pjproject (2.7.2~dfsg-1ubuntu0.1~esm1) bionic-security; urgency=medium

  * SECURITY UPDATE: buffer overflow when parsing ICE session credentials
    - debian/patches/CVE-2026-25994-1.patch: Validate credential lengths
      in pjnath/src/pjnath/ice_session.c.
    - debian/patches/CVE-2026-25994-2.patch: Fix wrong operator in ICE
      credential verification in pjnath/src/pjnath/ice_session.c.
    - CVE-2026-25994
  * SECURITY UPDATE: insecure reuse of TLS connections
    - debian/patches/CVE-2020-15260-1.patch: Check hostname during TLS
      transport selection in pjsip/include/pjsip/sip_dialog.h,
      pjsip/src/pjsip/sip_dialog.c, pjsip/src/pjsip/sip_transport.c,
      pjsip/src/pjsip/sip_util.c.
    - debian/patches/CVE-2020-15260-2.patch: Fix secure transport
    checking in pjsip/src/pjsip/sip_transport.c.
    - CVE-2020-15260
  * SECURITY UPDATE: denial of service due to server crash
    - debian/patches/CVE-2021-21375.patch: Prevent crash during SDP session
      negotiation in pjmedia/src/pjmedia/sdp_neg.c.
    - debian/patches/CVE-2021-32686.patch: Prevent crash in SSL socket server
      in pjlib/src/pj/ssl_sock_ossl.c and pjsip/src/pjsip/sip_transport_tls.c.
    - CVE-2021-21375
    - CVE-2021-32686
  * SECURITY UPDATE: remote code execution due to integer underflow
    - debian/patches/CVE-2021-37706.patch: Fix integer underflow when parsing
      STUN packets in pjnath/src/pjnath/stun_msg.c.
    - CVE-2021-37706
  * SECURITY UPDATE: buffer overflow in PJSUA APIs
    - debian/patches/CVE-2021-43299_to_CVE-2021-43303.patch: Perform buffer
      length checks in pjmedia/include/pjmedia/wav_playlist.h,
      pjmedia/src/pjmedia/wav_playlist.c, pjsip/include/pjsua-lib/pjsua.h,
      pjsip/src/pjsua-lib/pjsua_aud.c, pjsip/src/pjsua-lib/pjsua_dump.c.
    - CVE-2021-43299
    - CVE-2021-43300
    - CVE-2021-43301
    - CVE-2021-43302
    - CVE-2021-43303

 -- Edwin Jiang <edwin.jiang@canonical.com>  Fri, 20 Mar 2026 15:14:33 -0400

pjproject (2.7.2~dfsg-1) unstable; urgency=medium

  * New upstream version, fixing two remote crashes
    - Crash when receiving SDP with invalid fmtp attribute
    - Crash when parsing SDP with an invalid media format description
  * Mark binary packages linux-any, FTBFSing on hurd/kfreebsd
  * Drop duplicate filter line in d/gbp.conf
  * Switch Vcs-* to salsa

 -- Bernhard Schmidt <berni@debian.org>  Sat, 24 Feb 2018 23:37:04 +0100

pjproject (2.7.1~dfsg-1) unstable; urgency=medium

  * New upstream release
    + Adjust symbols

 -- Bernhard Schmidt <berni@debian.org>  Thu, 09 Nov 2017 23:20:17 +0100

pjproject (2.7~dfsg-1) unstable; urgency=medium

  [ Bernhard Schmidt ]
  * New upstream release
    + Repack with Jonas' updated copyright information (Closes: #877365)
    + Drop security patches applied upstream
    + Update symbols
  * Switch to libsrtp2
    + add Breaks against Asterisk built with libsrtp0
  * Change section of libraries to "libs", silencing lintian
  * Declare Standards-Version 4.1.1, no changes necessary
  * Enable all hardening

  [ Jonas Smedegaard ]
  * Update copyright info:
    + Use (derived form of) SPDX license shortname Rdisc.
    + Use https protocol in format URL.
    + Normalize http URLs.
    + Use License-Grant and License-Reference fields.
    + Fix list pjlib/src/pj/compat/longjmp_i386.S as licensed LGPL-2+
      (not LGPL-2.1+).
    + Fix cover files licensed FSFUL NTP Ms-PL Expat.
    + Fix cover file licensed BSD-4-clause and GPL-2+ (not only GPL-2+).
    + Fix remove files listed as stripped from source repackaging but
      not existing in upstream source:
      - third_party/yuv
      - third_party/webrtc.
    + Rewrite notes on files stripped from repackaged source.
    + Fix strip more files when repackaging source:
      - Non-DFSG-free ApiLock.*.
      - Copyright-protected graphics ICC profiles without DFSG-free
        license.
      - Binary Java files potentially with non-free parts.
    + Rewrite maintainer script copyright-check.

