virtuoso-opensource (6.1.6+repack-0ubuntu10+esm2) focal-security; urgency=medium

  * SECURITY UPDATE: SQL Injection
    - debian/patches/CVE-2023-31620.patch: Fixed issue placing simple
      functions inside control exp (fixes #1128)
    - debian/patches/CVE-2023-31622.patch: Fixed missing check for table
      in positioned delete (fixes #1135)
    - debian/patches/CVE-2023-31624.patch: Fixed check number of values
      vs cols when inserting into view (fixes #1134)
    - debian/patches/CVE-2023-31626.patch: Fixed handling of aliases in
      output (fixes #1129)
    - debian/patches/CVE-2023-31627.patch: Fixed first argument of
      CONTAINS() cannot be star (fixes #1140)
    - debian/patches/CVE-2023-31629.patch: Fixed wrap unions etc. if non-
      select for EXISTS ( subq ) (fixes #1139)
    - debian/patches/CVE-2023-31630.patch: Added check for non-terminals
      in WITH DATA (fixes #1138)
    - debian/patches/CVE-2023-31631.patch: Fixed missing check if column
      exists (fixes #1137)
    - debian/patches/CVE-2023-48951.patch: Fixed check constraint cannot
      use CONTAINS text predicate (fixes #1177)
    - CVE-2023-31620
    - CVE-2023-31622
    - CVE-2023-31624
    - CVE-2023-31626
    - CVE-2023-31627
    - CVE-2023-31629
    - CVE-2023-31630
    - CVE-2023-31631
    - CVE-2023-48951

 -- Allen Huang <allen.huang@canonical.com>  Thu, 04 Jul 2024 12:47:50 +0100

virtuoso-opensource (6.1.6+repack-0ubuntu10+esm1) focal-security; urgency=medium

  * SECURITY UPDATE: SQL Injection
    - debian/patches/CVE-2023-31607.patch: Fixed missing check for max
      number of key parts
    - debian/patches/CVE-2023-31608.patch: Fixed 64bit arith overflow
    - debian/patches/CVE-2023-31609.patch: Fixed issue if original dfe
      not there; see error in optimizer
    - debian/patches/CVE-2023-31610-31619-31623-31625-31628.patch: Fixed
      missing arguments in table def
    - debian/patches/CVE-2023-31611.patch: Fixed expand column list
      during parsing
    - debian/patches/CVE-2023-31616.patch: Fixed 64bit arith exception
    - debian/patches/CVE-2023-31617.patch: Fixed save/restore temp refs
    - debian/patches/CVE-2023-31618.patch: Fixed non-terminal in union
      branch is not supported
    - CVE-2023-31607
    - CVE-2023-31608
    - CVE-2023-31609
    - CVE-2023-31610
    - CVE-2023-31611
    - CVE-2023-31616
    - CVE-2023-31617
    - CVE-2023-31618
    - CVE-2023-31619
    - CVE-2023-31623
    - CVE-2023-31625
    - CVE-2023-31628

 -- Allen Huang <allen.huang@canonical.com>  Tue, 11 Jun 2024 11:15:09 +0100

virtuoso-opensource (6.1.6+repack-0ubuntu10) disco; urgency=medium

  * No-change rebuild for readline soname change.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 14 Jan 2019 20:05:24 +0000

virtuoso-opensource (6.1.6+repack-0ubuntu9) bionic; urgency=medium

  * Cherrypick patch from Debian for openssl1.1 support.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 06 Feb 2018 19:21:29 +0000

virtuoso-opensource (6.1.6+repack-0ubuntu8) bionic; urgency=high

  * No change rebuild against openssl1.1.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 05 Feb 2018 16:57:00 +0000

virtuoso-opensource (6.1.6+repack-0ubuntu7) zesty; urgency=medium

  * Rebuild against new imagemagick libs.

