libheif (1.17.6-1ubuntu4.8) noble-security; urgency=medium

  * SECURITY UPDATE: Heap out-of-bounds write in uncompressed encoder.
    - debian/patches/CVE-2026-62291.patch: Validate component plane sizes
      against primary image dimensions and propagate encode errors in
      libheif/uncompressed_image.cc, libheif/uncompressed_image.h,
      libheif/context.cc.
    - CVE-2026-62291

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 25 Aug 2026 12:17:59 -0600

libheif (1.17.6-1ubuntu4.7) noble-security; urgency=medium

  * SECURITY UPDATE: Integer underflow in Fraction constructor via double clap
    transform application
    - debian/patches/CVE-2026-62289.patch: Fix clap transform double-application
      in image tiling in libheif/box.cc, libheif/context.cc,
      tests/CMakeLists.txt, tests/clap_zero_size.cc.
    - CVE-2026-62289

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 17 Aug 2026 14:21:20 -0400

libheif (1.17.6-1ubuntu4.6) noble-security; urgency=medium

  * SECURITY UPDATE: Integer overflow when parsing uncC.
    - debian/patches/CVE-2026-47709.patch: Prevent integer overflow
      when parsing uncC in libheif/uncompressed_image.cc
    - CVE-2026-47709
  * SECURITY UPDATE: Integer overflow in inline mask size calculation
    - debian/patches/CVE-2026-47714.patch: Fix computation of size of inline
      region mask in libheif/region.cc
    - CVE-2026-47714

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 13 Jul 2026 16:00:17 -0600

libheif (1.17.6-1ubuntu4.5) noble; urgency=medium

  * d/p/do-not-stop-with-error-when-items-are-referenced-tha.patch,
    d/p/libheif-support-shared-alpha-thumbnails-and-content-.patch:
    - Backport upstream support for shared auxiliary image references
      (alpha, thumbnails, metadata), fixing "Too many auxiliary image
      references" errors when reading iOS 18 HEIC files. (LP: #2091957)
  * d/p/fix-check-whether-Exif-IFD-table-fits-within-given-m.patch
    - Backport upstream fix for inverted EXIF IFD bounds check that
      prevented the orientation tag from being reset after pixel
      rotation, causing double-rotation in converted images.

 -- Charles <charles05@canonical.com>  Tue, 30 Jun 2026 08:58:32 +0100

libheif (1.17.6-1ubuntu4.4) noble-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow when reading mask image.
    - debian/patches/CVE-2026-32741.patch: Fix possible buffer overflow when
      reading mask image in libheif/image-items/mask_image.cc
    - CVE-2026-32741
  * SECURITY UPDATE: Information leak in decode.
    - debian/patches/CVE-2026-32814.patch: Initialize allocated memory to
      avoid information leak in libheif/pixelimage.cc
    - CVE-2026-32814
  * SECURITY UPDATE: Heap overflow in HeifPixelImage.
    - debian/patches/CVE-2026-32882.patch: Fix overlay image with alpha
      channels with stride different from color channel in
      libheif/pixelimage.cc
    - CVE-2026-32882

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 16 Jun 2026 17:16:55 -0600

libheif (1.17.6-1ubuntu4.3) noble; urgency=medium

  * d/control: Demote libheif-plugin-libde265 to Suggests. (lp: #2142762)

 -- Charles <charles05@canonical.com>  Thu, 26 Feb 2026 12:28:49 +0000

libheif (1.17.6-1ubuntu4.2) noble-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2024-25269.patch: Fix memory leaks in function
      JpegEncoder::Encode
    - CVE-2024-25269
  * SECURITY UPDATE: Buffer Overflow
    - debian/patches/CVE-2025-68431.patch: Fix wrong copy width in
      overlay images, thanks to Aldo Ristori
    - CVE-2025-68431

 -- Bruce Cable <bruce.cable@canonical.com>  Wed, 07 Jan 2026 17:41:16 +1100

libheif (1.17.6-1ubuntu4.1) noble-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds data read/write in ImageOverlay::parse()
    - debian/patches/CVE-2024-41311.patch: added patch to check that
      overlay's offsets are valid
    - CVE-2024-41311

 -- Shishir Subedi <shishir.subedi@canonical.com>  Mon, 21 Oct 2024 16:33:55 +0545

libheif (1.17.6-1ubuntu4) noble; urgency=medium

  * d/control: update dependencies for the Main Inclusion Request (LP: #2061089):
    - Swap libheif-plugin-aomdec and libheif-plugin-dav1d.
    - Demote libheif-plugin-x265 to Suggests.