 -- Bernhard Schmidt <berni@debian.org>  Thu, 05 Oct 2017 23:31:13 +0200

pjproject (2.6~dfsg-2) unstable; urgency=medium

  * Add libavdevice-dev to libpjproject-dev Depends
  * Reinclude libssl-dev dependency that was dropped during migration
  * Drop useless-autoreconf-build-depends

 -- Bernhard Schmidt <berni@debian.org>  Thu, 17 Aug 2017 20:07:09 +0200

pjproject (2.6~dfsg-1) unstable; urgency=medium

  * Release to unstable
  * change Standards-Version to 4.0.1, no changes necessary
  * add debian/gbp.conf for pristine-tar

 -- Bernhard Schmidt <berni@debian.org>  Tue, 15 Aug 2017 22:32:04 +0200

pjproject (2.6~dfsg-0+exp2) experimental; urgency=medium

  * Build with -Wl,--as-needed
    - disable unnecessary 0006-Reduce-linkage-of-unused-libraries.patch
    - also disable 0001-Remove-pointless-linking-with-libasound.patch
      breaking compilation
  * drop symbols for (largely unused) C++ library

 -- Bernhard Schmidt <berni@debian.org>  Sun, 06 Aug 2017 23:33:46 +0200

pjproject (2.6~dfsg-0+exp1) experimental; urgency=medium

  * New upstream version 2.6
    - dfsg: Exclude third_party/webrtc, not sure if distributable
    - Drop patches applied upstream
    - refresh remaining patches
    - update symbols
  * Disable webrtc build
  * Switch to OpenSSL 1.1.0 (Closes: #854583)

 -- Bernhard Schmidt <berni@debian.org>  Sat, 24 Jun 2017 22:38:54 +0200

pjproject (2.5.5~dfsg-6) unstable; urgency=high

  [ Tzafrir Cohen ]
  * add security patches published by the Asterisk project
    - AST-2017-002: Buffer Overrun in PJSIP transaction layer
      (Closes: #863901)
    - AST-2017-003: Crash in PJSIP multi-part body parser
      (Closes: #863902)

 -- Bernhard Schmidt <berni@debian.org>  Fri, 02 Jun 2017 08:59:42 +0200

pjproject (2.5.5~dfsg-5) unstable; urgency=medium

  [ Bernhard Schmidt ]
  * run dh_clean in clean target
  * Disable debug assertions as recommended for production builds

 -- Bernhard Schmidt <berni@debian.org>  Sun, 18 Dec 2016 22:32:19 +0100

pjproject (2.5.5~dfsg-4) unstable; urgency=medium

  [ Bernhard Schmidt ]
  * Adjust previous changelog to fix lintian error
  * Bump all symbols minimum versions to force tighter dependencies
    (Closes: #847014)
  * Update debian/config_site.h with suggestions from Asterisk git
  * convert package from git-dpm to gbp pq

 -- Bernhard Schmidt <berni@debian.org>  Fri, 16 Dec 2016 14:53:12 +0100

pjproject (2.5.5~dfsg-3) unstable; urgency=medium

  [ Bernhard Schmidt ]
  * Temporarily drop d-devlibdeps generated dependency on libssl-dev
    from libpjproject-dev
  * Add a couple of stability fixes collected by Asterisk
    (third_party/pjproject/patches), all present in pjproject trunk
    - asterisk-0001-r5397-pjsip_generic_array_max_count.patch
    - asterisk-0001-r5400-pjsip_tx_data_dec_ref.patch
    - Fix-1946-Avoid-deinitialization-of-uninitialized-cli.patch
    - asterisk-0002-r5435-add-pjsip_inv_session-ref_cnt.patch
    - asterisk-0003-r5403-pjsip_IPV6_V6ONLY.patch
    - resolver.c-Prevent-SERVFAIL-from-marking-name-server.patch
    - Re-1969-Fix-crash-on-using-an-already-destroyed-SSL.patch
    - r5471-svn-backport-Various-fixes-for-DNS-IPv6.patch
    - r5473-svn-backport-Fix-pending-query.patch
    - r5475-svn-backport-Remove-DNS-cache-entry.patch
    - r5477-svn-backport-Fix-DNS-write-on-freed-memory.patch
   This bunch of patches hopefully fixes #842878