 -- Bhavani Shankar <bhavi@ubuntu.com>  Fri, 20 Jan 2017 11:40:32 +0530

virtuoso-opensource (6.1.6+repack-0ubuntu6) yakkety; urgency=medium

  * No-change rebuild for readline soname change.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 17 Sep 2016 12:12:02 +0000

virtuoso-opensource (6.1.6+repack-0ubuntu5) xenial; urgency=medium

  * Remove the saddr_t typedef, which clashes with system headers on s390x
    (closes: #805157).

 -- Colin Watson <cjwatson@ubuntu.com>  Thu, 24 Dec 2015 17:10:02 +0000

virtuoso-opensource (6.1.6+repack-0ubuntu4) vivid; urgency=medium

  * Rebuild against libmagickcore-6.q16-2.

 -- Colin Watson <cjwatson@ubuntu.com>  Thu, 30 Oct 2014 12:28:05 +0000

virtuoso-opensource (6.1.6+repack-0ubuntu3) saucy; urgency=low

  * Don't hardcode automake versions, this tends to break things and
    eat unicorns
  * Pass add-missing to automake to fix build

 -- Rohan Garg <rohangarg@kubuntu.org>  Mon, 23 Sep 2013 20:45:25 +0200

virtuoso-opensource (6.1.6+repack-0ubuntu2) raring; urgency=low

  * Add --with-debug to the extra configure flags so we get debugging symbols
    for the application binaries

 -- Philip Muškovac <yofel@kubuntu.org>  Mon, 14 Jan 2013 18:16:56 +0100

virtuoso-opensource (6.1.6+repack-0ubuntu1) quantal; urgency=low

  * Rebuild to fix version number

 -- Jonathan Riddell <jriddell@ubuntu.com>  Mon, 13 Aug 2012 16:39:34 +0100

virtuoso-opensource (6.1.6+repack-0ubuntu1~ppa1) quantal; urgency=low

  * New upstream release 
    - Repack tarbal to remove binary files
    - Drop repack-oat.patch, applied upstream

 -- Rohan Garg <rohangarg@kubuntu.org>  Mon, 06 Aug 2012 19:02:19 +0530

virtuoso-opensource (6.1.4+dfsg1-1ubuntu2) quantal; urgency=low

  * Rebuild for imagemagick 6.7.

 -- Colin Watson <cjwatson@ubuntu.com>  Fri, 13 Jul 2012 11:31:43 +0100

virtuoso-opensource (6.1.4+dfsg1-1ubuntu1) quantal; urgency=low

  * Merge with Debian unstable, remaining changes:
    - Drop build-depends on libwbxml2-dev (in Universe)
  * The virtuoso-nepomuk transitional package was dropped in this merge,
    since updates must now run through precise, and the package is
    transitional there. The replace/break for libvirtodbc0 was removed too.
  * The virtuoso-opensource-6.0 transitional package was dropped for the same
    reasons.

