faad2 (2.8.0~cvs20161113-1+deb9u3) stretch-security; urgency=high

  * Non-maintainer upload by the LTS Team.
  * CVE-2021-32274
    heap buffer overflow that might allow an attacker to execute code
  * CVE-2021-32276
    null pointer dereference that might allow an attacker to perform a DoS
  * CVE-2021-32277
    heap buffer overflow that might allow an attacker to execute code
  * CVE-2021-32278
    heap buffer overflow that might allow an attacker to execute code
  * CVE-2019-6956
    Buffer over read
  * CVE-2018-20360
    NULL pointer dereference
  * CVE-2018-20199
    NULL pointer dereference

 -- Thorsten Alteholz <debian@alteholz.de>  Sun, 24 Oct 2021 13:03:02 +0200

faad2 (2.8.0~cvs20161113-1+deb9u2) stretch-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * CVE-2018-20357, CVE-2018-20359, CVE-2018-20197, CVE-2018-20194,
    CVE-2018-19503, CVE-2018-20361: multiple memory corruption vulnerabilities
    caused by insufficiently sanitized frequency band borders.
  * CVE-2018-20358, CVE-2018-20362, CVE-2018-19504, CVE-2018-20195,
    CVE-2018-20198: multiple memory corruption vulnerabilities caused by syntax
    element inconsistencies (implicit channel mapping reconfiguration).
  * CVE-2019-15296: buffer overflow in faad_resetbits.
  * CVE-2018-19502: heap based buffer overfow in excluded_channels
    (libfaad/syntax.c) (Closes: #914641).

 -- Hugo Lefeuvre <hle@debian.org>  Fri, 06 Sep 2019 18:52:19 +0200

faad2 (2.8.0~cvs20161113-1+deb9u1) stretch; urgency=high

  * Non-maintainer upload.
  * Fix CVE-2017-9218, CVE-2017-9219, CVE-2017-9220, CVE-2017-9221,
    CVE-2017-9222, CVE-2017-9223, CVE-2017-9253, CVE-2017-9254, CVE-2017-9255,
    CVE-2017-9256, CVE-2017-9257.
    Various issues were discovered in faad2, a fast audio decoder, that could
    cause a denial of service (large loop and CPU consumption) via a crafted
    mp4 file. (Closes: #889915)

 -- Markus Koschany <apo@debian.org>  Tue, 01 May 2018 17:49:02 +0200

faad2 (2.8.0~cvs20161113-1) unstable; urgency=medium

  * New upstream CVS snapshot.
    + Fixes implicit SBR detection via AudioSpecificConfig
      on systems with unsigned char (Closes: #843173).
  * Change Uploaders field to use my Debian account.

 -- Fabian Greffrath <fabian@debian.org>  Sun, 13 Nov 2016 17:45:15 +0100

faad2 (2.8.0~cvs20150510-1) unstable; urgency=medium

  * New upstream CVS snapshot.
    + Does not crash when given ADTS AAC file with large ID3v2 tag anymore,
      thanks Mike Crowe for the bug report and patch (Closes: #689712).
    + Does not crash with the Mayhem testcase anymore, thanks Alexandre Rebert
      for the bug report (Closes: #715882).
  * Add debian/README.source to document how the Debian source tarball was
    created and force xz compression in debian/gbp.conf.
  * Remove all patches that were either applied, solved differently or
    disapproved upstream:
    + autotools-compat.patch: Disapproved upstream.
    + noinst-mp4ff.patch: Applied upstream.
    + manpage.patch: Applied upstream.
    + incorrect_pointer_size.patch: Does not apply anymore.
    + bpa-stdin.patch: Applied upstream.
    + path_max.patch: Applied upstream.
    + fix_ftbfs_with_gcc4.5.patch: Disapproved upstream.
    + symbol-visibility.patch: Does not apply anymore.
    + libfaad-drm.patch: Applied upstream.
  * Ship upstream's own frontend and API documentation manpages.
  * Update Debian packaging copyright years.
  * Remove '__DATE__' CPP macro for reproducible builds.

 -- Fabian Greffrath <fabian+debian@greffrath.com>  Mon, 11 May 2015 13:59:49 +0200

faad2 (2.7-9) unstable; urgency=medium

  * Build the DRM version of the library as well as the normal version,
    thanks Julian Cable for the idea and the patch!
  * Remove Andres Mejia from Uploaders (Closes: #743545).
  * Remove "DM-Upload-Allowed" field from debian/control.
  * Mark the faad2-dbg package as "Multi-Arch: same" and
    remove faad ("Multi-Arch: no") from its Dependencies.
  * Remove debian/source/local-options, they are default now.
  * Add faad.lintian-overrides for a spelling error that is used
    in the id3 specification.
  * Fix "vcs-field-not-canonical" lintian warning.
  * Fix "'visibility' attribute ignored on non-class types" compiler warnings
    introduced by our symbol versioning patch.
  * Fix most autotools warnings.
  * Bump "Standards-Version" to 3.9.6.
  * Run "wrap-and-sort -asb".
  * Add extensive API documentation in libfaad.3, courtesy of Julian Cable.

