lcms2 (2.9-4ubuntu0.1~esm1) focal-security; urgency=medium

  * SECURITY UPDATE: integer overflow in CubeSize
    - debian/patches/CVE-2026-41254-pre1.patch: fix a bounds check in
      src/cmslut.c.
    - debian/patches/CVE-2026-41254-pre2.patch: prevent allocating a big
      chunk of memory on corrupted LUT in src/cmslut.c.
    - debian/patches/CVE-2026-41254-1.patch: fix integer overflow in
      CubeSize() in src/cmslut.c.
    - debian/patches/CVE-2026-41254-2.patch: check for overflow in
      src/cmslut.c.
    - CVE-2026-41254

 -- Federico Quattrin <federico.quattrin@canonical.com>  Wed, 27 May 2026 14:19:11 -0300

lcms2 (2.9-4) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/changelog: Remove trailing whitespaces
  * d/watch: Use https protocol

  [ Thomas Weber ]
  * Bump standards version to 4.4.0, no changes needed
  * dh_strip_nondeterminism should not normalize src.zip (Closes: #935177)

 -- Thomas Weber <tweber@debian.org>  Mon, 09 Sep 2019 22:40:46 +0200

lcms2 (2.9-3) unstable; urgency=medium

  * Fix integer overflow in AllocateDataSet() (CVE-2018-16435)
    Thanks to Salvatore Bonaccorso <carnil@debian.org> and
    Marti Maria <marti.maria@littlecms.com>
    (Closes: #907983)

 -- Thomas Weber <tweber@debian.org>  Wed, 05 Sep 2018 17:59:06 +0200

lcms2 (2.9-2) unstable; urgency=medium

  * Switch Vcs links to salsa.debian.org
  * Add Build-Depends-Package header to symbols file (see #900819)
    Thanks to Andreas Henriksson <andreas@fatal.se>
  * Bump standards version to 4.1.4, no changes needed

 -- Thomas Weber <tweber@debian.org>  Sat, 09 Jun 2018 22:33:22 +0200

lcms2 (2.9-1) unstable; urgency=medium

  * New upstream version 2.9:
    - Drop patch fix-CVE-2016-10165 (applied upstream)
    - Drop patch lcms2-fix-strFrom16-byte-order.patch (applied upstream)
    - Update patch dont-write-uninitialized-memory-for-color-strings.patch
    - Update patch prepare-for-libtoolizing.patch
    - Update symbols file for 2.9 version.
      The 2.9 release no longer exports private symbols.
    - Update doc-base files for new 2.9 upstream version
  * Remove build-depends on dh-autoreconf.
    We depend on debhelper >= 10, so this is automatically enabled
    Thanks to lintian
  * Bump standards version from 3.9.8 to 4.1.2:
    - Use httpS in the "Format" field of debian/copyright. (policy 4.0.0)

 -- Thomas Weber <tweber@debian.org>  Sun, 17 Dec 2017 15:52:01 +0100

lcms2 (2.8-4) unstable; urgency=medium

  * New patch: debian/patches/fix-CVE-2016-10165.patch.
    Fix for CVE-2016-10165. (Closes: #852627)
    Thanks to Salvatore Bonaccorso <carnil@debian.org>

 -- Thomas Weber <tweber@debian.org>  Thu, 26 Jan 2017 11:04:13 +0100

lcms2 (2.8-3) unstable; urgency=medium

  * New patch: lcms2-fix-strFrom16-byte-order.patch.
    Thanks to HW42 <hw42@ipsumj.de> (Closes: #847595)

 -- Thomas Weber <tweber@debian.org>  Sun, 18 Dec 2016 23:24:18 +0100

lcms2 (2.8-2) unstable; urgency=medium

  * Provide liblcms-dev (Closes: 830752)

 -- Thomas Weber <tweber@debian.org>  Wed, 07 Dec 2016 22:41:38 +0100

lcms2 (2.8-1) experimental; urgency=medium

  * Imported Upstream version 2.8 (Closes: 839160)
  * Drop patch fix-cmsnamed-alignment-issue.patch (applied upstream)
  * Drop patch fix-unaligned-access.patch
  * Ensure correct alignment for doubles on SPARC, mips, mipsel via CPP
    variable
  * Bump debhelper compat level to 10
  * Bump standards version to 3.9.8

 -- Thomas Weber <tweber@debian.org>  Sat, 29 Oct 2016 20:46:09 +0200

lcms2 (2.7-1) unstable; urgency=medium

  * Imported Upstream version 2.7 (Closes: 819718)
  * No longer ship own copy of documentation source files
  * Removed patches (applied upstream)
    + update-manpages.patch
    + sanity-check-profiles-CVE-2014-0459.patch
    + endianness-verification-fix-powerpc.patch
  * Move to automatic dbgsym packages
  * Use secure URLs for Version Control System repository
  * Bump Standards version to 3.9.7, no changes needed
  * New patch: dont-write-uninitialized-memory-for-color-strings.patch
    Thanks to Jérémy Bobbio <lunar@debian.org> (Closes: 815248)
  * Update maintainers field (Closes: 820138)

 -- Thomas Weber <tweber@debian.org>  Mon, 18 Apr 2016 15:53:10 +0200

lcms2 (2.6-3) unstable; urgency=medium

  * New patch: endianness-verification-fix-powerpc.patch.
    Thanks to "Fernando Seiti Furusato" <ferseiti@br.ibm.com>
    (Closes: #750686)

 -- Thomas Weber <tweber@debian.org>  Mon, 16 Jun 2014 17:14:13 +0200

lcms2 (2.6-2) unstable; urgency=medium

  * New patch: fix-unaligned-access.patch: Align access to double values.
    Thanks to Aurelien Jarno <aurel32@debian.org> (Closes: #749975)

