uriparser (0.8.4-1+deb9u2ubuntu0.1+esm2) bionic-security; urgency=medium

  * SECURITY UPDATE: stack exhaustion via unbounded recursion in URI parser
  - debian/patches/CVE-2025-67899_1.patch: convert tail-recursive calls
    to iterative goto loops in src/UriParse.c
  - debian/patches/CVE-2025-67899_2.patch: dissolve indirect recursion
    in ParseIpFutLoop/ParseIpFutStopGo in src/UriParse.c
  - debian/patches/CVE-2025-67899_3.patch: dissolve indirect recursion
    in ParseOwnHostUserInfoNz in src/UriParse.c
  - CVE-2025-67899

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Thu, 28 May 2026 17:30:57 +0000

uriparser (0.8.4-1+deb9u2ubuntu0.1+esm1) bionic-security; urgency=medium

  * SECURITY UPDATE: Integer Overflow
    - debian/patches/CVE-2024-34402.patch: Replace int type with size_t
    - CVE-2024-34402
    - debian/patches/CVE-2024-34403.patch: Check if string length is
      INT_MAX
    - CVE-2024-34403

 -- Bruce Cable <bruce.cable@canonical.com>  Mon, 17 Mar 2025 17:55:59 +1100

uriparser (0.8.4-1+deb9u2ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Use after free
    - debian/patches/CVE-2021-46141_46142.patch: Fix .hostText copying in
      uriMakeOwnerEngine.
    - CVE-2021-46141
    - CVE-2021-46142
  * Additional fixes:
    - debian/patches/implement_new_public_urlMakeOwner.patch: UriNormalize.c:
      Implement new public uriMakeOwner*
    - debian/patches/rename_internal_uriMakeOwner.patch: UriNormalize.c:
      Rename internal uriMakeOwner to uriMakeOwnerEngine
    - debian/patches/test_cover_new_uriMakeOwner.patch: test.cpp: Cover
      new uriMakeOwner*  

 -- David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>  Tue, 12 Jul 2022 15:52:39 +0200

uriparser (0.8.4-1+deb9u2build0.18.04.1) bionic-security; urgency=medium

  * fake sync from Debian

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Fri, 03 Dec 2021 18:59:12 +0100

uriparser (0.8.4-1+deb9u2) stretch-security; urgency=medium

  * Non-maintainer upload by the LTS team.
  * CVE-2018-20721: Out-of-bounds read for an incomplete URI with
    an IPv6 address containing an embedded IPv4 address.

 -- Adrian Bunk <bunk@debian.org>  Wed, 01 Dec 2021 00:25:38 +0200

uriparser (0.8.4-1+deb9u1) stable; urgency=medium

  * Fix multiple CVEs (Closes: #913817):
    - New debian/patches/CVE-2018-19198.patch to fix CVE-2018-19198.
    - New debian/patches/CVE-2018-19199.patch to fix CVE-2018-19199.
    - New debian/patches/CVE-2018-19200.patch to fix CVE-2018-19200.
  * debian/control:
    - Change to my new email address.
    - Switch Vcs-* to new location.

 -- Jörg Frings-Fürst <debian@jff.email>  Fri, 16 Nov 2018 09:43:24 +0100

uriparser (0.8.4-1) unstable; urgency=medium

  * New upstream release.
  * debian/liburiparser-dev.links:
    - Bump library version to 1.0.20.
  * Add package liburiparser-doc:
    - debian/rules:
      + Add override_dh_auto_build-indep and override_dh_installdocs-indep
        to handle the build and install the html documentation.
    - debian/control:
      + Add Build-Depends-Indep.
      + Add new package liburiparser-doc.
    - New debian/liburiparser-doc.doc-base.
    - New debian/liburiparser-doc.dirs.
  * New debian/liburiparser-doc.lintian-overrides to override the lintian
    warning "embedded-javascript-library".
  * debian/copyright:
    - Change GPL-3.0+ to GPL-3+.
    - Change Upstream Mail Address to Sebastian Pipping <webmaster@hartwork.org>
  * debian/rules:
    - Add override_dh_compress to exclude *.qhp.
    - Remove -c0 from dh_makeshlibs call.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 04 Nov 2015 07:02:13 +0100

uriparser (0.8.3-1) unstable; urgency=low

  * New upstream release.
  * New debian/upstream/metadata:
    - Add some DEP-12 upstream metadata.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 07 Oct 2015 18:35:50 +0200

