libvpx (1.3.0-3+deb8u4) jessie-security; urgency=high

  * Non-maintainer upload by the ELTS Security Team.
  * CVE-2023-5217: Heap buffer overflow in vp8 encoding allowed a remote
    attacker to potentially exploit heap corruption via a crafted HTML
    page. (Closes: #1053182)

 -- Sylvain Beucler <beuc@debian.org>  Sat, 30 Sep 2023 17:25:42 +0200

libvpx (1.3.0-3+deb8u3) jessie-security; urgency=high

  * CVE-2020-0034: Fix an out-of-bounds buffer read on truncated key frames.

 -- Chris Lamb <lamby@debian.org>  Sun, 08 Mar 2020 14:49:21 -0700

libvpx (1.3.0-3+deb8u2) jessie-security; urgency=medium

  * Non-maintainer upload by the LTS Security Team.
  * Fix CVE-2019-9433.
  * Fix CVE-2019-9232.

 -- Dylan Aïssi <daissi@debian.org>  Tue, 26 Nov 2019 21:44:40 +0100

libvpx (1.3.0-3+deb8u1) jessie-security; urgency=high

  * Fix OOB caused by odd frame width (CVE-2017-13194)

 -- Ondřej Nový <onovy@debian.org>  Wed, 28 Feb 2018 21:24:34 +0100

libvpx (1.3.0-3) unstable; urgency=high

  * debian/control:
    + Add VP9 to the short and long package descriptions (Closes: #760095).
  * debian/patches/vp9-out-of-bounds-access.patch:
    + Fix out of bounds access in the VP9 codec (CVE-2014-1578) (Closes: #765435).

 -- Sebastian Dröge <slomo@debian.org>  Tue, 21 Oct 2014 10:02:18 +0200

libvpx (1.3.0-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Build using the default GCC. Closes: #751318.
  * Move doxygen and php5-cli to B-D-I (Peter Pentchev). Closes: #726485.
  * Build using hardening defaults. Closes: #674570.
  * Apply bug fix for ssse3 quantize function.

 -- Matthias Klose <doko@debian.org>  Sat, 09 Aug 2014 14:38:23 +0200

libvpx (1.3.0-2) unstable; urgency=medium

  * debian/control,
    debian/rules:
    + Build with gcc 4.8 to fix FTBFS on SPARC (Closes: #734445).

 -- Sebastian Dröge <slomo@debian.org>  Tue, 07 Jan 2014 11:25:31 +0100

libvpx (1.3.0-1) unstable; urgency=medium

  * New upstream release, including VP9 support:
    + debian/patches/fix-armhf-link.patch:
      - Refresh patch.
    + debian/rules,
      debian/libvpx1.symbols:
      - Update shlibs version and symbols file for API additions.

 -- Sebastian Dröge <slomo@debian.org>  Tue, 17 Dec 2013 18:20:51 +0100

libvpx (1.2.0-2) unstable; urgency=low

  * debian/rules,
    debian/patches/fix-armhf-link.patch:
    + Fix build on ARM by using the correct compiler and CFLAGS.

 -- Sebastian Dröge <slomo@debian.org>  Mon, 27 May 2013 13:08:06 +0200

libvpx (1.2.0-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/*: Refreshed to apply cleanly again.

 -- Sebastian Dröge <slomo@debian.org>  Sun, 26 May 2013 10:39:18 +0200

libvpx (1.1.0-1) unstable; urgency=low

  * New upstream release, "Eider".
  * debian/patches/*: Refreshed to apply cleanly again.
  * debian/rules: Update shlibs version for API additions.

 -- Sebastian Dröge <slomo@debian.org>  Mon, 14 May 2012 10:03:37 +0200

libvpx (1.0.0-2) unstable; urgency=low

  * debian/control,
    debian/libvpx1.install,
    debian/libvpx-dev.install,
    debian/rules:
    + Add support for multi-arch (Closes: #643016).
      Thanks to Riku Voipio for the patch.
  * debian/rules,
    debian/patches/fix-armhf-link.patch:
    + Add NEON flavor on arm (Closes: #660692).
      Thanks to Riku Voipio for the patch.

 -- Sebastian Dröge <slomo@debian.org>  Tue, 21 Feb 2012 12:15:36 +0100

libvpx (1.0.0-1.1) unstable; urgency=high

  * Non-maintainer upload.
  * Drop binaries from the debug package, to stop libvpx0-dbg and
    libvpx1-dbg from conflicting with each other (Closes: #658453).
  * Set urgency to “high” for the RC bug fix, to speed up things with
    packages (involved in other transitions) having picked up a
    dependency on libvpx1 due to this unannounced transition.

 -- Cyril Brulebois <kibi@debian.org>  Wed, 15 Feb 2012 22:40:09 +0100

libvpx (1.0.0-1) unstable; urgency=low

  * New upstream release, "Duclair":
    + debian/libvpx1.install,
      debian/libvpx1.symbols,
      debian/control,
      debian/rules:
      - Update for new soname.

 -- Sebastian Dröge <slomo@debian.org>  Wed, 01 Feb 2012 09:50:13 +0100

libvpx (0.9.7.p1-2) unstable; urgency=low

  * debian/rules,
    debian/libvpx-dev.install:
    + Install vpx.pc file in the -dev package. Thanks to
      j@v2v.cc for the patch (Closes: #644542).
  * debian/control,
    debian/vpx-tools.install:
    + Install vpxenc and vpxenc in the new vpx-tools package. Thanks
      to j@v2v.cc for the patch (Closes: #644543).