 -- Fabian Greffrath <fabian+debian@greffrath.com>  Thu, 30 Apr 2015 18:04:42 +0200

faad2 (2.7-8) unstable; urgency=low

  [ Fabian Greffrath ]
  * debian/patches/path_max.patch:
    + Dynamically allocate file name buffers,
      instead of relying on PATH_MAX.
  * Set appropriate symbol visibility attributes.
  * Rebuild autofoo with dh-autoreconf.
  * Add debian/libfaad2.symbols file.
  * Multi-Archify.
  * Remove redundant license blurb from debian/copyright.
  * libmp4ff ist not packaged, so do not install it either.
  * Simplify debian/*.install accordingly.

  [ Andres Mejia ]
  * Make dev package multiarch installable.
  * Bump to Standards-Version 3.9.3.

 -- Andres Mejia <amejia@debian.org>  Sun, 18 Mar 2012 09:07:55 -0400

faad2 (2.7-7) unstable; urgency=low

  [ Andres Mejia ]
  * Update to my @debian.org email.
  * Update gbp.conf.
  
  [ Reinhard Tartler ]
  * Update Vcs-Browser field
  * bump standards version (no changes needed)

  [ Fabian Greffrath ]
  * Convert to 3.0 (quilt) source format.
  * Re-enable two patches that got lost in the 2.7-6 upload:
    - debian/patches/bpa-stdin.patch
      + Apply SqueezeCenter patches from FreeBSD that enable streaming with
        BBCiPlayer and ezstream (LP: #470562).
    - debian/patches/path_max.patch
      + Extend file name buffers for longer path names (LP: #475050).
  * Merge patch from 2.7-6ubuntu1:
    - debian/patches/fix_ftbfs_with_gcc4.5.patch
      + Correctly declare lrintf in libfaad/common.h to avoid a conflict of
        declaration in mathcalls.h to fix FTBFS on i386
  * Improve debian/copyright.

 -- Fabian Greffrath <fabian+debian@greffrath.com>  Wed, 03 Aug 2011 14:19:49 +0200

faad2 (2.7-6) unstable; urgency=high

  [ Alessio Treglia ]
  * Fix segmentation fault in faad due to an incorrect pointer size
    (Closes: #603807, LP: #665802).
  * Add gbp config file.

  [ Andres Mejia ]
  * Revert changes in 2.7-5. Upload of 2.7-5 was unintentionally done.
  * Refresh patches.

 -- Andres Mejia <mcitadel@gmail.com>  Mon, 22 Nov 2010 19:17:36 -0500

faad2 (2.7-5) unstable; urgency=low

  * Update my e-mail address.
  * Apply SqueezeCenter patches from FreeBSD that enable streaming with
    BBCiPlayer and ezstream (LP: #470562).
  * Extend file name buffers for longer path names (LP: #475050).

 -- Fabian Greffrath <fabian+debian@greffrath.com>  Mon, 16 Aug 2010 16:43:14 +0200

faad2 (2.7-4) unstable; urgency=low

  * debian/control: Do not build the shared libmp4ff library packages
    anymore (Closes: #550679). The use of mp4ff from faad2 is discouraged
    by upstream, see <http://xbmc.org/trac/ticket/6882#comment:15>.
  * Removed debian/patches/force-include-stdint_h.patch.
  * Removed debian/patches/libmp4ff-shared-lib.patch.
  * Removed debian/patches/70_automake-1.9.patch.
  * Added debian/README.source.
  * Bumped Standards-Version to 3.8.3.
  * Raised Build-Depends to debhelper (>= 7.0.50~), thanks lintian.
  * Removed debian/libmp4ff-dev.install and debian/libmp4ff0.install.
  * Removed libmp4ff0 from Depends for faad2-dbg.

 -- Fabian Greffrath <fabian@debian-unofficial.org>  Mon, 26 Oct 2009 12:04:41 +0100

faad2 (2.7-3) UNRELEASED; urgency=low

  * debian/patches/force-include-stdint_h.patch: New patch to force
    inclusion of stdint.h (Closes: #550679).

 -- Fabian Greffrath <fabian@debian-unofficial.org>  Thu, 15 Oct 2009 18:00:41 +0200

faad2 (2.7-2) unstable; urgency=low

  * upload to unstable.

