Change log for tiff3 package in Debian

tiff3 (3.9.7-3) unstable; urgency=low


  * libtiff4 -> libtiff5 transition: drop libtiff4-dev (and therefore
    libtiff-dev).  The tiff3 source package is planned for removal from
    jessie.  There is no longer any dev package for tiff 3.x.

 -- Jay Berkenbilt <email address hidden>  Wed, 04 Dec 2013 14:13:04 -0500

tiff3 (3.9.7-2) unstable; urgency=low


  * Complete Multi-Arch conversion for dev packages.  (Closes: #720705)

 -- Jay Berkenbilt <email address hidden>  Sat, 24 Aug 2013 12:22:32 -0400

tiff3 (3.9.7-1) unstable; urgency=low


  * New upstream release
  * Patches incorporated by upstream:
     CVE-2012-1173.patch
     CVE-2012-2088.patch
     CVE-2012-3401.patch
     CVE-2012-5581.patch
  * Build depend on autotools-dev
  * Incorporated changes from CVE-2013-1961 that were applied to the
    library.  Ther rest of this CVE and CVE-2013-1960 do not apply to
    tiff3 because tiff3 does not create libtiff-tools.  (Closes: #712840)

 -- Jay Berkenbilt <email address hidden>  Sun, 23 Jun 2013 10:55:29 -0400

tiff3 (3.9.6-11) unstable; urgency=high


  * Fix /usr/share/doc symlink to directory transition.  When upgrading
    from very old versions (pre 3.8.2-8), /usr/share/doc may contain
    symbolic links that should be removed.  (Closes: #699041)

 -- Jay Berkenbilt <email address hidden>  Sat, 26 Jan 2013 12:27:56 -0500

tiff3 (3.9.6-10) unstable; urgency=high


  * Add fix for CVE-2012-5581, reimplementing DOTRANGE handling to make it
    safer.  Thanks to Red Hat security team for backporting the fix.
    (Closes: #694693)

 -- Jay Berkenbilt <email address hidden>  Sat, 15 Dec 2012 06:04:00 -0500

tiff3 (3.9.6-9) unstable; urgency=high


  * Previous change was uploaded with the wrong CVE number.  I updated the
    last changelog entry.  The correct CVE number is CVE-2012-4447.

 -- Jay Berkenbilt <email address hidden>  Fri, 05 Oct 2012 17:32:42 -0400

tiff3 (3.9.6-7) unstable; urgency=high


  * SECURITY UPDATE: possible arbitrary code execution via heap overflow
    in tiff2pdf.  (Closes: #682195)
    - debian/patches/CVE-2012-3401.patch: properly set t2p->t2p_error in
      tools/tiff2pdf.c.
    - CVE-2012-3401
    Changes prepared by Marc Deslauriers for Ubuntu.  Thanks!

 -- Jay Berkenbilt <email address hidden>  Sat, 21 Jul 2012 21:33:53 -0400

tiff3 (3.9.6-6) unstable; urgency=high


  * Incorporated fix to CVE-2012-2088, a buffer overflow with certain
    tiled tiff files.  Note that CVE-2012-2113 is not fixed in this
    package, but it applies only to tiff2pdf, which is not packaged here.
    (It is packaged in the "tiff" source package, which is based on a
    newer version that doesn't have the problem.)

 -- Jay Berkenbilt <email address hidden>  Fri, 29 Jun 2012 16:17:11 -0400

tiff3 (3.9.6-5) unstable; urgency=low


  * Fix shlibs again.

 -- Jay Berkenbilt <email address hidden>  Sun, 22 Apr 2012 11:41:52 -0400

tiff3 (3.9.6-4) unstable; urgency=low


  * Use >= instead of > in shlibs file.  (Closes: #669042)

 -- Jay Berkenbilt <email address hidden>  Sun, 22 Apr 2012 10:56:37 -0400

tiff3 (3.9.6-3) unstable; urgency=low


  * Support JBIG now that patents have expired.

 -- Jay Berkenbilt <email address hidden>  Sun, 08 Apr 2012 07:58:38 -0400

tiff3 (3.9.6-2) unstable; urgency=high


  * Incorporated fix to CVE-2012-1173, a problem in the parsing of the
    TileSize entry, which could result in the execution of arbitrary code
    if a malformed image is opened.
  * Updated standards to 3.9.3

 -- Jay Berkenbilt <email address hidden>  Fri, 06 Apr 2012 10:09:01 -0400

tiff3 (3.9.6-1) unstable; urgency=low


  * New upstream release
  * Fix watch file to restrict to 3.x versions of tiff and to point to new
    download location.

 -- Jay Berkenbilt <email address hidden>  Mon, 20 Feb 2012 09:38:04 -0500

tiff3 (3.9.5-4) experimental; urgency=low


  * Fix Conflicts for renaming of binary packages in the tiff source
    package.

 -- Jay Berkenbilt <email address hidden>  Sat, 04 Feb 2012 09:40:40 -0500

tiff3 (3.9.5-3) experimental; urgency=low


  * New source package for tiff 3.x.  Dropped libtiff-tools,
    libtiff-opengl, and libtiff-doc, which are still in the tiff source
    package.
  * Enabled versioned symbols; bumped shlibs files to force properly
    versioned dependency for new builds.

 -- Jay Berkenbilt <email address hidden>  Sat, 28 Jan 2012 10:49:12 -0500