 -- Jonathan Thomas <echidnaman@kubuntu.org>  Sun, 01 Jul 2012 19:20:08 -0400

virtuoso-opensource (6.1.4+dfsg1-1) unstable; urgency=low

  * New upstream release (Closes: #650281).
  * Switch to source format 3.0 (quilt).
  * Update patches:
    - drop fix-wide-char-encoding.patch, applied upstream.
    - update repack-zlib.patch.
    - refresh other patches in order to make them apply without any offset.
    - add ignore-netstat-failure.patch, to avoid FTBFS on various
      architectures, thanks to Steven Chamberlain (Closes: #663010).
  * Bump debhelper compatibility level to 9.
  * Build also with LDFLAGS provided by dpkg-buildflags. Doing this with the
    debhelper compatibility level set to 9 should enable all the default
    hardening flags.
  * Bump build dependency on cli-common-dev to (>= 0.8~).
  * Bump Standards-Version to 3.9.3:
    - moved virtuoso-opensource, virtuoso-server and virtuoso-minimal to the
      new "metapackages" section.
  * Metapackages now have versioned Depends (>= ${binary:Version}) against
    other virtuoso packages.
  * Fix a bug in the init script, now uses start-stop-daemon with "--user",
    this makes the script work when you are running it under Plasma (the KDE
    workspace) with Nepomuk, which may already execute a /usr/bin/virtuoso-t
    process making start-stop-daemon fail.
  * The init script now removes the pid file when you stop the process, thus it
    won't kill innocent processes with unfortunate pids when restarting.
  * /etc/virtuoso-opensource-6.1/virtuoso.ini isn't a conffile anymore, it's
    just handled by maintainer scripts (Closes: #656087).
  * Now virtuoso-opensource-6.1.postrm stops the server.
  * Add README.source explaining how the upstream tarball repacking was done.
    Just for the record the zlib removal is handled different compared to
    previous versions of this package, hence why repack-zlib.patch was updated.
  * Fix Vcs-Browser field, now points to a valid URL.
  * Changes in debian/copyright:
    - remove pcre information since it's removed with the repackaging.
    - remove the "Virtuoso may be linked against..." statements.
    - remove various duplicated mentions about SHA/MD5 Javascript routines.
    - remove "DocBk XML" part, since looks like the file(s) involved aren't
      there anymore.
    - extend information about works from the GNU C Library.
    - add the license for a couple of DocBook DTD's.
    - add Minizip and Info-ZIP licenses.
    - mention the files involved in each license statement from other projects.
    - add myself to the copyright holders for the debian packaging.
  * Add debian/not-installed.
  * Install README.UPGRADE.
  * Add pt_BR debconf translation (Closes: #649152).
  * Update debian/TODO.Debian:
    - remove explanation about broken parallel building, right now looks like
      the problem is just gone.
  * Set myself as maintainer since looks like Obey Arthur Liu is MIA. Arthur,
    you are very wellcomed to come back.
  * Enable the DM-Upload-Allowed flag.

 -- José Manuel Santamaría Lema <panfaust@gmail.com>  Sun, 10 Jun 2012 23:21:02 +0200

virtuoso-opensource (6.1.4+dfsg1-0ubuntu1) precise; urgency=low

  * New upstream release

 -- Jonathan Riddell <jriddell@ubuntu.com>  Wed, 15 Feb 2012 16:37:45 +0000

virtuoso-opensource (6.1.3+dfsg1-2.1) unstable; urgency=low

  * Non-maintainer upload
  * Refresh list of Mono architectures in debian/control
    (Closes: #657781)
  * Use system default Mono compiler by using the mono-devel package
    and the mono-csc command therein (Closes: #658166)

 -- Jo Shields <directhex@apebox.org>  Tue, 31 Jan 2012 18:25:09 +0000

virtuoso-opensource (6.1.3+dfsg1-1ubuntu3) precise; urgency=low

  * No-change rebuild to drop spurious libsfgcc1 dependency on armhf.

 -- Adam Conrad <adconrad@ubuntu.com>  Fri, 02 Dec 2011 17:34:57 -0700

virtuoso-opensource (6.1.3+dfsg1-1ubuntu2) precise; urgency=low

  * No change rebuild for imagemagick4 transition

 -- Michael Terry <mterry@ubuntu.com>  Fri, 18 Nov 2011 12:18:02 -0500

virtuoso-opensource (6.1.3+dfsg1-2) unstable; urgency=low

  * Apply wide char encoding fix from KDE bug 271664,
    thanks Sebastian Trueg.

