Salvatore Bonaccorso authored Jan 28, 2019 and Laurent Bigonville committed Aug 06, 2019

spice (0.14.0-1.3) unstable; urgency=medium

  * Non-maintainer upload.
  * memslot: Fix off-by-one error in group/slot boundary check (CVE-2019-3813)
    (Closes: #920762)

Salvatore Bonaccorso authored Oct 11, 2018 and Laurent Bigonville committed Aug 06, 2019

spice (0.14.0-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * tests/pki: Use CA/certificate with 2048 bit RSA keys (Closes: #910634)

Salvatore Bonaccorso authored Sep 15, 2018 and Laurent Bigonville committed Aug 06, 2019

spice (0.14.0-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix flexible array buffer overflow (CVE-2018-10873) (Closes: #906315)

with Debian dir c412b404349ce41e1c938f117c82f3ba90481f82

spice (0.13.90-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * debian/rules: Disable parallel building for the tests, this will hopefully
    fix FTBFS on some arch (Closes: #876266)

debian/control: Add the needed gstreamer modules to the (build-)dependencies to enable gstreamer support

debian/rules: Drop override_dh_installdocs, this was only needed when we were building the -dbg package ourself

Also drop debian/patches/stop-linking-with-libcacard.diff, we are removing the
.private entries all together, so this is not needed

* New upstream release (Closes: #849569)
  - Adjust the build-dependencies
  - Drop d/p/CVE-2016-9577-and-CVE-2016-9578.patch,
    d/p/CVE-2017-7506-1.patch, d/p/CVE-2017-7506-2.patch,
    d/p/CVE-2017-7506-3.patch: All merged upstream
  - Drop debian/patches/fix-tests-warnings.patch, unused

with Debian dir 5c6852118fb609d29349f4a25acbe86368d11ecf

spice (0.12.8-2.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix CVE-2017-7506: (Closes: #868083)
    Possible buffer overflow via invalid monitor configurations.

Markus Koschany authored Feb 13, 2017 and Laurent Bigonville committed Jul 17, 2017

spice (0.12.8-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add CVE-2016-9577-and-CVE-2016-9578.patch:
    - CVE-2016-9577: A buffer overflow vulnerability in
      main_channel_alloc_msg_rcv_buf was found that occurs when reading large
      messages due to missing buffer size check.
    - CVE-2016-9578: A vulnerability was discovered in the server's
      protocol handling. An attacker able to connect to the spice server could
      send crafted messages which would cause the process to crash.
      (Closes: #854336)

Upstream version 0.12.8