~ubuntu-branches/ubuntu/saucy/libav/saucy-security

libav (6:0.8.12-0ubuntu0.13.10.1) saucy-security; urgency=medium

  * SECURITY UPDATE: Update to 0.8.12 to fix multiple security issues

    - CVE-2014-3984

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 10 Jun 2014 09:34:09 -0400

libav (6:0.8.10-0ubuntu0.13.10.1) saucy-security; urgency=medium

  * Update to 0.8.10 to fix multiple security issues (LP: #1277173)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 06 Feb 2014 12:06:04 -0500

libav (6:0.8.9-0ubuntu0.13.10.1) saucy-security; urgency=low

  * Update to 0.8.9 to fix multiple security issues (LP: #1249621)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 09 Nov 2013 10:46:15 -0500

libav (6:0.8.8-0ubuntu0.13.10.1) saucy-security; urgency=low

  * Update to 0.8.8 to fix multiple security issues (LP: #1242802)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 21 Oct 2013 13:37:07 -0400

libav (6:0.8.7-1ubuntu2) saucy; urgency=low

  * debian/patches/{05-aarch64-support.patch,06-aarch64-pie.patch}:

    - Backport basic aarch64 support from git.

 -- William Grant <wgrant@ubuntu.com>  Fri, 11 Oct 2013 16:59:06 +1100

libav (6:0.8.7-1ubuntu1) saucy; urgency=low

  * Merge from debian/unstable, remaining changes:

    - don't build against libdirac, lame, libopenjpeg, librtmp, frei0r,

      vo-aacenc, vo-amrenc, x264, and xvid  (all in universe)

    - do not build libav-extra-dbg, it is build from the libav-extra source

      package in ubuntu.

    - drop libav-regular-dbg, not necessary in ubuntu

    - Adjust LIB_PKGS/LIB_PKGS2 lists in debian/rules

    - several ifdefs in debian/rules that allow the use of the same file

      in libav and libav-extra (most of this can be merged into the debian

      package)

 -- Jackson Doak <noskcaj@ubuntu.com>  Thu, 11 Jul 2013 09:21:04 +1000

libav (6:0.8.7-1) unstable; urgency=medium

  * Imported Upstream version 0.8.7, new releases fixes:

    - wav: Always seek to an even offset, Bug #500, LP: #1174737

    - A number of further security relevant patches.

 -- Reinhard Tartler <siretart@tauware.de>  Mon, 20 May 2013 11:04:00 +0200

libav (6:0.8.6-1ubuntu2) raring; urgency=low

  * Put back the dh_strip invocations. Otherwise, no .ddebs will be

    available at all.

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 30 Mar 2013 22:41:36 +0100

libav (6:0.8.6-1ubuntu1) raring; urgency=low

  * Merge from debian/unstable, LP: #1160734, remaining changes:

    - don't build against libdirac, lame, libopenjpeg, librtmp, frei0r,

      vo-aacenc, vo-amrenc, x264, and xvid  (all in universe)

    - do not build libav-extra-dbg, it is build from the libav-extra source

      package in ubuntu.

    - drop libav-regular-dbg, not necessary in ubuntu

    - Adjust LIB_PKGS/LIB_PKGS2 lists in debian/rules

    - several ifdefs in debian/rules that allow the use of the same file

      in libav and libav-extra (most of this can be merged into the debian

      package)

  * Tested that co-instability of libavcodec-dev with libavcodec-extra-53 works.

    LP: #1143929, #1101829

  * Remove all debug packages. In ubuntu, we provide debug symbols via the

    .ddeb infrastructure.

 -- Reinhard Tartler <siretart@tauware.de>  Wed, 27 Mar 2013 07:57:15 +0100

libav (6:0.8.6-1) unstable; urgency=low

  * Imported Upstream version 0.8.6, new releases fixes:

    - h264: check for luma and chroma bit depth being equal (CVE-2013-2277)

    - iff: validate CMAP palette size (CVE-2013-2495)

    - msrledec: convert to bytestream2 API and add proper bounds checking (CVE-2013-2496)

    - vorbisdec: Error on bark_map_size equal to 0 (CVE-2013-0894)

    - Thus, closes: #703200

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 24 Mar 2013 07:35:51 +0100

libav (6:0.8.5-1) unstable; urgency=low

  * New upstream security/bugfix release. New releases fixes

    (bug numbers reference http://bugzilla.libav.org, Closes: #694483)

    - Indeo 4 (CVE-2012-2791)

    - VP5/VP6 (CVE-2012-2783)

    - Indeo 3 (CVE-2012-2804)

    - MPEG-1/2 (CVE-2012-2803)

    - MP3 (CVE-2012-2797)

    - AAC (CVE-2012-5144)

    - AC-3 (CVE-2012-2802)

    - AVS (CVE-2012-2801)

    - DFA (CVE-2012-2798)

    - ID3v2 (Bug 395)

    - Serious Memory leaks on broken Ogg files

  * drop recordshow script. This clearly undermaintained script has

    unclear copyright status and is unlikely to work properly anyway.