 -- Bernhard Schmidt <berni@debian.org>  Thu, 10 Nov 2016 09:48:05 +0100

pjproject (2.5.5~dfsg-2) unstable; urgency=medium

  * explicitly build-depend on OpenSSL 1.0.2, see #828505

 -- Bernhard Schmidt <berni@debian.org>  Wed, 02 Nov 2016 14:32:51 +0100

pjproject (2.5.5~dfsg-1) unstable; urgency=medium

  * Add myself to uploaders
  * New upstream version 2.5.5~dfsg
    - d/copyright: Exclude third_party/yuv (unclear license)
    - d/copyright: drop third_party/portaudio not present anymore
  * disable libyuv
  * Update symbols file for new version
  * add Build-dep on liboss4-salsa-dev for kfreebsd-any

 -- Bernhard Schmidt <berni@debian.org>  Sun, 30 Oct 2016 20:34:11 +0100

pjproject (2.5.1~dfsg-4) unstable; urgency=medium

  * Update libpjsua2-2v5.symbols for 32-bit platforms
  * disable parallel building causing FTBFS on some architectures

 -- Bernhard Schmidt <berni@debian.org>  Sat, 15 Oct 2016 23:33:59 +0200

pjproject (2.5.1~dfsg-3) unstable; urgency=medium

  * Update debian/libpjsua2-2v5.symbols for GCC-6 (Closes: #831179)

 -- Bernhard Schmidt <berni@debian.org>  Fri, 14 Oct 2016 12:25:18 +0200

pjproject (2.5.1~dfsg-2) unstable; urgency=medium

  * Build-depend on libvo-amrwbenc-dev.
  * Declare compliance with Debian Policy 3.9.8.
  * Stop build-depend on unused libx264-dev.
  * Add d-shlibdev override for libvo-amrwbenc.
  * Add lintian override regarding license in License-Reference field.
    See bug#786450.

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 07 Jun 2016 22:46:25 +0200

pjproject (2.5.1~dfsg-1) unstable; urgency=medium

  [ upstream ]
  * new release(s).

  [ Jonas Smedegaard ]
  * Update copyright info:
    + Normalize and sort copyright holders.
    + Fix use double-space as copyright-holder delimiter.
    + Extend coverage for main author to include recent years.
    + Use License-Grant and License-Reference fields for GPL license.
      Thanks to Ben Finney.
    + Merge Files sections with identical license-grant.
    + Generalize comment about additional ignored licenses.
    + Fix add additional GPL-granting copyright holders.
    + Use separate Files section for each public-domain (non-)grant.
    + Use License-Grant and License-Reference fields for Apache license.
    + Strip convenience code copies gsm portaudio resample speex srtp
      when repackaging upstream source.
    + Stop track files or licenses of non-redistributed convenience code
      copies.
  * Add copyright-check script.
  * Update patches to not mess with autogenerated files.
  * Bump debhelper compatibility level to 10.
    Adjust rules to use dh_autoreconf.
    Tighten build-dependency on debhelper.
  * Drop import script (gbp import-orig clashes with git-dpm patches).
    Document in README.source how to import new upstream source.
  * Unfuzz patch, and drop ones resolved upstream.
  * Build-depend on libopus-dev libwebrtc-audio-processing-dev.
  * Simplify d-shlibdeps call and instead tighten build-dependency on
    d-shlibs.
  * Update symbols files.
  * Add d-shlibdev override for libopus.

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 07 Jun 2016 18:59:26 +0200

pjproject (2.4.5~dfsg-4) unstable; urgency=medium

  * Fix avoid build-depending on libv4l-dev on the Hurd:
    + Adapt symbols.
    + Resolve libpjproject-dev dependencies related to linked libraries
      during build.
    + Build-depend on d-shlibs.
  * Modernize Vcs-* field URLs:
    + Use https protocol.
    + Use cgit viewer.
  * Build-depend unversioned on debhelper: Needed version satisfied even
    in oldstable.
  * Add lintian override regarding debhelper 9.
  * Declare compliance with Debian Policy 3.9.7.
  * Update symbols file (affects only optional symbols).
  * Fix stop have libpjproject-dev depend on libx264-dev: Seems unused.

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 01 Apr 2016 15:03:42 +0200

pjproject (2.4.5~dfsg-3) unstable; urgency=medium

  * Update symbois.

