gcab (0.7-2+deb9u1) stretch-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * Do not crash when ncbytes is larger than the buffer size (CVE-2018-5345)
    (Closes: #887776)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 20 Jan 2018 09:10:05 +0100

gcab (0.7-2) unstable; urgency=medium

  * Explicitly build-depend on intltool and pkg-config instead of relying
    on gnome-common. Closes: #837853.
  * Standards-Version 3.9.8, no change required.

 -- Stephen Kitt <skitt@debian.org>  Thu, 15 Sep 2016 23:02:12 +0200

gcab (0.7-1) unstable; urgency=medium

  * New upstream release.
  * Add unique license names for all the permissive licenses.
  * Migrate to dbgsym debug packages.
  * Switch to https: VCS URIs (see #810378).
  * Add the Ubuntu patch to avoid integer overflows in zalloc.
  * Standards-Version 3.9.7, no change required.
  * Enable all hardening options.

 -- Stephen Kitt <skitt@debian.org>  Fri, 18 Mar 2016 12:46:01 +0100

gcab (0.6-1) unstable; urgency=medium

  * New upstream release.
  * Drop afl-fixes.patch, merged upstream.

 -- Stephen Kitt <skitt@debian.org>  Fri, 20 Mar 2015 20:11:15 +0100

gcab (0.5-1) unstable; urgency=medium

  * New upstream release.
  * Drop patches fix-glib-linking, fix-gtkdoc-tests, cve-2015-0552.patch,
    merged upstream.
  * m4/intltool.m4 is no longer shipped, remove it from
    debian/copyright.

 -- Stephen Kitt <skitt@debian.org>  Thu, 12 Mar 2015 06:59:08 +0100

gcab (0.4-3) unstable; urgency=medium

  * Fix all the crashes detected by AFL. Thanks to Jakub Wilk for the
    suggestion! Closes: #775941.
  * Fix hyphens in the manpage.

 -- Stephen Kitt <skitt@debian.org>  Sun, 25 Jan 2015 23:51:15 +0100

gcab (0.4-2) unstable; urgency=medium

  * Indicate that libgcab/gcab-enums.* is licensed using LGPL-2.0+, not
    2.1+ like the rest of the project. Thanks to Thorsten Alteholz for
    pointing out that this should be indicated explicitly!
  * Prevent path traversals; contents of cabinet files are always
    extracted below the extraction point and cannot escape it. Closes:
    #774580. This is CVE-2015-0552.

 -- Stephen Kitt <skitt@debian.org>  Tue, 06 Jan 2015 00:14:58 +0100

gcab (0.4-1) unstable; urgency=low

  * Initial release. Closes: #771253.

 -- Stephen Kitt <skitt@debian.org>  Sat, 29 Nov 2014 00:12:00 +0100