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 13 Jan 2013 11:56:59 +0100

libav (6:0.8.5-0ubuntu1) raring; urgency=low

  * Update to 0.8.5 to fix multiple security issues. (LP: #1104019)

    - CVE-2012-2783

    - CVE-2012-2791

    - CVE-2012-2797

    - CVE-2012-2798

    - CVE-2012-2801

    - CVE-2012-2802

    - CVE-2012-2803

    - CVE-2012-2804

    - CVE-2012-5144

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 24 Jan 2013 08:05:12 -0500

libav (6:0.8.4-1) unstable; urgency=low

  * New upstream security/bugfix release. New release fixes:

    (bug numbers reference http://bugzilla.libav.org, Closes: #688847)

    - h264 (Bug 118), vc1dec (CVE-2012-2796), sipr, bmpdec (bug 367), alsdec

      (CVE-2012-2775), rv34/rv40 (CVE-2012-2772), indeo3/indeo4

      (CVE-2012-2776, CVE-2012-2779, CVE-2012-2787, CVE-2012-2794,

      CVE-2012-2800), vorbisenc, vorbisdec (Bug 277), snow, ac3dec

      (CVE-2012-2802), avsdec (CVE-2012-2801), dfa (CVE-2012-2786,

      CVE-2012-2798), lagrith (CVE-2012-2793), wmaprodec (CVE-2012-2789 &

      Bug 327), avidec (CVE-2012-2788, CVE-2012-2790), cavsdec

      (CVE-2012-2777, CVE-2012-2784), wav (Bug 379), yuff4mpeg (Bug 373),

      mpegaudio, tiffenc, smacker (Bug 265).

    - smaller bug fixes in avconv (Bug 352)

    - fix lt() and lte() in function evaluator

    - fix segfault in avformat_open_input()

    - fix segfault in golomb decoder (bug 310)

    - fix segfault (double free) in libavfilter

    - convert dfa decoder to bytestream2 API to protect from overreads

    - bugfix in vf_pad/scale filter (Bug 203 & 245)

    - lavc: remove stats_out and stats_in from the options table.

      (Bug 380, Closes: #690726)

  * Drop patches applied upstream.

 -- Reinhard Tartler <siretart@tauware.de>  Mon, 22 Oct 2012 20:57:08 +0200

libav (6:0.8.4-0ubuntu2) raring; urgency=low

  * Weaken dependencies on -dev packages. LP: #1038781

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 09 Dec 2012 19:09:54 +0100

libav (6:0.8.4-0ubuntu1) raring-proposed; urgency=low

  * No change rebuild for raring

 -- Jamie Strandboge <jamie@ubuntu.com>  Fri, 16 Nov 2012 12:39:50 -0600

libav (6:0.8.4-0ubuntu0.12.10.1) quantal-security; urgency=low

  * Update to 0.8.4 to fix multiple security issues. (LP: #1075593)

    - CVE-2012-2772

    - CVE-2012-2775

    - CVE-2012-2776

    - CVE-2012-2777

    - CVE-2012-2779

    - CVE-2012-2784

    - CVE-2012-2786

    - CVE-2012-2787

    - CVE-2012-2788

    - CVE-2012-2789

    - CVE-2012-2790

    - CVE-2012-2793

    - CVE-2012-2794

    - CVE-2012-2796

    - CVE-2012-2798

    - CVE-2012-2800

    - CVE-2012-2801

    - CVE-2012-2802

  * Removed upstreamed patches:

    - 0001-h264-allow-cropping-to-AVCodecContext.width-height.patch

    - 0002-mov-set-AVCodecContext.width-height-for-h264.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 06 Nov 2012 10:29:38 -0500

libav (6:0.8.3-7) unstable; urgency=low

  [ Fabian Greffrath ]

  * Fix generation of shlibs file not only for libavcodec*, but for all the

    other library packages as well. Really closes: #679542

  * Use xz compression for binary packages, thanks Ansgar Burchardt

    (Closes: #683895).

  [ Reinhard Tartler ]

  * use EPOCH macro in SHLIBS_VERSION

  * Drop the package 'libav-regular-dbg'. It was not included in squeeze.

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 25 Aug 2012 11:08:48 +0200

libav (6:0.8.3-6ubuntu2) quantal; urgency=low

  * Temporarily fudge the versioning of libavcodec-dev's dependency on

    libavcodec-extra-53 to cope with the botched merge of libav-extra.