 -- Reinhard Tartler <siretart@tauware.de>  Wed, 16 Sep 2009 21:07:45 +0200

faad2 (2.7-1) experimental; urgency=low

  [ Andres Mejia ]
  * New upstream release. (Closes: #515072)
  * Verified all patches are either applied upstream, or a different
    implementation is used.
    + (Closes: #505901)
    + (Closes: #503657)
  * Switch to quilt.
  * Add -DPIC for CFLAGS.
  * Don't include dpatch.make in debian/rules.
  * Update watch file to default DEHS would use.
  * Bump to using debhelper 7.
  * Use quilt (>= 0.46-7).
  * Update control file.
  * Add DM-Upload-Allowed: yes field.
  * Don't include dummy package anymore.
  * Add in description for libfaad2 that it contains shared library.
  * Move libfaad-dev to the front to be 'default' package debhelper acts
    on.
  * Add ${misc:Depends} for all packages. Remove libc dev packages from
    Depends.
  * Add debug packages. (Closes: #516680)
  * Rewrite debian/rules to use new debhelper and quilt.
  * Rename <package>.files to <package>.install. Be more specific what
    to include in libfaad-dev. Also include .install files for other packages.
  * Add libmp4ff-dev package.
  * Don't include version for rename of libfaad package. Place all debug
    symbols  for binary packages in faad2-dbg.
  * Modify description for libmp4ff-dev.
  * Update address to FSF in debian/copyright.
  * Fix hyphen in manpage. Fixes lintian warning as well.
  * Patch faad2 to create a shared lib for libmp4ff. (Closes: #485373)
  * Allow to pass in more CFLAGS via DEB_CFLAGS.
  * Add in DRM (Digital Radio Mondiale) support.
  * Add Build-Depends of automake, autoconf, and autotools-dev.

  [ Fabian Greffrath ]
  * Add myself to Uploaders.
  * Clean up Build-Depends: libid3-dev was only needed for the obsolete
    XMMS plugin, autotools stuff shouldn't be needed at all.
  * Untagle library file names in the install rules.
  * Revert overriding of CFLAGS, dpkg-buildpackage will choose
    appripriate settings. Revert running the entire autoreconf sequence
    before calling ./configure. Build without DRM support, it has proven
    to break base functionality.
  * Clean up watch file.
  * Make faad2-dbg and libmp4ff-dev depend on libmp4ff0.
  * Improve short description for the libmp4ff\* packages.
  * debian/patches/70_automake-1.9.patch: New patch, run automake-1.9 to
    regenerate Makefile.in with the changes introduced by
    debian/patches/libmp4ff-shared-lib.patch.
  * Do not ship .la files in the development packages.
  * Add reasonable defaults to CFLAGS/CXXFLAGS.

 -- Fabian Greffrath <fabian@debian-unofficial.org>  Wed, 03 Jun 2009 11:02:00 +0200

faad2 (2.6.1-3.1) unstable; urgency=high

  * Non-maintainer upload by the security team
  * Include upstream patch to fix heap overflow in the frontend code
    (Closes: #499899)

 -- Steffen Joeris <white@debian.org>  Fri, 26 Sep 2008 12:02:35 +0000

faad2 (2.6.1-3) unstable; urgency=low

  * Closes: #479802: Update man page to reflect on raw PCM is supported on
    standard out. Also, have faad fail on trying to send non-raw PCM to
    standard out.
  * Apply new knowledge about the differences between hyphens, en-dashes, and
    em-dashes to man pages.
  * Move faad man page to patch system.
  * Update standards version.
  * Add license declarations and copyright declarations to copyright file.
    Tidy up authors.

 -- Matthew W. S. Bell <matthew@bells23.org.uk>  Thu, 19 Jun 2008 02:35:47 +0100

faad2 (2.6.1-2) unstable; urgency=low

  * Remove XMMS plugin as XMMS is being removed (Closes: #456724)

 -- Matthew W. S. Bell <matthew@bells23.org.uk>  Fri, 21 Dec 2007 00:04:17 +0000

faad2 (2.6.1-1) unstable; urgency=low

  * Import new upstream version containing new license text
    (Closes: #451948)
  * Change build system to call autoreconf at build time, as
    upstream no longer ships generated files
  * Update debian/copyright to reflect new license text
  * Remove Build-Depends on libsndfile1-dev (Closes: #452362)

 -- Matthew W. S. Bell <matthew@bells23.org.uk>  Wed, 28 Nov 2007 23:45:05 +0000

faad2 (2.6-1) unstable; urgency=low

  * Import new 2.6 release. Includes several small off-by-one scale
    fixes.
  * Update the copyright as new code includes a clarification of the license 
    text, which indicates that the entire work is under the GPLv2 (closes:
    #419339).

