uriparser (0.9.3-2ubuntu0.1~esm4) focal-security; urgency=medium

  * SECURITY UPDATE: stack exhaustion via unbounded recursion in URI parser
  - debian/patches/CVE-2025-67899_1.patch: convert tail-recursive calls
    to iterative goto loops in src/UriParse.c
  - debian/patches/CVE-2025-67899_2.patch: dissolve indirect recursion
    in ParseIpFutLoop/ParseIpFutStopGo in src/UriParse.c
  - debian/patches/CVE-2025-67899_3.patch: dissolve indirect recursion
    in ParseOwnHostUserInfoNz in src/UriParse.c
  - CVE-2025-67899

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Thu, 28 May 2026 17:30:56 +0000

uriparser (0.9.3-2ubuntu0.1~esm3) focal-security; urgency=medium

  * SECURITY UPDATE: Integer Overflow
    - debian/patches/CVE-2024-34402.patch: Replace int type with size_t
    - CVE-2024-34402
    - debian/patches/CVE-2024-34403.patch: Check if string length is
      INT_MAX
    - CVE-2024-34403

 -- Bruce Cable <bruce.cable@canonical.com>  Mon, 17 Mar 2025 17:56:13 +1100

uriparser (0.9.3-2ubuntu0.1~esm2) focal-security; urgency=medium

  * SECURITY UPDATE: Use after free
    - debian/patches/CVE-2021-46141_46142.patch: Fix .hostText copying in
      uriMakeOwnerEngine.
    - CVE-2021-46141
    - CVE-2021-46142
  * Additional fixes:
    - debian/patches/implement_new_public_urlMakeOwner.patch: UriNormalize.c:
      Implement new public uriMakeOwner*
    - debian/patches/rename_internal_uriMakeOwner.patch: UriNormalize.c:
      Rename internal uriMakeOwner to uriMakeOwnerEngine
    - debian/patches/test_cover_new_uriMakeOwner.patch: test.cpp: Cover
      new uriMakeOwner*

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Tue, 25 Jan 2022 15:07:38 +0000

uriparser (0.9.3-2) unstable; urgency=medium

  * Fix FTBFS:
    - debian/control: move all Build-Depends-Indep to Build-Depends.

 -- Jörg Frings-Fürst <debian@jff.email>  Sat, 20 Jul 2019 10:24:00 +0200

uriparser (0.9.3-1) unstable; urgency=medium

  * New upstream release.
    - Refresh symbols file.
    - Rewrite build process.
  * Migrate to debhelper 12:
    - Change debian/compat to 12.
    - Bump minimum debhelper version in debian/control to >= 12.
  * Declare compliance with Debian Policy 4.4.0 (No changes needed).

 -- Jörg Frings-Fürst <debian@jff.email>  Sat, 13 Jul 2019 18:39:44 +0200

uriparser (0.9.1-1) unstable; urgency=medium

  * New upstream release.
  * Declare compliance with Debian Policy 4.3.0.1 (No changes needed).
  * debian/copyright:
    - Bump years to 2019.

 -- Jörg Frings-Fürst <debian@jff.email>  Sat, 12 Jan 2019 19:08:27 +0100

uriparser (0.9.0-1) unstable; urgency=medium

  * New upstream release (Closes: #913817):
    - Fix CVE-2018-19198.
    - Fix CVE-2018-19199.
    - Fix CVE-2018-19200.
  * Refresh debian/liburiparser1.symbols.

 -- Jörg Frings-Fürst <debian@jff.email>  Fri, 16 Nov 2018 07:57:14 +0100

uriparser (0.8.6-1) unstable; urgency=medium

  * New upstream release.
  * Declare compliance with Debian Policy 4.2.1 (No changes needed).

 -- Jörg Frings-Fürst <debian@jff.email>  Sat, 08 Sep 2018 10:40:53 +0200

uriparser (0.8.5-2) unstable; urgency=medium

  * debian/control:
    - Switch Vcs-* to new loacation.
  * Remove now useless debian/liburiparser-doc.lintian-overrides.
  * Declare compliance with Debian Policy 4.1.5 (No changes needed).