 -- Colin Watson <cjwatson@ubuntu.com>  Mon, 01 Oct 2012 11:48:25 +0100

libav (6:0.8.3-6ubuntu1) quantal; urgency=low

  * Merge from debian, remaining changes:

    - don't build against libdirac, lame, libopenjpeg, librtmp, frei0r,

      vo-aacenc, vo-amrenc, x264, and xvid  (all in universe)

    - do not build libav-extra-dbg, it is build from the libav-extra source

      package in ubuntu.

    - drop libav-regular-dbg, not necessary in ubuntu

    - Adjust LIB_PKGS/LIB_PKGS2 lists in debian/rules

    - several ifdefs in debian/rules that allow the use of the same file

      in libav and libav-extra (most of this can be merged into the debian

      package)

    - several dependency fixups in debian/control

 -- Reinhard Tartler <siretart@tauware.de>  Tue, 07 Aug 2012 22:23:55 +0200

libav (6:0.8.3-6) unstable; urgency=low

  * Clarify the changes in the 6:0.8.3-5 upload, as discussed in bug

    #683247.

  * Make ffmpeg-dbg 'arch: all' for consistency with the libav-extra-dbg

    package.

  * Fix generation of shlibs file. (Closes: #679542)

    Wrong make variables where used for the shlibs generation.

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 04 Aug 2012 09:03:54 +0200

libav (6:0.8.3-5) unstable; urgency=low

  [ Reinhard Tartler ]

  * Bug fix: "Multi-Arch: foreign libraries", thanks to Stepan Golosunov.

    Make the transitional libavfoo-extra-NN packages 'arch: all' and

    remove the 'Multi-Arch: foreign' fields to avoid that the dependency

    can be satisfied by packages of other architectures, which would break

    applications. Closes: #680613

  * Make libav-extra-dbg 'arch: all'.  As empty, transitional package

    without strict dependencies, we can safely ship it as arch:all

    package.

  [ Fabian Greffrath ]

  * Mention qt-faststart in the long description (Closes: #681491).

  * Install all debug symbols into libav-dbg (Closes: #680602).

  * Do not run doxygen if it is not installed. This does not change anything

    for regular builds, but helps with bootstrapping the package to new

    architectures that may not have doxygen available yet.

  * Fix up debian/changelog and tighten dependencies.

  * Do not declare "ffmpeg" as virtual package (provided by libav-tools).

    Instead, we provide it as transitional package for libav-tools. Note

    the next upstream version will no longer provide neither an 'ffmpeg'

    package, nor a /usr/bin/ffmpeg binary. This means that front-end

    applications in Debian that previously used this binary needs to be

    ported to /usr/bin/avconv for jessie.

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 15 Jul 2012 23:13:42 +0200

libav (6:0.8.3-4) unstable; urgency=low

  * Declare a 'Breaks' relationship against mplayer, Closes: #671934

 -- Reinhard Tartler <siretart@tauware.de>  Tue, 26 Jun 2012 08:46:42 +0200

libav (6:0.8.3-3) unstable; urgency=low

  * Install the shared flavor last; the binaries from the optimized flavor(s)

    would overwrite the ones from the shared baseline flavor causing SIGILL;

    closes: #657885.

  * control/Uploaders: update my email address

 -- Loïc Minier <lool@debian.org>  Mon, 25 Jun 2012 21:21:24 +0200

libav (6:0.8.3-2) unstable; urgency=low

  [ Fabian Greffrath ]

  * Clarify relations between libavcodec53 and libavcodec-extra-53

    in debian/control.

  * Use the cond_enable() macro for all additional features in debian/confflags.

  * Tidy up and sort configuration flags.

  * Add a debian/README.source file that describes how to rebuild libav

    with a reduced feature set in order to avoid circular build-dependencies

    for bootstrapping.

  * Restrict Build-Depends to "yasm [any-amd64 any-i386]"

    and explicitly disable it if not found.

  [ Reinhard Tartler ]

  * add patch from upstream to fix playback of Canon AVHCD movies.

    (Fixes: LP: #937561)

  * fix location in ffmpeg.NEWS file

  * add dependency on libavcodec53 to libav-dbg

  * add Pre-Depend on dpkg to libav-tools to ensure smooth updates

  * {ffmpeg,libav-tools}.install: make files to install more explicit

 -- Reinhard Tartler <siretart@tauware.de>  Mon, 25 Jun 2012 19:06:49 +0200

libav (6:0.8.3-1) unstable; urgency=medium

  [ Andres Mejia ]

  * Update libav-doc doc base. (Closes: #674139)

  [ Reinhard Tartler ]

  * New upstream release 0.8.3:

    - Several bugs and crashes have been fixed in the following codecs: PNG,

      Electronic Arts TQI, H.264 (CVE-2012-0851) and H.263 (CVE-2011-3937)

  * Raising severity because of security issues.

