVE-2023-50471-50472-2.patch: fix error in null
      checkings
    - CVE-2023-50471
    - CVE-2023-50472
  * SECURITY UPDATE: null pointer dereference
    - debian/patches/CVE-2024-31755-1.patch: adds the NULL check of
      valuestring before it is dereferenced.
    - debian/patches/CVE-2024-31755-2.patch: update comments and add
      tests for cJSON_SetValuestring.
    - CVE-2024-31755

 -- Shishir Subedi <shishir.subedi@canonical.com>  Mon, 26 Jan 2026 14:22:14 +0545

cjson (1.7.15-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service when parsing large numbers
    - debian/patches/CVE-2023-26819.patch: allocate dynamic memory for
      temporary buffer instead of using fixed 64-byte stack buffer in
      parse_number() function in cJSON.c
    - CVE-2023-26819

  * SECURITY UPDATE: heap buffer overflow in parse_string function
    - debian/patches/CVE-2023-53154.patch: add bounds checking in
      parse_string() to prevent out-of-bounds read when parsing JSON
      strings without null terminators
    - CVE-2023-53154

  * SECURITY UPDATE: Out-of-bounds memory access
    - debian/patches/CVE-2025-57052.patch: fix the incorrect check in
      decode_array_index_from_pointer
    - CVE-2025-57052

 -- Shishir Subedi <shishir.subedi@canonical.com>  Wed, 21 Jan 2026 14:12:11 +0545

cjson (1.7.15-1) unstable; urgency=medium

  * New upstream release 1.7.15.
  * Bump Standards-Version to 4.6.0 (no changes needed).

 -- Boyuan Yang <byang@debian.org>  Sun, 29 Aug 2021 16:30:06 -0400

cjson (1.7.14-1) unstable; urgency=medium

  * New upstream release 1.7.14.
  * debian/symbols: Refresh symbols.

 -- Boyuan Yang <byang@debian.org>  Sun, 06 Sep 2020 10:48:14 -0400

cjson (1.7.13-1) unstable; urgency=medium

  * New upstream release 1.7.13.
  * debian/symbols: Refresh symbols.

 -- Boyuan Yang <byang@debian.org>  Sat, 23 May 2020 19:27:39 -0400

cjson (1.7.10-2) unstable; urgency=medium

  * Take over package maintenance. (Closes: #958656)
  * debian/control:
    + Bump Standards-Version to 4.5.0.
    + Bump debhelper compat to v13.
    + Update URL in Vcs-* packaging repository.
  * debian/libcjson-dev.install: Also install cmake/pkgconfig files.

 -- Boyuan Yang <byang@debian.org>  Sat, 23 May 2020 07:16:39 +0800

cjson (1.7.10-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Cherry pick upstream commit a43fa56a63920343d0ac8f8e73a6b0447867f459,
    which contains fixes for CVEs (Closes: #928726)
    + CVE-2019-11834
    + CVE-2019-11835

 -- Gordon Ball <gordon@chronitis.net>  Tue, 14 May 2019 08:52:20 +0000

cjson (1.7.10-1) unstable; urgency=medium

  * New upstream version 1.7.10

 -- Yanhao Mo <yanhaocs@gmail.com>  Mon, 07 Jan 2019 16:17:56 +0800

cjson (1.7.8-1) unstable; urgency=medium

  * New upstream version 1.7.8
  * Bump Standards-Version to 4.2.0 (no changes needed).
  * Apply wrap-and-sort changes.

 -- Yanhao Mo <yanhaocs@gmail.com>  Sun, 14 Oct 2018 11:11:09 +0800

cjson (1.7.7-1) unstable; urgency=medium

  * New upstream version 1.7.7
    + Fix a memory leak when realloc fails.
  * Bump Standards-Version to 4.2.0 (no changes needed).

 -- Yanhao Mo <yanhaocs@gmail.com>  Thu, 23 Aug 2018 16:42:05 +0800

cjson (1.7.5-1) unstable; urgency=medium

  * Initial release. Closes: #870443

 -- Yanhao Mo <yanhaocs@gmail.com>  Thu, 29 Mar 2018 22:53:48 +0800