 -- Sebastian Dröge <slomo@debian.org>  Mon, 10 Oct 2011 09:42:49 +0200

libvpx (0.9.7.p1-1) unstable; urgency=low

  * New upstream bugfix release.

 -- Sebastian Dröge <slomo@debian.org>  Tue, 16 Aug 2011 15:35:26 +0200

libvpx (0.9.7-1) unstable; urgency=low

  * New upstream release, "Cayuga" (Closes: #636670):
    + debian/patches/01_enable-shared.patch:
      - Refreshed to apply cleanly again.
    + debian/rules:
      - Update shlibs version because of API additions.

 -- Sebastian Dröge <slomo@debian.org>  Tue, 09 Aug 2011 10:14:33 +0200

libvpx (0.9.6-1) unstable; urgency=low

  * New upstream release, "Bali":
    + debian/patches/02_cve-2010-4489.patch:
      - Dropped, merged upstream.

 -- Sebastian Dröge <slomo@debian.org>  Tue, 08 Mar 2011 17:58:26 +0100

libvpx (0.9.5-2) unstable; urgency=low

  * Upload to unstable.
  * debian/patches/02_cve-2010-4489.patch:
    + SECURITY -- CVE 2010-4489: Fix integer overflow in decoder
      Patch taken from upstream GIT (Closes: #610510).

 -- Sebastian Dröge <slomo@debian.org>  Tue, 08 Feb 2011 11:59:42 +0100

libvpx (0.9.5-1) experimental; urgency=low

  * New upstream release:
    + debian/patches/01_enable-shared.patch:
      - Refreshed.
    + debian/rules:
      - Enable altivec assembly for powerpc.
    + debian/libvpx0.symbols,
      debian/rules:
      - Update for API additions.

 -- Sebastian Dröge <slomo@debian.org>  Fri, 29 Oct 2010 08:36:14 +0200

libvpx (0.9.2-1) experimental; urgency=low

  * New upstream release:
    + debian/patches/01_enable-shared.patch:
      - Refreshed.

 -- Sebastian Dröge <slomo@debian.org>  Tue, 07 Sep 2010 23:12:53 +0200

libvpx (0.9.1-1) unstable; urgency=low

  * New upstream release.

 -- Sebastian Dröge <slomo@debian.org>  Fri, 18 Jun 2010 06:00:58 +0200

libvpx (0.9.0+git-2010-06-15-13-41-2) unstable; urgency=low

  * debian/patches/01_enable-shared.patch:
    + Allow shared library build everywhere, fixes FTBFS.
  * debian/rules:
    + Enable assembly optimizations for kfreebsd and hurd too.

 -- Sebastian Dröge <slomo@debian.org>  Wed, 16 Jun 2010 13:07:32 +0200

libvpx (0.9.0+git-2010-06-15-13-41-1) unstable; urgency=low

  * New upstream GIT snapshot:
    + Fixes enormous amount of virtual memory used by the library,
      causing problems on 32 bit architectures (Closes: #583765).
    + Replaces non-free MD5 implementation with a free one (Closes: #585821).
    + debian/rules:
      - Update for build system changes, especially for the shared library
        support that is upstream now.

 -- Sebastian Dröge <slomo@debian.org>  Wed, 16 Jun 2010 07:17:13 +0200

libvpx (0.9.0-6) unstable; urgency=low

  * debian/patches/*:
    + Update to upstream GIT 09202d80716ef7e2931de60c66b6fb2383f52613.
  * debian/copyright:
    + Update for the new, improved and GPL compatible
      license (Closes: #583758).

 -- Sebastian Dröge <slomo@debian.org>  Fri, 04 Jun 2010 22:34:15 +0200

libvpx (0.9.0-5) unstable; urgency=low

  * debian/copyright:
    + Use new FSF address.
  * debian/patches/*:
    + Update to upstream GIT 1689564bb5c0f03bb2f35244bf40bcf58c9fec35.
  * debian/rules,
    debian/control:
    + Remove execstack and -fPIC hacks that were fixed upstream.
  * debian/vpx_codec.h.patch,
    debian/rules:
    + Remove HAVE_CONFIG_H removal hack for the public header files.

 -- Sebastian Dröge <slomo@debian.org>  Sat, 29 May 2010 07:29:58 +0200

libvpx (0.9.0-4) unstable; urgency=low

  * debian/rules:
    + x86 is i386, this enables assembly optimizations on i386.
  * debian/control:
    + Build depend on yasm >= 0.7.
  * debian/copyright:
    + Add all the other copyright holders and licenses to the copyright
      file. These only apply to the scripts in examples/includes, which
      are used for building the API documentation.

 -- Sebastian Dröge <slomo@debian.org>  Sat, 22 May 2010 12:10:35 +0200

libvpx (0.9.0-3) unstable; urgency=low

  * debian/rules:
    + Always build with -fPIC, configure doesn't set it for the
      generic-gnu target.
  * debian/copyright,
    debian/control:
    + Fix download URLs.

 -- Sebastian Dröge <slomo@debian.org>  Thu, 20 May 2010 12:56:42 +0200

libvpx (0.9.0-2) unstable; urgency=low

  * debian/rules:
    + Fix shlibs version.

 -- Sebastian Dröge <slomo@debian.org>  Wed, 19 May 2010 22:20:14 +0200

libvpx (0.9.0-1) unstable; urgency=low

  * Initial Debian packaging (Closes: #582271).

 -- Sebastian Dröge <slomo@debian.org>  Tue, 18 May 2010 20:49:11 +0200