 -- Jörg Frings-Fürst <debian@jff.email>  Sun, 08 Jul 2018 14:16:31 +0200

uriparser (0.8.5-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix broken symlink: liburiparser.so -> liburiparser.so.1.0.21
    (closes: #901955)

 -- Bas Couwenberg <sebastic@debian.org>  Fri, 22 Jun 2018 17:00:15 +0200

uriparser (0.8.5-1) unstable; urgency=medium

  * New upstream release (Closes: #893316).
    - Refresh symbols file.
    - Refresh debian/copyright.
    - Rewrite debian/upstream/metadata.
  * Remove trailing whitespaces:
    - debian/changelog
    - debian/control
    - debian/rules
  * Migrate to debhelper 11:
    - Change debian/compat to 11.
    - Bump minimum debhelper version in debian/control to >= 11.
    - Remove dh-autoreconf from Build-Depends.
  * Declare compliance with Debian Policy 4.1.4 (No changes needed).
  * Change to my new email address:
    - debian/control
    - debian/copyright
  * New README.source to explain the branching model used.
  * debian/rules:
    - Switch to $(DEB_UPSTREAM_VERSION).

 -- Jörg Frings-Fürst <debian@jff.email>  Sat, 05 May 2018 10:14:09 +0200

uriparser (0.8.4-1) unstable; urgency=medium

  * New upstream release.
  * debian/liburiparser-dev.links:
    - Bump library version to 1.0.20.
  * Add package liburiparser-doc:
    - debian/rules:
      + Add override_dh_auto_build-indep and override_dh_installdocs-indep
        to handle the build and install the html documentation.
    - debian/control:
      + Add Build-Depends-Indep.
      + Add new package liburiparser-doc.
    - New debian/liburiparser-doc.doc-base.
    - New debian/liburiparser-doc.dirs.
  * New debian/liburiparser-doc.lintian-overrides to override the lintian
    warning "embedded-javascript-library".
  * debian/copyright:
    - Change GPL-3.0+ to GPL-3+.
    - Change Upstream Mail Address to Sebastian Pipping <webmaster@hartwork.org>
  * debian/rules:
    - Add override_dh_compress to exclude *.qhp.
    - Remove -c0 from dh_makeshlibs call.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 04 Nov 2015 07:02:13 +0100

uriparser (0.8.3-1) unstable; urgency=low

  * New upstream release.
  * New debian/upstream/metadata:
    - Add some DEP-12 upstream metadata.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 07 Oct 2015 18:35:50 +0200

uriparser (0.8.2-1) unstable; urgency=low

  * New upstream release.
  * debian/control:
    - Bump Standards-Version to 3.9.6 (no changes required).
    - Remove unknown substitution variable ${shlibs:Depends}
      from liburiparser-dev.
  * Refresh debian/liburiparser1.symbols.
  * Refresh link to usr/lib/liburiparser.so in liburiparser-dev.links.
  * debian/copyright:
    - Add License and author for the new files:
      +  test/VersionSuite.*.
  * debian/source/options:
    - Removed because xz is now standard compression.
  * debian/rules:
    - Enable hardening.
    - Add override_dh_makeshlibs for testing symbols.
  * Enable mulitarch:
    - debian/rules:
      + Add --libdir to confflags
    - debian/liburiparser-dev.links:
      + Add dh-exec shebang line.
      + Add ${DEB_HOST_MULTIARCH}.
      + make file executable.
    - debian/*.install:
      + Change the path (add /*/).
    - debian/control:
      + Add dh-exec (>=0.3) to Build-Depends.
      + Add Pre-Depends: ${misc:Pre-Depends} to package liburiparser1.
      + Add Multi-Arch: same to package liburiparser1.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Tue, 28 Apr 2015 08:18:53 +0200

uriparser (0.8.0.1-2) unstable; urgency=low

  * debian/rules:
    - Add --with autoreconf to enable update Build Environment
      (Closes: #727517).
      + Thanks to Breno Leitao <brenohl@br.ibm.com>