 -- Matthew W. S. Bell <matthew@bells23.org.uk>  Mon, 15 Oct 2007 00:16:21 +0100

faad2 (2.5-5) unstable; urgency=low

  * Make packages depends bin-NMU safe

 -- Matthew W. S. Bell <matthew@bells23.org.uk>  Fri, 17 Aug 2007 16:07:59 +0100

faad2 (2.5-4) unstable; urgency=low

  * Add mp4ff headers to libfaad-dev package (Closes: 409648) 

 -- Matthew W. S. Bell <matthew@bells23.org.uk>  Fri, 11 May 2007 19:44:22 +0100

faad2 (2.5-3) unstable; urgency=low

  * Add patch to stabilise/sanitise headers (Closes: 404279)
  * Port several fixes from Ubuntu
  * Add an mp4ff static library

 -- Matthew W. S. Bell <matthew@bells23.org.uk>  Sun, 15 Apr 2007 04:23:35 +0100

faad2 (2.5-2) unstable; urgency=low

  * add xmms-mp4 desription read not like nonsense (Closes: #399457)
  * Compile without Digital Radio Mondiale support, as it breaks base
    functionality
  * Update debian/copyright (See: #403117)

 -- Matthew W. S. Bell <m.bell@bvrh.co.uk>  Mon,  4 Dec 2006 19:56:22 +0000

faad2 (2.5-1) unstable; urgency=low

  * Call make install with DESTDIR instead of prefix
  * Change configure/Makefile to provide xmms config differently
  * Add manual page for faad utility
  * Call make uninstall in clean
  * Add dummy libfaad2-0 pacakge to satisfy some third-party dependencies
  * Upload into main (Closes: #306366) 

 -- Matthew W. S. Bell <m.bell@bvrh.co.uk>  Wed, 18 Oct 2006 23:41:32 +0100

faad2 (2.5-0.0) unstable; urgency=low

  * New upstream release.
  * Add drm (Digital Radio Mondiale) support.

 -- Christian Marillat <marillat@debian.org>  Wed,  6 Sep 2006 20:18:25 +0200

faad2 (2.0.0+cvs20060416-0.1) unstable; urgency=low

  * Rebuild for amd64.

 -- Christian Marillat <marillat@debian.org>  Sat, 13 May 2006 08:58:34 +0200

faad2 (2.0.0+cvs20060416-0.0) unstable; urgency=low

  * CVS release.

 -- Christian Marillat <marillat@debian.org>  Sun, 16 Apr 2006 17:15:00 +0200

faad2 (2.0.0-0.7) unstable; urgency=low

  * Rebuild for gcc 4.0

 -- Christian Marillat <marillat@debian.org>  Sat, 16 Jul 2005 17:34:28 +0200

faad2 (2.0.0-0.6) unstable; urgency=low

  * New patch from Gentoo to fix amd64 problem with some files. Thanks to
    Carl Schneidinger.

 -- Christian Marillat <marillat@debian.org>  Fri, 20 May 2005 18:42:23 +0200

faad2 (2.0.0-0.5) unstable; urgency=low

  * Apply patch from Arnaud Rouanet to fix the -w option in faad.

 -- Christian Marillat <marillat@debian.org>  Mon, 21 Mar 2005 10:13:05 +0100

faad2 (2.0.0-0.4) unstable; urgency=low

  * New patch 04_mp4ff.h to replace "mp4ff_int_types.h" include by <stdint.h>

 -- Christian Marillat <marillat@debian.org>  Wed,  9 Mar 2005 08:59:35 +0100

faad2 (2.0.0-0.3) unstable; urgency=low

  * Add libfaac-dev in Build-Depends.
  * Little hack to not build the mpeg4ip plugin.

 -- Christian Marillat <marillat@debian.org>  Wed, 26 Jan 2005 07:36:25 +0100

faad2 (2.0.0-0.2) unstable; urgency=low

  * Build with libmp4
  * Add new package xmms-mp4

 -- Christian Marillat <marillat@debian.org>  Mon, 25 Oct 2004 10:19:52 +0200

faad2 (2.0.0-0.1) unstable; urgency=low

  * Really apply my patch to link against -lm

 -- Christian Marillat <marillat@debian.org>  Thu, 29 Jul 2004 15:48:22 +0200

faad2 (2.0.0-0.0) unstable; urgency=low

  * New upstream release.

 -- Christian Marillat <marillat@debian.org>  Sun,  4 Jul 2004 00:26:23 +0200

faad2 (2.0-rc3-0.0) unstable; urgency=low

  * New upstream release.

 -- Christian Marillat <marillat@debian.org>  Tue,  9 Dec 2003 10:57:01 +0100

faad2 (1.1-0.0) unstable; urgency=low

  * Initial Release.

 -- Christian Marillat <marillat@debian.org>  Sun, 29 Dec 2002 23:09:33 +0100

