2017-04-14 - Salvatore Bonaccorso <carnil@debian.org>
libxslt (1.1.28-2+deb8u3) jessie; urgency=medium
* Non-maintainer upload.
* Check for integer overflow in xsltAddTextString (CVE-2017-5029)
(Closes: #858546)
2016-11-06 - Salvatore Bonaccorso <carnil@debian.org>
libxslt (1.1.28-2+deb8u2) jessie-security; urgency=high
* Non-maintainer upload by the Security Team.
* Fix heap overread in xsltFormatNumberConversion (CVE-2016-4738)
(Closes: #842570)
2016-06-18 - Salvatore Bonaccorso <carnil@debian.org>
libxslt (1.1.28-2+deb8u1) jessie-security; urgency=high
* Non-maintainer upload by the Security Team.
* Fix for type confusion in preprocessing attributes (CVE-2015-7995)
(Closes: #802971)
* Always initialize EXSLT month and day to 1
* Fix use-after-free in xsltDocumentFunctionLoadDocument
* Fix xsltNumberFormatGetMultipleLevel (CVE-2016-1683)
* Round xsl:number values to nearest integer
* Handle negative xsl:number values
* Lower bound for format token "a"
* Lower and upper bound for format token "i" (CVE-2016-1684)
* Fix double free in libexslt hash functions
* Fix buffer overflow in exsltDateFormat
* Fix OOB heap read in xsltExtModuleRegisterDynamic
2013-08-01 - Aron Xu <aron@debian.org>
libxslt (1.1.28-2) unstable; urgency=low
* debian/patches/000[4-8].patch:
Upstream post release patches.
2013-08-01 - Aron Xu <happyaron.xu@gmail.com>
libxslt (1.1.28-1) experimental; urgency=low
[ YunQiang Su ]
* Imported Upstream version 1.1.28
* Workaround xsltMaxVars version number (Closes: #698955)
* Refresh patches
* Correct email address of YunQiang Su
* Mark libxslt1-dev as Multi-Arch: same (Closes: #689091)
[ Aron Xu ]
* Use canonical VCS-* fields.
* Remove unused override: python-libxslt1-dbg: hardening-no-relro
2012-10-03 - Aron Xu <aron@debian.org>
libxslt (1.1.27-1) experimental; urgency=low
* New upstream release (Closes: #448205, #683353)
* debian/rules:
+ Add hardening flags for dbg package in LDFLAGS (Closes: #681163)
* debian/control:
- std-ver: 3.9.3 -> 3.9.4, no change required.
2012-07-05 - Aron Xu <aron@debian.org>
libxslt (1.1.26-13) unstable; urgency=low
* Patch to fix CVE-2012-2825 (Closes: #679283).
2012-05-29 - Aron Xu <aron@debian.org>
libxslt (1.1.26-12) unstable; urgency=low
[ Aron Xu ]
* New maintainer (Closes: #654177)
* debian/rules: small improvements, stop shipping .la files.
* debian/control: mark libxslt1-dev as not M-A (Closes: #671902).
[ YunQiang Su ]
* Convert to 3.0 source format.
* Byte-compile Python modules again (Closes: #671901).
2012-05-06 - Michael Gilbert <mgilbert@debian.org>
libxslt (1.1.26-11) unstable; urgency=low
* QA upload.
* Bump standards version to 3.9.3.
* Apply Steve Langasek's patch to enable multiarch (closes: #643034).
* Fix cve-2011-3970: out-of-bounds array access issue (closes: #660650).
* Bump debian/compat to 9 and enable hardened build flags (closes: #655601).
* Eliminate system config.sub and config.guess from the debian diff
(closes: #670799).
2012-05-06 - Thorsten Glaser <tg@mirbsd.de>
libxslt (1.1.26-10) unstable; urgency=low
* QA upload.
* Fix building for real: (Closes: #666333)
- make(1) targets accumulate, they do not replace
- You absolutely must not have a build-% (wildcard) target!
- Never have a directory (or file) with the same name as a
(phony) target, as it *will* prevent the target from being
run while that file/directory exists, with varying messages
=> rename ./build/ to builddir and build-% to dobuild-%
Discovered while trying to hand-fix an m68k build.
* Throw in some lintian fixes (manpage, spelling) for good measure.