 -- Obey Arthur Liu <arthur@milliways.fr>  Fri, 14 Oct 2011 02:02:42 +0200

virtuoso-opensource (6.1.3+dfsg1-1ubuntu1) oneiric; urgency=low

  * Merge from debian unstable.  Remaining changes:
    - Make libvirtodbc0 replace/break virtuoso-nepomuk
    - Add virtuoso-opensource-6.0 transitional package with a prerm script
      as a fallback for the old package which fails to upgrade
    - Adjust Breaks/Replaces for Ubuntu versions
    - Drop build-depends on libwbxml2-dev (in Universe)

 -- Scott Kitterman <scott@kitterman.com>  Wed, 10 Aug 2011 09:53:46 -0400

virtuoso-opensource (6.1.3+dfsg1-1) unstable; urgency=low

  * New upstream release (Closes: #626253).
  * Bump standards to 3.9.2.
  * Add missingok to logrotate (LP: #666391).
  * Update translations for cs, da, de, es, fr, it, ja, nl, pt, ru, sk, sv, vi
    (Closes: #605343, #626568, #635150).
  * Relax readline build-depend version requirement (Closes: #634443).
  * Use SIGINT instead of SIGTERM to stop daemon (Closes: #632060).
  * Enable LDAP support (Closes: #633563).
  * Sourcefull rebuild for libmagick transition (Closes: #625561).
  * Make installation paths more Debian compatible.

 -- Obey Arthur Liu <arthur@milliways.fr>  Fri, 29 Jul 2011 11:08:42 +0200

virtuoso-opensource (6.1.2+dfsg1-1ubuntu4) maverick; urgency=low

  * Make libvirtodbc0 replace/break virtuoso-nepomuk. (LP: #608878)
  * Mention that virtuoso-nepomuk is a transitional package in the short
    description.
  * Add virtuoso-opensource-6.0 transitional package and add a prerm script
    as a fallback for the old package which fails to upgrade. (LP: #609924)

 -- Felix Geyer <debfx-pkg@fobos.de>  Mon, 02 Aug 2010 15:54:34 +0200

virtuoso-opensource (6.1.2+dfsg1-1ubuntu3) maverick; urgency=low

  * Conflict/replace older packages with versioned names. We can drop these
    changes in maverick+1

 -- Jonathan Thomas <echidnaman@kubuntu.org>  Thu, 22 Jul 2010 09:46:35 -0400

virtuoso-opensource (6.1.2+dfsg1-1ubuntu2) maverick; urgency=low

  * Remove build-depend on libwbxml2-dev that was added as part of the merge
    accidentally

 -- Jonathan Thomas <echidnaman@kubuntu.org>  Wed, 21 Jul 2010 16:52:15 -0400

virtuoso-opensource (6.1.2+dfsg1-1ubuntu1) maverick; urgency=low

  * Merge with Debian Unstable, remaining changes:
    - Make virtuoso-minimal replace/break virtuoso-nepomuk
    - Keep virtuoso-nepomuk around as a virtual dummy package

 -- Jonathan Thomas <echidnaman@kubuntu.org>  Wed, 21 Jul 2010 15:38:56 -0400

virtuoso-opensource (6.1.2+dfsg1-1) unstable; urgency=low

  * New upstream release.
  * Bump standards to 3.9.0.
  * Retroactively fix typo in closed bug in previous upload changelog.
  * Improve init/postinst sequence to avoid mangling /etc/default.
  * Fix missing odbcinst dependency for the postinst of libvirtodbc0,
    thanks Jonathan Thomas <echidnaman@kubuntu.org>.
  * Shorten tests initialization timeouts to 60 seconds to prevent buildd
    resources tie-ups. Thanks Marc 'HE' Brockschmidt <he@debian.org>
    (Closes: #581267).
  * Debconf translation update:
    - Danish (Joe Dalton) (Closes: #587431)

 -- Obey Arthur Liu <arthur@milliways.fr>  Sun, 11 Jul 2010 11:11:42 -0700

virtuoso-opensource (6.1.1+dfsg1-1) unstable; urgency=medium

  * New upstream release.
  * Correctly fix FTBFS on s390 related to SHM (closes: #574018).
  * Fix FTBFS on alpha due to recent binutils change (closes: 575942).
  * Fix missing-debian-source-format lintian warning.

