~ubuntu-branches/debian/stretch/freetype/stretch : changes

~ubuntu-branches/debian/stretch/freetype/stretch » Changes from revision 51

From Revision 49 to 30

Rev	Summary	Authors	Tags	Date
49	* Fix Savannah bug #43774. Closes #780143. * Fix Savannah bug #43774. Closes #780143. * Release 2.5.2-4	Keith Packard	2.5.2-4	9 years ago
48	* Fix Savannah bug #43535. CVE-2014-9675 * Fix Savannah bug #43535. CVE-2014-9675 * [bdf] Fix Savannah bug #41692. CVE-2014-9675-fixup-1 * src/base/ftobj.c (Mac_Read_POST_Resource): Additional overflow check in the summation of POST fragment lengths. CVE-2014-0674-part-2 * src/base/ftobjs.c (Mac_Read_POST_Resource): Insert comments and fold too long tracing messages. CVS-2014-9674-fixup-2 * src/base/ftobjs.c (Mac_Read_POST_Resource): Use unsigned long variables to read the lengths in POST fragments. CVE-2014-9674-fixup-1 * Fix Savannah bug #43538. CVE-2014-9674-part-1 * Fix Savannah bug #43539. CVE-2014-9673 * src/base/ftobjs.c (Mac_Read_POST_Resource): Avoid memory leak by a broken POST table in resource-fork. CVE-2014-9673-fixup * Fix Savannah bug #43540. CVE-2014-9672 * Fix Savannah bug #43547. CVE-2014-9671 * Fix Savannah bug #43548. CVE-2014-9670 * [sfnt] Fix Savannah bug #43588. CVE-2014-9669 * [sfnt] Fix Savannah bug #43589. CVE-2014-9668 * [sfnt] Fix Savannah bug #43590. CVE-2014-9667 * [sfnt] Fix Savannah bug #43591. CVE-2014-9666 * Change some fields in `FT_Bitmap' to unsigned type. CVE-2014-9665 * Fix uninitialized variable warning. CVE-2014-9665-fixup-2 * Make `FT_Bitmap_Convert' correctly handle negative `pitch' values. CVE-2014-9665-fixup * [type1, type42] Fix Savannah bug #43655. CVE-2014-9664 * [sfnt] Fix Savannah bug #43656. CVE-2014-9663 * [cff] Fix Savannah bug #43658. CVE-2014-9662 * [type42] Allow only embedded TrueType fonts. CVE-2014-9661 * [bdf] Fix Savannah bug #43660. CVE-2014-9660 * [cff] Fix Savannah bug #43661. CVE-2014-9659 * [sfnt] Fix Savannah bug #43672. CVE-2014-9658 * [truetype] Fix Savannah bug #43679. CVE-2014-9657 * [sfnt] Fix Savannah bug #43680. CVE-2014-9656 * All CVEs patched. Closes: #777656.	Keith Packard	2.5.2-3	9 years ago
47	* Acknowledge security NMU; thanks to Michael Gilbert. * Acknowledge security NMU; thanks to Michael Gilbert. * Standards-Version 3.9.6. * Bump debhelper build-dependency to 9. * debian/patches/enable-old-cff.patch: disable the new CFF hinter from Adobe, working around wrong hinting with some toolkits on Linux. Thanks to Samat K Jain <samat@samat.org> for preparing the patch. Closes: #730742. * debian/patches-freetype/0001-Fix-Savannah-bug-40997.patch: Cherry-pick upstream patch to fix a double free. Closes: #747002, LP: #1310728. * debian/patches-freetype/0002-Fix-Savannah-bug-42418.patch: Cherry-pick upstream patch to fix cjk font rendering issue. LP: #1310017. * debian/patches-freetype/verbose-libtool.patch: don't let libtool suppress compiler output. * debian/patches-freetype/no-uninitialized-bbox.patch: ensure that our variable is reliably initialized before use, fixing a build failure on ppc64el when building with -O3.	Steve Langasek	2.5.2-2	9 years ago
46	* Non-maintainer upload by the Security Team. * Non-maintainer upload by the Security Team. * Fix two security issues in the CFF rasterizer (closes: #741299) - CVE-2014-2240: out-of-bounds read/write in cf2hints.c. - CVE-2014-2241: denial-of-service in cf2ft.c.	Michael Gilbert	2.5.2-1.1	9 years ago
