ioquake3 1.36+u20161101+dfsg1-2 source package in Ubuntu

Changelog

ioquake3 (1.36+u20161101+dfsg1-2) unstable; urgency=high

  * d/gbp.conf: switch branch to debian/stretch for updates during freeze
  * d/patches: Add patches from upstream fixing security vulnerabilities
    - refuse to load potentially auto-downloadable .pk3 files as
      ioquake3 renderers, ioquake3 game code, libcurl, or OpenAL drivers
      (mitigation: auto-downloading is off by default, and in Debian
      we do not dlopen libcurl anyway)
    - refuse to load default configuration file names from a .pk3 file
    - protect cl_renderer, cl_curllib, s_aldriver configuration variables so
      game code cannot set them
    - refuse to overwrite files other than *.txt with the dump console
      command
    - refuse to overwrite files other than *.cfg with the writeconfig
      console command
    (Closes: #857699)
  * Add patch adapted from openarena to request confirmation before
    enabling auto-downloading if the native-code Quake III Arena UI is
    in use. Unfortunately this is not the case with quake3_46, but
    I'm adding this patch in the hope that the wrapper script can
    be fixed before the stretch release.

 -- Simon McVittie <email address hidden>  Tue, 14 Mar 2017 10:14:37 +0000