  [Christian Perrier]
  * Debconf templates and debian/control reviewed by the debian-l10n-
    english team as part of the Smith review project. Closes: #573404
  * [Debconf translation updates]
    - Czech (Michal Simunek).  Closes: #573772
    - Russian (Yuri Kozlov).  Closes: #573861
    - Portuguese (Américo Monteiro).  Closes: #573927
    - Vietnamese (Clytie Siddall).  Closes: #574430
    - French (David Prévot).  Closes: #575042
    - Italian (Vincenzo Campanella).  Closes: #575099
    - German (Martin Eberhard Schauer).  Closes: #575594
    - Swedish (Martin Ågren).  Closes: #575635
    - Spanish (Francisco Javier Cuadrado).  Closes: #575373

 -- Obey Arthur Liu <arthur@milliways.fr>  Sun, 04 Apr 2010 13:21:42 +0200

virtuoso-opensource (6.1.0+dfsg2-3) unstable; urgency=high

  * Emergency rollback of the fix for FTBFS on armel from 6.1.0+dfsg2-2
    causing database binary format incompatibility, closes: #575173.
    There should be no data loss.

 -- Obey Arthur Liu <arthur@milliways.fr>  Wed, 24 Mar 2010 02:03:42 +0100

virtuoso-opensource (6.1.0+dfsg2-2) unstable; urgency=medium

  * Set ODBC registration debconf question for libvirtodbc0 to low priority,
    defaults to Yes.
  * Fix FTBFS on kFreeBSD.
  * Fix FTBFS on armel. Thanks to Sune Vuorela <debian@pusling.com>.
  * Fix FTBFS on s390 by complying with Debian CLI policy, closes: #574018.
  * Fix lintian errors referring to old-fsf-address.
  * Added README.source pointing to quilt README.

 -- Obey Arthur Liu <arthur@milliways.fr>  Mon, 15 Mar 2010 14:04:42 +0200

virtuoso-opensource (6.1.0+dfsg2-1) unstable; urgency=low

  * Initial release (Closes: #508048)
  * Many thanks to the following people who helped bring this package into
    existence: Sune Vuorela <debian@pusling.com>, Will Daniels
    <mail@willdaniels.co.uk> and Miriam Ruiz <little_miry@yahoo.es>.

 -- Obey Arthur Liu <arthur@milliways.fr>  Mon, 22 Feb 2010 22:42:42 +0100

virtuoso-opensource (6.1.0-0ubuntu4) maverick; urgency=low

  * Add a dependency on odbcinst to libvirtodbc0. It needs to use it for its
    postinst script. (LP: #529562)

 -- Jonathan Thomas <echidnaman@kubuntu.org>  Sun, 09 May 2010 08:40:18 -0400

virtuoso-opensource (6.1.1+dfsg1-1) unstable; urgency=medium

  * New upstream release.
  * Correctly fix FTBFS on s390 related to SHM (closes: #574018).
  * Fix FTBFS on alpha due to recent binutils change (closes: 575942).
  * Fix missing-debian-source-format lintian warning.

  [Christian Perrier]
  * Debconf templates and debian/control reviewed by the debian-l10n-
    english team as part of the Smith review project. Closes: #573404
  * [Debconf translation updates]
    - Czech (Michal Simunek).  Closes: #573772
    - Russian (Yuri Kozlov).  Closes: #573861
    - Portuguese (Américo Monteiro).  Closes: #573927
    - Vietnamese (Clytie Siddall).  Closes: #574430
    - French (David Prévot).  Closes: #575042
    - Italian (Vincenzo Campanella).  Closes: #575099
    - German (Martin Eberhard Schauer).  Closes: #575594
    - Swedish (Martin Ågren).  Closes: #575635
    - Spanish (Francisco Javier Cuadrado).  Closes: #575373

 -- Obey Arthur Liu <arthur@milliways.fr>  Sun, 04 Apr 2010 13:21:42 +0200

virtuoso-opensource (6.1.0+dfsg2-3) unstable; urgency=high

  * Emergency rollback of the fix for FTBFS on armel from 6.1.0+dfsg2-2
    causing database binary format incompatibility, closes: #575173.
    There should be no data loss.