45	* New upstream release * New upstream release - fixes a crasher bug with certain fonts. Closes: #733052. - drop of additional symbols which were previously exported but are only meant for debugging and upstream recommends not enabling them when building in "release mode". If this impacts users of freetype, we can re-enable these symbols later. * Call autogen.sh on build to refresh autotools; not using dh-autoreconf because the upstream directory structure is non-standard and it's a throw-away dir, so there's no advantage to dh-autoreconf's rollback support. * Fix symbols file with respect to more complete version info found in Ubuntu. * Drop debian/patches-ft2demos/compiler-warning-fixes.patch, which is actually a bug in the compiler_hardening_fixes.patch; fix it there instead. * Fix libpng detection when cross-building.	Steve Langasek	2.5.2-1	10 years ago
44	* Drop unnecessary GPLv2.txt from libfreetype6-dev. * Drop unnecessary GPLv2.txt from libfreetype6-dev. * Add missing dependency on libpng-dev to libfreetype6-dev. Closes: #732062.	Steve Langasek	2.5.1-2	10 years ago
43	* New upstream release. Closes: #717952, #729231. * New upstream release. Closes: #717952, #729231. - Add build-dependency on libpng-dev. - Dropped patches, included upstream: savannah-bug-35847.patch, savannah-bug-35833.patch, savannah-bug-37905.patch, savannah-bug-37906.patch, savannah-bug-37907.patch - Internal symbols have been dropped in this version. No soname change because the symbols are not supposed to be used, but past experience suggests that this may break some third-party software anyway. * compiler_hardening_fixes.patch: fix wrong snprintf() calls in ttdebug.c that cause an overflow 100% of the time. * debian/patches-ft2demos/compiler-warning-fixes.patch: Fix a wrong cast that triggers a compiler warning. * debian/patches-ft2demos/revert-wrong-extern.patch: revert wrong upstream commit that causes a build failure.	Steve Langasek	2.5.1-1	10 years ago
42	* Non-maintainer upload. * Non-maintainer upload. Upload ACKed by Steve Langasek <vorlon@debian.org> on #debian-devel. * Add savannah-bug-37905.patch patch [SECURITY] CVE-2012-5668: NULL Pointer Dereference in bdf_free_font. (Closes: #696691) * Add savannah-bug-37906.patch patch [SECURITY] CVE-2012-5669: Out-of-bounds read in _bdf_parse_glyphs. (Closes: #696691) * Add savannah-bug-37907.patch patch [SECURITY] CVE-2012-5670: Out-of-bounds write in _bdf_parse_glyphs. (Closes: #696691)	Salvatore Bonaccorso	2.4.9-1.1	11 years ago
41	* New upstream release * New upstream release - upstream fix for multiple vulnerabilities: CVE-2012-1126, CVE-2012-1133, CVE-2012-1134, CVE-2012-1136, CVE-2012-1142, CVE-2012-1144. and others. Closes: #662864. - update symbols file for a new symbol, ft_raccess_guess_table * debian/patches-freetype/savannah-bug-35847.patch, debian/patches-freetype/savannah-bug-35833.patch: pull two bugfixes from upstream git on top of 2.4.9, to address regressions affecting ghostscript. Thanks to Till Kamppeter for pointing this out. * push CPPFLAGS into CFLAGS for ft2demos, so our demos will be secure. Closes: #663613. * don't let a quiltrc override our QUILT_PATCHES settings in debian/rules. Closes: #617217. * Migrate debian/copyright to copyright-format 1.0, and fix up the upstream URL. Closes: #642059.	Steve Langasek	2.4.9-1	12 years ago
40	* New upstream release * New upstream release - upstream fix for CVE-2011-3439. Closes: #649122. - adjust libfreetype6.symbols for a newly-exported function.	Steve Langasek	2.4.8-1	12 years ago
39	* Use dpkg-buildflags through debhelper. * Use dpkg-buildflags through debhelper. * Don't set -Werror in CFLAGS on alpha or m68k, to work around a compiler bug. Closes: #646334.	Steve Langasek	2.4.7-2	12 years ago