uriparser (0.8.2-1) unstable; urgency=low

  * New upstream release.
  * debian/control:
    - Bump Standards-Version to 3.9.6 (no changes required).
    - Remove unknown substitution variable ${shlibs:Depends}
      from liburiparser-dev.
  * Refresh debian/liburiparser1.symbols.
  * Refresh link to usr/lib/liburiparser.so in liburiparser-dev.links.
  * debian/copyright:
    - Add License and author for the new files:
      +  test/VersionSuite.*.
  * debian/source/options:
    - Removed because xz is now standard compression.
  * debian/rules:
    - Enable hardening.
    - Add override_dh_makeshlibs for testing symbols.
  * Enable mulitarch:
    - debian/rules:
      + Add --libdir to confflags
    - debian/liburiparser-dev.links:
      + Add dh-exec shebang line.
      + Add ${DEB_HOST_MULTIARCH}.
      + make file executable.
    - debian/*.install:
      + Change the path (add /*/).
    - debian/control:
      + Add dh-exec (>=0.3) to Build-Depends.
      + Add Pre-Depends: ${misc:Pre-Depends} to package liburiparser1.
      + Add Multi-Arch: same to package liburiparser1.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Tue, 28 Apr 2015 08:18:53 +0200

uriparser (0.8.0.1-2) unstable; urgency=low

  * debian/rules:
    - Add --with autoreconf to enable update Build Environment
      (Closes: #727517).
      + Thanks to Breno Leitao <brenohl@br.ibm.com>

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sat, 16 Aug 2014 09:30:15 +0200

uriparser (0.8.0.1-1) unstable; urgency=medium

  * New Maintainer (Closes: #754473).
  * New upstream release (Closes: #668244).
    - Remove nonfree items from source (Closes: #753833):
      + doc/rfc3513.htm.
      + doc/rfc3986.htm.
      + doc/rfc3986_grammar_only.txt.
      + Remove debian/prune-tarball.sh.
      + Remove debian/README.Debian-source.
  * debian/control:
    - Set myself as maintainer.
    - Bump Standards-Version to 3.9.5 (no changes required).
    - Update Build-Depends:
      + Add dh-autoreconf for update Build Environment (Closes: #727517).
    - Change description of liburiparser1  (Closes: #552993).
    - For previously not existing Vcs
      + Create a new git repository on alioth.
      + Add the Fields Vcs-Browser and Vcs-Git.
  * Change debian/compat to 9 (no changes required).
  * Add debian/source/options:
    - Set compression to xz & compression-level to 9 to save space.
  * debian/copyright:
    - Rewrite into machine-readable format.
    - Add myself to the list of authors for debian/*.
    - Update copyright years for 2014.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 06 Aug 2014 21:23:55 +0200

uriparser (0.8.0+dfsg-1) UNRELEASED; urgency=medium

  * Change debian/watch
    - change upstream tarball to all filetypes.
  * remove debian/rules.old

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sat, 12 Jul 2014 05:09:11 +0200


uriparser (0.7.5-1) unstable; urgency=low

  * New upstream release.
  * New maintainer. (Closes: #544633)
  * Use more minimalistic approach to rules using debhelper 7.
  * Add --disable-test to configure because cpptest-1.1.0 isn't packaged yet.
  * Add --disable-doc to configure to prevent generation of api docs.
  * Switch to dpkg-source 3.0 (quilt) format
  * Update *.install files to more inclusive of files to install.
  * Re-enable watch file, as it seems to work just fine with uscan.

 -- Taylor LeMasurier-Wren <ripps818@gmail.com>  Sat, 15 May 2010 13:47:20 -0500

uriparser (0.7.4-2) unstable; urgency=low

  * Bump to Standards-Version 3.8.2.
  * Set maintainer to Debian QA Group.

 -- Clint Adams <schizo@debian.org>  Sat, 01 Aug 2009 01:12:33 -0400

uriparser (0.7.4-1) unstable; urgency=low

  * New upstream release.  closes: #493073.
  * Add myself to Uploaders.
  * Bump to Standards-Version 3.8.0.
  * debian/prune-tarball.sh: also remove RFC1866.

 -- Clint Adams <schizo@debian.org>  Sat, 14 Feb 2009 10:36:07 -0500

uriparser (0.6.4-1) unstable; urgency=low

  * New upstream release.
  * Bump Standard-Versions to 3.7.3 (no changes needed).

 -- Adeodato Simó <dato@net.com.org.es>  Sun, 09 Mar 2008 11:54:35 +0100

uriparser (0.6.3-1) unstable; urgency=low

  * New upstream release.

 -- Adeodato Simó <dato@net.com.org.es>  Mon, 11 Feb 2008 19:48:38 +0100

uriparser (0.6.1-1) unstable; urgency=low

  * New upstream version. 

  * Add a watch file.

  * Convert debian/liburiparser1.symbols to be a dpkg-gensymbols file.
    SymbolFile.pm blacklists arch-specific symbols, so this closes: #448959.

 -- Adeodato Simó <dato@net.com.org.es>  Wed, 26 Dec 2007 18:42:29 +0100

uriparser (0.6.0-1) unstable; urgency=low

  * Initial release. (Closes: #443222)

  * Include in the .diff.gz hunks to allow building in a separate tree.
    This will be fixed in the next upstream release.

 -- Adeodato Simó <dato@net.com.org.es>  Wed, 19 Sep 2007 21:07:20 +0200