 -- Obey Arthur Liu <arthur@milliways.fr>  Wed, 24 Mar 2010 02:03:42 +0100

virtuoso-opensource (6.1.0+dfsg2-2) unstable; urgency=medium

  * Set ODBC registration debconf question for libvirtodbc0 to low priority,
    defaults to Yes.
  * Fix FTBFS on kFreeBSD.
  * Fix FTBFS on armel. Thanks to Sune Vuorela <debian@pusling.com>.
  * Fix FTBFS on s390 by complying with Debian CLI policy, closes: #574018.
  * Fix lintian errors referring to old-fsf-address.
  * Added README.source pointing to quilt README.

 -- Obey Arthur Liu <arthur@milliways.fr>  Mon, 15 Mar 2010 14:04:42 +0200

virtuoso-opensource (6.1.0+dfsg2-1) unstable; urgency=low

  * Initial release (Closes: #508048)
  * Many thanks to the following people who helped bring this package into
    existence: Sune Vuorela <debian@pusling.com>, Will Daniels
    <mail@willdaniels.co.uk> and Miriam Ruiz <little_miry@yahoo.es>.

 -- Obey Arthur Liu <arthur@milliways.fr>  Mon, 22 Feb 2010 22:42:42 +0100

virtuoso-opensource (6.1.0-0ubuntu3) lucid; urgency=low

  * Remove debian/init.d file which errornously added an init script to
    virtuoso-nepomuk

 -- Jonathan Riddell <jriddell@ubuntu.com>  Fri, 19 Feb 2010 07:47:34 +0000

virtuoso-opensource (6.1.0-0ubuntu2) lucid; urgency=low

  * Change pre-depends into depends in virtuoso-opensource-6.0

 -- Jonathan Riddell <jriddell@ubuntu.com>  Thu, 11 Feb 2010 23:08:30 +0000

virtuoso-opensource (6.1.0-0ubuntu1) lucid; urgency=low

  * New upstream release
  * Sync with Debian packaging from Git
   - Add no_do_os_calls.diff patch, don't allow do_os_calls
   - Install to /usr/lib/virtuoso instead of /usr/bin, not a user
     binary
   - virtuoso-t installed to /usr/lib/virtuoso/
  * Update build-gmake-to-make.patch
  * Add package virtuoso-nepomuk to install only the files needed by nepomuk
  * Remove virtuoso-nepomuk files from virtuoso-opensource-6.0-bin and libvirtodbc0
  * Add virtuoso-opensource-6.0-bin.links to link to virtuoso-t from /usr/bin
  * libvirtodbc0 and virtuoso-opensource-6.0-bin depends on virtuoso-nepomuk
  * Remove build-dep on libwbxml2-dev

 -- Jonathan Riddell <jriddell@ubuntu.com>  Fri, 05 Feb 2010 01:22:09 +0000

virtuoso-opensource (5.0.12-0ubuntu3) lucid; urgency=low

  * Install to /usr/lib/virtuoso instead of /usr/bin, not a user
    binary
  * Build with --without-internal-zlib and add debian/patches/external_zlib.diff
  * Add no_do_os_calls.diff patch, don't allow do_os_calls

 -- Jonathan Riddell <jriddell@ubuntu.com>  Thu, 28 Jan 2010 20:35:28 +0000

virtuoso-opensource (5.0.12-0ubuntu2) lucid; urgency=low

  * Update build-sanely.diff to only build the required virtodbc_r
    driver and not the other drivers

 -- Jonathan Riddell <jriddell@ubuntu.com>  Mon, 18 Jan 2010 13:48:50 +0000

virtuoso-opensource (5.0.12-0ubuntu1) lucid; urgency=low

  * Initial release
  * Remove .jar and .dll files from .orig

 -- Jonathan Riddell <jriddell@ubuntu.com>  Mon, 04 Jan 2010 16:06:55 +0000