38	* New upstream release * New upstream release - upstream fix for CVE-2011-3256. Closes: #646120. - drop debian/patches-freetype/0001-Fix-Savannah-bug-33992.patch, included upstream. * Pass --without-bzip2 to configure, to avoid unwanted dependency on libbz2. Closes: #639638. * Standards-Version 3.9.2.	Steve Langasek	2.4.7-1	12 years ago
37	debian/patches-freetype/0001-Fix-Savannah-bug-33992.patch: [... debian/patches-freetype/0001-Fix-Savannah-bug-33992.patch: [PATCH] Fix Savannah bug #33992. Thanks to David Bevan <david.bevan@pb.com>. Closes: #638348.	Steve Langasek	2.4.6-2	12 years ago
36	* New upstream release * New upstream release - fixes CVE-2011-0226, a vulnerability in parsing of Type 1 fonts. Closes: #635871. - upstream now builds cleanly with -Werror and the new gcc-4.6 upstream warnings. Closes: #625328.	Steve Langasek	2.4.6-1	12 years ago
35	* Build for multiarch, using debhelper compat 9. * Build for multiarch, using debhelper compat 9. * Add Pre-Depends: ${misc:Pre-Depends} to pick up multiarch-support dependency.	Steve Langasek	2.4.4-2	12 years ago
34	* Acknowledge security NMU - thanks, Moritz! * Acknowledge security NMU - thanks, Moritz! * New upstream release, closes: #606286, #600321 - fixes PDF rendering issues. Closes: #612484, LP: #709229. - fixes a rendering issue with 'S' glyphs in certain fonts. LP: #654010. - drop patches for CVE-2010-3855 and CVE-2010-3814, applied upstream. - drop patch ft2demos-2.1.7-ftbench.patch; doesn't apply cleanly, the code has changed significantly, patch never forwarded upstream. If this is still an issue, someone will provide a fixed patch. - drop patch ft2demos-grkey.patch, fixed upstream. * debian/patches-freetype/enable-gxvalid-otvalid.patch: enable the otvalid and gxvalid table validation modules. Thanks to Paul Wise <pabs@debian.org>. Closes: #520879, LP: #239626. * debian/libfreetype6.symbols: update the symbols file for the same. * debian/rules et al.: convert to dh 7 * drop INSTALL.* from the libfreetype6-dev docs. Closes: #550971. * move homepage out of debian/copyright and into debian/control. * fix GPL link to point to GPL-2 explicitly. * clean up long-obsolete conflicts/replaces. * drop debian/README.quilt, redundant with debian/README.source. * drop debian/README.Debian, which talks about the long-finished transition from freetype1. * strip dependency_libs out of /usr/lib/libfreetype.la. * bump standards-version to 3.9.1.	Steve Langasek	2.4.4-1	13 years ago
33	* Non-maintainer upload by the Security Team. * Non-maintainer upload by the Security Team. * Fix CVE-2010-3855 and CVE-2010-3814 (Closes: #602221)	Moritz Muehlenhoff		13 years ago
32	* SECURITY UPDATE: denial of service and possible code execu... * SECURITY UPDATE: denial of service and possible code execution via improper error handling of SHZ bytecode instruction - debian/patches/CVE-2010-3814.patch: add bounds check to src/truetype/ttinterp.c. - CVE-2010-3814 * SECURITY UPDATE: denial of service and possible code execution via TrueType GX font - debian/patches/CVE-2010-3855.patch: add bounds checks to src/truetype/ttgxvar.c. - CVE-2010-3855	Marc Deslauriers	2.4.2-2ubuntu0.1	13 years ago
31	debian/patches-ft2demos/f2tdemos-grkey.patch: update to fix ... debian/patches-ft2demos/f2tdemos-grkey.patch: update to fix another problem when building under gcc-4.5 that was overlooked in the previous version of the patch. LP: #624740.	Steve Langasek		13 years ago
30	* New upstream release * New upstream release - High urgency upload for RC security bugfix. - Corrects a stack overflow in the interpreter for CFF fonts (CVE-2010-1797). Closes: #592399. - drop debian/patches-freetype/opentype-missing-glyphs, included upstream. * Update libfreetype6.symbols for two new functions.	Steve Langasek		13 years ago

Older »