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 25 Mar 2016 19:22:31 +0100

pjproject (2.4.5~dfsg-2) unstable; urgency=medium

  * Move packaging to Debian VoIP team (with Tzafrir's consent).
    Add myself as uploader.
  * Use pkgkde-symbolshelper. Build-depend on pkg-kde-tools.

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 25 Mar 2016 17:09:28 +0100

pjproject (2.4.5~dfsg-1.1) unstable; urgency=medium

  * Non-maintainer upload.

  [ upstream ]
  * New release(s).
    + Use the OpenSSL RNG if available, instead of via SRTP.
      Closes: Bug#793972.
    + Support compilation with OpenSSL without OpenSSLv3 support.
      Closes: Bug#805082. Thanks to Peter Green.

  [ Tzafrir Cohen ]
  * Fix add Files section for bar-descriptor.xml to debian/copyright.
    Closes: #793051. Thanks to Thorsten Alteholz.
  * Move arch-dependent headers to a triplet subdir.
    Closes: #793097. Thanks to Jakub Wilk.
  * Bump soname for libpjsua2: Add C++ transitional v5 suffix.
    Closes: Bug#793094. Thanks to Jakub Wilk and Simon McVittie.
  * Replace deprecated FFmpeg API.
    Closes: Bug#803855, #801535. Thanks to Andreas Cadhalpun.
  * Copy -dev build deps to deps of -dev package.
    Closes: #795825, #801535. Thanks to Julien Cristau, Simon McVittie
    and Andreas Beckmann.

  [ Jeremy Lainé ]
  * Reduce library linkage.
    Closes: Bug#793141. Thanks to James Cloos.

  [ Jonas Smedegaard ]
  * Fix typo in long descriptions.
  * Build-depend on virtual libsrtp-dev (not libsrtp0-dev) to ease
    pending transition.
  * Fix have libpjproject-dev depend on libpjsua2-2v5 (not libpjsua2-2).
  * Fix add version mangling hint to watch file.
  * Fix strip debian revision from symbols files.

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 21 Mar 2016 11:42:57 +0100

pjproject (2.4~dfsg-1) unstable; urgency=low

  * New upstream release: now an upstream version (Closes: #725326).
    - Update symbols for version 2.3, 2.4
    - We use upstream source. No need for the README
    - rules: config_site moved
    - CODEC_ID_* changed to AV_CODEC_ID_*
    - Extra library: pjsua2 (libpjsua2-2. Package libpjsua2 is pjsua).
  * -dev package: depend explicitly on libsrtp0-dev due to -lsrtp in
    the pkg-config file.
  * rules: run 'make dep' at build time.
  * rules: 'build' not cnfused by directory 'build'
  * Enable opencore-amr codec support
  * Do enable IPv6 support in config_site (Closes: #787964).
  * README.source: we use git-dpm
  * Do enable video
  * compat level 9
  * multi-arch support
    - control: packages pre-depend on multi-arch
  * Remove offending build flags from pkgconfig file (lintian).
  * A disabled tests target
  * extra files to remove after tests
  * Reduce number of libraries linked with pjlib-util
  * copyright: Fix syntax (gsm)
  * Remove video libs dependency for pj-utils and pjnath
  * package python-pjproject (Closes: #768578)
    - Depend on python-dev
  * Standards version 3.9.6 (no change needed)
  * copyright: Don't use '[]' wildcards

 -- Tzafrir Cohen <tzafrir@debian.org>  Sun, 28 Jun 2015 23:53:29 +0300

pjproject (2.1.0.0.ast20130823-1) unstable; urgency=low

  [ Jeremy Lainé ]
  * Fix dh_auto_clean on an unconfigured source tree (Closes: #722013).
  * Fix syntax error in machine-readable debian/copyright.
  * Update Standards-Version to 3.9.4 (no changes).

  [ Tzafrir Cohen ]
  * Further copyright fixes.
  * New upstream git snapshot:
    pkgconfig_nodestdir.patch, soname.patch dropped: merged upstream.
  * fix_gcc_warn.patch: remove some build warnings.

 -- Tzafrir Cohen <tzafrir@debian.org>  Thu, 12 Sep 2013 16:53:51 +0300

pjproject (2.1.0~ast20130801-1) unstable; urgency=low

  * Initial release. (Closes: #708122)

 -- Tzafrir Cohen <tzafrir@debian.org>  Wed, 07 Aug 2013 22:20:07 +0300