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 09 Jun 2012 13:25:31 +0200

libav (6:0.8.2-2) unstable; urgency=low

  * Revert "temporarily disable opencv to work around dependency troubles"

  * Simplify internal dependencies (Closes: #672791)

 -- Reinhard Tartler <siretart@tauware.de>  Mon, 14 May 2012 21:37:59 +0200

libav (6:0.8.2-1) unstable; urgency=medium

  * New upstream release:

    - Several bugs and crashes have been fixed in the following codecs: AAC,

      APE, H.263, H.264, Indeo 4, Mimic, MJPEG, Motion Pixels Video, RAW,

      TTA, VC1, VQA, WMA Voice, vqavideo (CVE-2012-0947).

    - Several bugs and crashes have been fixed in the following formats:

      ASF, ID3v2, MOV, xWMA

    - This release additionally updates the following codecs to the

      bytestream2 API, and therefore benefit from additional overflow

      checks: truemotion2, utvideo, vqavideo

  * drop 02-fix-avpreset-extension.patch, applied upstream

  * Revert "Revert "temporarily disable opencv to work around dependency

           troubles"" (Closes: #671302)

  * Bumped urgency because of security issue.

 -- Reinhard Tartler <siretart@tauware.de>  Sat, 05 May 2012 11:08:44 +0200

libav (6:0.8.1-7) unstable; urgency=low

  * Fix build for hurd. Thanks to Samuel Thibault for patch. (Closes: #613034)

    (Closes: #671038)

  * Properly migrate /etc/ffserver.conf to /etc/avserver.conf.

    (Closes: #660786)

  * Renable opencv support.

 -- Andres Mejia <amejia@debian.org>  Tue, 01 May 2012 21:33:13 -0400

libav (6:0.8.1-6) unstable; urgency=low

  * Fix epoch in strict internal dependencies. Closes: #670861

  * Temporarily disable opencv to work around dependency trouble

 -- Reinhard Tartler <siretart@tauware.de>  Mon, 30 Apr 2012 08:14:20 +0200

libav (6:0.8.1-5) unstable; urgency=low

  [ Andres Mejia ]

  * Fix issue with file not being multiarch compatible. (Closes: #669988)

  [ Reinhard Tartler ]

  * Bump epoch to fix messed upload to unstable (Closes: #670762)

 -- Reinhard Tartler <siretart@tauware.de>  Sun, 29 Apr 2012 10:30:26 +0200

libav (5:0.8.1-4) unstable; urgency=low

  * Use a Provides field to provide transitional packages instead of Conflicts.

    (Closes: #666401)

  * Have both libavcodec and libavcodec-extra package conflict with each other.

 -- Andres Mejia <amejia@debian.org>  Fri, 30 Mar 2012 10:15:50 -0400

libav (5:0.8.1-3) unstable; urgency=low

  * Separate the ffmpeg program into the transitional package.

  * Change ffmpeg warning so that it's clearer the program is

    deprecated (LP: #939863)

 -- Andres Mejia <amejia@debian.org>  Thu, 29 Mar 2012 13:13:01 -0400

libav (5:0.8.1-2) experimental; urgency=low

  [ Andres Mejia ]

  * Merge libav-extra packages to libav. (Closes: #658084)

  * Provide only libavcodec-extra package, the other packages are unnecessary.

  * Remove libav-source package. No longer necessary.

  * Remove dependencies and suggests of FAAD, no longer needed.

  * Set Enhances field and update package description for libavcodec-extra

    package. (Closes: #653451)

  * Fix issue with installation of debug symbols. (Closes: #642798)

  [ Fabian Greffrath ]

  * Mention license impact in libavcodec-extra-53's package description.

 -- Andres Mejia <amejia@debian.org>  Wed, 21 Mar 2012 15:52:58 -0400

libav (4:0.8.1-1) unstable; urgency=medium

  [ Reinhard Tartler ]

  * Bump shlibs (Closes: #662793)

  * force upgrades of older libavcodec-extra-53 packages

  * drop all post-0.8 patches, applied upstream

  * bump standards version, no changes needed

  * Imported Upstream version 0.8.1

  * Bumped urgency to medium because of included security fixes:

    CVE-2012-0848, CVE-2012-0853, CVE-2012-0858, CVE-2011-3929,

    CVE-2011-3936, CVE-2011-3937, CVE-2011-3940, CVE-2011-3945,

    CVE-2011-3947, CVE-2011-3951, CVE-2011-3952