libgd2 (2.2.5-5.2ubuntu2.4) focal-security; urgency=medium

  * SECURITY UPDATE: gdGetBuf and gdPutBuf are missing bounds checks,
    allowing for out-of-bounds reads.
    - debian/patches/CVE-2021-40812.patch: Add bounds checking after gdPutBuf
      calls.
    - CVE-2021-40812 

 -- Nicolas Campuzano Jimenez <nicolas.campuzano@canonical.com>  Wed, 13 Nov 2024 18:40:43 -0500

libgd2 (2.2.5-5.2ubuntu2.1) focal-security; urgency=medium

  * SECURITY UPDATE: Heap-based buffer over-read
    - debian/patches/CVE-2017-6363-*.patch: make sure transparent
      palette index is within bounds in src/gd_gd.c and add tests in
      tests/gd/bug00383.c, tests/gd/CMakeLists.txt, tests/gd/Makemodule.am,
      tests/gd2/bug00383.c, tests/gd2/CMakeLists.txt, test/gd2/Makemodule.am.
    - CVE-2017-6363
  * SECURITY UPDATE: Out-of-bounds read
    - debian/patches/CVE-2021-38115.patch: fix a read out-of-bounds in
      reading tga header file in src/gd_tga.c.
    - CVE-2021-38115
  * SECURITY UPDATE: Double free
    - debian/patches/CVE-2021-40145.patch: fix a memory leak in
      src/gd_gd2.c.
    - CVE-2021-40145

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 30 Aug 2021 15:10:22 -0300

libgd2 (2.2.5-5.2ubuntu2) focal; urgency=medium

  * No change rebuild.

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Thu, 16 Apr 2020 15:43:03 +0000

libgd2 (2.2.5-5.2ubuntu1) focal; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference in gdImageClone allows attackers
    to crash an application via a specific function call sequence
    - debian/patches/CVE-2018-14553.patch: remove manual style copy from
      src/gd.c and appropriately set stylePos in tests/gdimageclone/style.c.
    - CVE-2018-14553 

 -- Avital Ostromich <avital.ostromich@canonical.com>  Thu, 05 Mar 2020 14:12:25 -0500

libgd2 (2.2.5-5.2) unstable; urgency=high

  * Non-maintainer upload.
  * Fix CVE-2019-11038: Uninitialized read in gdImageCreateFromXbm
    (Closes: #929821)

 -- Jonas Meurer <jonas@freesources.org>  Tue, 11 Jun 2019 16:21:57 +0200

libgd2 (2.2.5-5.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Heap-based buffer overflow in gdImageColorMatch (CVE-2019-6977)
    (Closes: #920645)
  * Potential double-free in gdImage*Ptr() (CVE-2019-6978) (Closes: #920728)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 02 Feb 2019 10:55:00 +0100

libgd2 (2.2.5-5) unstable; urgency=medium

  * Update Vcs-* links to salsa.d.o
  * Update maintainers address to team+gd@tracker.d.o (Closes: #899928)
  * Remove Files-Excluded from d/copyright, the files just inherit the
    global license (Closes: #883760)

 -- Ondřej Surý <ondrej@debian.org>  Sun, 28 Oct 2018 22:20:23 +0000

libgd2 (2.2.5-4.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Potential infinite loop in gdImageCreateFromGifCtx (CVE-2018-5711)
    (Closes: #887485)
  * bmp: check return value in gdImageBmpPtr (CVE-2018-1000222)
    (Closes: #906886)
  * Remove src/Makefile.am patching in
    tests-make-a-little-change-for-autopkgtest.patch.  Fixes "libgd2 FTBFS:
    cannot find -lgd".
    Thanks to Helmut Grohne and Adrian Bunk (Closes: #906840)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 06 Oct 2018 00:22:59 +0200

libgd2 (2.2.5-4) unstable; urgency=medium

  [ Jiří Paleček ]
  * Disable the test during build and run the testsuite through autopkgtest
    (Closes: #867003)
  * Make --as-needed work again

  [ Ondřej Surý ]
  * Get rid of libgd2*-dev traces (Closes: #879254)

 -- Ondřej Surý <ondrej@debian.org>  Sun, 22 Oct 2017 11:14:32 +0200

libgd2 (2.2.5-3) unstable; urgency=medium

  * Disable gdimagerotate/bug00067 because it FTBFS on i386

 -- Ondřej Surý <ondrej@debian.org>  Tue, 05 Sep 2017 13:46:57 +0200

# For older changelog entries, run 'apt-get changelog libgd3'