 -- Thomas Weber <tweber@debian.org>  Thu, 05 Jun 2014 14:51:56 +0000

lcms2 (2.6-1) unstable; urgency=medium

  * Imported Upstream version 2.6
    + Drop patch fix-memory-write-bug.patch (applied upstream)
    + Update symbols file for 2.6 release
  * Include up-to-date source files for documentation
  * Remove quilt from Build-Depends:
    Thanks to Mathieu Malaterre (Closes: #741435)
  * Update package description
  * Update manpages (Closes: #742587)
  * Update libtool by using dh-autoreconf.
    Thanks to "Breno Leitao" <brenohl@br.ibm.com> (Closes: 745748)
  * new patch: prepare-for-libtoolizing.patch, needed for libtool update
  * Sanity check profile versions (CVE-2014-0459) (Closes: #745471)

 -- Thomas Weber <tweber@debian.org>  Fri, 25 Apr 2014 14:53:42 +0200

lcms2 (2.5-1) unstable; urgency=low

  * Imported Upstream version 2.5 (Closes: #701993, #701971)
  * Dropped patches (applied upstream):
    - sparc64-ftbfs
    - ojdk-8007925+8007926.patch
    - ojdk-8009654.patch
    - ojdk-8007929.patch
    - ojdk-8007927.patch
  * Refresh patch fix-cmsnamed-alignment-issue.patch
  * Bump debhelper level to 9
  * Bump Standards version to 3.9.5, no changes needed
  * Update Debian copyright
  * Always update config.sub and config.guess.
    Thanks to Wookey (Closes: #717839)
  * Add debug package
  * Add symbols file from Ubuntu
  * Update and activate VCS fields in debian/control (Closes: #639607)
  * Add Thomas Weber as uploader/co-maintainer
  * New patch: fix-memory-write-bug.patch (LP: 1261840)

 -- Thomas Weber <tweber@debian.org>  Sun, 09 Feb 2014 02:21:26 +0100

lcms2 (2.2+git20110628-2.3) unstable; urgency=low

  * Non-maintainer upload.
  * debian/patches/sparc64-ftbfs: align blocks according to host
    requirements.  Thanks to Aurelien Jarno <aurel32@debian.org>.
    Closes: #647220.
  * debian/patches/fix-cmsnamed-alignment-issue.patch: fix alignment
    issues when casting chars to shorts.  Thanks to Michael Cree
    <mcree@orcon.net.nz>.  Closes: #644473.
  * Apply security fixes from IcedTea (Closes: #714529, CVE-2013-4160):
    - debian/patches/ojdk-8007925+8007926.patch: Improve
      cmsStageAllocLabV2ToV4curves. Improve cmsPipelineDup.
    - debian/patches/ojdk-8007927.patch: Improve
      cmsAllocProfileSequenceDescription.
    - debian/patches/ojdk-8007929.patch: Improve CurvesAlloc.
    - debian/patches/ojdk-8009654.patch: Improve stability of cmsnamed.
  * Build-depend on libtiff-dev instead of libtiff4-dev, to facilitate future
    library transitions.  Thanks to Michael Terry <michael.terry@canonical.com>
    for the patch.  Closes: #681904.
  * Fix a typo in the liblcms2-utils package description.  Thanks to
    Paolo Scarabelli <paolo@msw.it>.  Closes: #640084.

 -- Steve Langasek <vorlon@debian.org>  Sun, 06 Oct 2013 12:38:01 -0700

lcms2 (2.2+git20110628-2.2) unstable; urgency=low

  * Non-maintainer upload.
  * Enable multi-arch (closes: #667556).

 -- Michael Gilbert <mgilbert@debian.org>  Tue, 22 May 2012 23:57:24 -0400

lcms2 (2.2+git20110628-2.1) unstable; urgency=low

  * Non-maintainer upload.
  * Fix "FTBFS: dpkg-buildpackage: error: dpkg-source -b lcms2-
    2.2+git20110628 gave error exit status 2":
    - drop auto-generated patches
    - use make distclean in debian/rules' clean target
    (Closes: #643177)
  * Don't install the .la file anymore (release goal).

 -- gregor herrmann <gregoa@debian.org>  Tue, 06 Mar 2012 18:46:04 +0100

lcms2 (2.2+git20110628-2) unstable; urgency=low

  * debian/control:
    - Updated libjpeg dependency for the transition.
    - Updated package descriptions for better search results.

 -- Oleksandr Moskalenko <malex@debian.org>  Mon, 18 Jul 2011 23:39:39 -0500

lcms2 (2.2+git20110628-1) unstable; urgency=low

  * Upstream git update (Closes: #631598).

 -- Oleksandr Moskalenko <malex@debian.org>  Wed, 29 Jun 2011 01:20:02 -0500

lcms2 (2.2+git20110627-1) unstable; urgency=low

  * Upstream git update to fix a FTBFS on i386.

 -- Oleksandr Moskalenko <malex@debian.org>  Mon, 27 Jun 2011 23:22:54 -0500

lcms2 (2.2-1) unstable; urgency=low

  * New upstream release.
  * debian/control: Updated standards version to 3.9.2.

 -- Oleksandr Moskalenko <malex@debian.org>  Sun, 12 Jun 2011 00:36:06 -0500

lcms2 (2.1-1) unstable; urgency=low

  * Initial release (Closes: #590222).

 -- Oleksandr Moskalenko <malex@debian.org>  Sun, 23 Jan 2011 15:26:53 -0600