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sat, 16 Aug 2014 09:30:15 +0200

uriparser (0.8.0.1-1) unstable; urgency=medium

  * New Maintainer (Closes: #754473).
  * New upstream release (Closes: #668244).
    - Remove nonfree items from source (Closes: #753833):
      + doc/rfc3513.htm.
      + doc/rfc3986.htm.
      + doc/rfc3986_grammar_only.txt.
      + Remove debian/prune-tarball.sh.
      + Remove debian/README.Debian-source.
  * debian/control:
    - Set myself as maintainer.
    - Bump Standards-Version to 3.9.5 (no changes required).
    - Update Build-Depends:
      + Add dh-autoreconf for update Build Environment (Closes: #727517).
    - Change description of liburiparser1  (Closes: #552993).
    - For previously not existing Vcs
      + Create a new git repository on alioth.
      + Add the Fields Vcs-Browser and Vcs-Git.
  * Change debian/compat to 9 (no changes required).
  * Add debian/source/options:
    - Set compression to xz & compression-level to 9 to save space.
  * debian/copyright:
    - Rewrite into machine-readable format.
    - Add myself to the list of authors for debian/*.
    - Update copyright years for 2014.

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Wed, 06 Aug 2014 21:23:55 +0200

uriparser (0.8.0+dfsg-1) UNRELEASED; urgency=medium

  * Change debian/watch
    - change upstream tarball to all filetypes.
  * remove debian/rules.old

 -- Jörg Frings-Fürst <debian@jff-webhosting.net>  Sat, 12 Jul 2014 05:09:11 +0200


uriparser (0.7.5-1) unstable; urgency=low

  * New upstream release.
  * New maintainer. (Closes: #544633)
  * Use more minimalistic approach to rules using debhelper 7.
  * Add --disable-test to configure because cpptest-1.1.0 isn't packaged yet.
  * Add --disable-doc to configure to prevent generation of api docs.
  * Switch to dpkg-source 3.0 (quilt) format
  * Update *.install files to more inclusive of files to install.
  * Re-enable watch file, as it seems to work just fine with uscan.

 -- Taylor LeMasurier-Wren <ripps818@gmail.com>  Sat, 15 May 2010 13:47:20 -0500

uriparser (0.7.4-2) unstable; urgency=low

  * Bump to Standards-Version 3.8.2.
  * Set maintainer to Debian QA Group.

 -- Clint Adams <schizo@debian.org>  Sat, 01 Aug 2009 01:12:33 -0400

uriparser (0.7.4-1) unstable; urgency=low

  * New upstream release.  closes: #493073.
  * Add myself to Uploaders.
  * Bump to Standards-Version 3.8.0.
  * debian/prune-tarball.sh: also remove RFC1866.

 -- Clint Adams <schizo@debian.org>  Sat, 14 Feb 2009 10:36:07 -0500

uriparser (0.6.4-1) unstable; urgency=low

  * New upstream release.
  * Bump Standard-Versions to 3.7.3 (no changes needed).

 -- Adeodato Simó <dato@net.com.org.es>  Sun, 09 Mar 2008 11:54:35 +0100

uriparser (0.6.3-1) unstable; urgency=low

  * New upstream release.

 -- Adeodato Simó <dato@net.com.org.es>  Mon, 11 Feb 2008 19:48:38 +0100

uriparser (0.6.1-1) unstable; urgency=low

  * New upstream version.

  * Add a watch file.

  * Convert debian/liburiparser1.symbols to be a dpkg-gensymbols file.
    SymbolFile.pm blacklists arch-specific symbols, so this closes: #448959.

 -- Adeodato Simó <dato@net.com.org.es>  Wed, 26 Dec 2007 18:42:29 +0100

uriparser (0.6.0-1) unstable; urgency=low

  * Initial release. (Closes: #443222)

  * Include in the .diff.gz hunks to allow building in a separate tree.
    This will be fixed in the next upstream release.

 -- Adeodato Simó <dato@net.com.org.es>  Wed, 19 Sep 2007 21:07:20 +0200