 -- Vladimir Petko <vladimir.petko@canonical.com>  Tue, 16 Apr 2024 20:36:05 +1200

libheif (1.17.6-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 07:49:51 +0000

libheif (1.17.6-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libpng16-16t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 29 Feb 2024 07:04:17 +0000

libheif (1.17.6-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Don't build rav1e plugin on i386, rust not available there.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 27 Dec 2023 16:51:27 +0100

libheif (1.17.6-1) unstable; urgency=medium

  * New upstream version 1.17.6
  * Fixes CVE-2023-49460, CVE-2023-49462, CVE-2023-49463,
    CVE-2023-49464 (Closes: #1059151).
  * Remove patch now applied upstream.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 21 Dec 2023 10:45:41 +0100

libheif (1.17.4-1ubuntu1) noble; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - Don't build rav1e plugin on i386, rust not available there.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 14 Dec 2023 16:25:59 +0100

libheif (1.17.4-1) unstable; urgency=medium

  * New upstream version 1.17.4
  * Add patch to fix installing thumbnailer file.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 21 Nov 2023 10:03:52 +0100

libheif (1.17.1-1ubuntu3) noble; urgency=medium

  * Rebuild against new libdav1d7.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 07 Nov 2023 09:20:51 +0100

libheif (1.17.1-1ubuntu2) noble; urgency=medium

  * Rebuild against latest svt-av1

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 27 Oct 2023 19:40:47 -0400

libheif (1.17.1-1ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Don't build rav1e plugin on i386, rust not available there.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 26 Oct 2023 08:53:24 +0200

libheif (1.17.1-1) unstable; urgency=medium

  * New upstream version 1.17.1

 -- Joachim Bauch <bauch@struktur.de>  Mon, 23 Oct 2023 11:04:57 +0200

libheif (1.17.0-1) unstable; urgency=medium

  * New upstream version 1.17.0
    - Fix loading of plugins in some cases (Closes: #1041242, #1043506)
  * Update symbols for new upstream version.
  * Update codec selection for new upstream version.
  * Build new codec plugins (ffmpegdec, jpeg{dec,enc}, j2k{dec,enc}).
  * Pass path to plugins when running tests.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 16 Oct 2023 14:30:23 +0200

libheif (1.16.2-3) unstable; urgency=medium

  * Team upload
  * Explicitly enable sharpyuv and have libheif-dev depend on libsharpyuv-dev
    per its pkgconfig file. Previously this was an automagic dependency
    and the pkgconfig file broke with a binNMU (Closes: #1052932)

 -- Jeremy Bícha <jbicha@ubuntu.com>  Sat, 30 Sep 2023 05:23:55 -0400

libheif (1.16.2-2ubuntu1) mantic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Don't build rav1e plugin on i386, rust not available there.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 20 Jul 2023 06:50:18 +0200

libheif (1.16.2-2) unstable; urgency=medium

  [ Pino Toscano ]
  * Enable the rav1e plugin only on archs where librav1e is available

  [ Fabian Greffrath ]
  * Let the libheif1 package depend on at least one HEIF and AVIF decoder plugin
    (Closes: #1040520)

 -- Joachim Bauch <bauch@struktur.de>  Mon, 17 Jul 2023 09:21:51 +0200

libheif (1.16.2-1ubuntu1) mantic; urgency=medium

  * Don't build rav1e plugin on i386, rust not available there.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 06 Jul 2023 15:21:26 +0200

libheif (1.16.2-1) unstable; urgency=medium

  [ Sebastian Ramacher ]
  * Use libgdk-pixbuf-2.0-dev
  * Set MA for heif-gdk-pixbuf and heif-thumbnailer (Closes: #981551)

  [ Joachim Bauch ]
  * New upstream version 1.16.2
  * Update symbols for new upstream version.
  * Build codecs as plugins and separate packages that are pulled using
    "Recommends".
  * Add codec plugins using "rav1e" and "svtenc".
  * Remove duplicate MA entry in heif-gdk-pixbuf.
  * d/rules: No need to override "dh_autoreconf", no longer used.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 20 Jun 2023 11:37:08 +0200

libheif (1.15.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.15.1
    - Fix CVE-2023-0996 (Closes: #1032101)
    - Do not fail if no plugin directory is available (Closes: #1029668)
  * debian/libheif1.symbols: Add new symbols
  * debian/*.install: Update for new upstream release

 -- Sebastian Ramacher <sramacher@debian.org>  Thu, 02 Mar 2023 00:09:34 +0100

libheif (1.14.2-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Apply multi-arch hints. + heif-gdk-pixbuf: Add Multi-Arch: same.

  [ Joachim Bauch ]
  * New upstream version 1.14.2
  * Update symbols for new upstream version.
  * Switch to cmake and use arch-dependent include directory.
  * Update "Standards-Version" to 4.6.2

 -- Joachim Bauch <bauch@struktur.de>  Tue, 17 Jan 2023 10:17:32 +0100

libheif (1.13.0-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Joachim Bauch ]
  * New upstream version 1.13.0
  * Update symbols for new upstream version.
  * Update "Standards-Version" to 4.6.1

 -- Joachim Bauch <bauch@struktur.de>  Fri, 02 Sep 2022 13:20:39 +0200

libheif (1.12.0-2) unstable; urgency=medium

  * Team upload
  * Upload to unstable

 -- Sebastian Ramacher <sramacher@debian.org>  Tue, 31 Aug 2021 22:37:31 +0200

libheif (1.12.0-1) experimental; urgency=medium

  * New upstream version 1.12.0
  * Update symbols for new upstream version.
  * Bump watch file to version 4.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 10 May 2021 15:51:05 +0200

libheif (1.11.0-1) unstable; urgency=medium

  * Imported Upstream version 1.11.0
  * Remove patch applied upstream.
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 02 Feb 2021 10:28:05 +0100

libheif (1.10.0-2) unstable; urgency=medium

  * Team upload
  * debian/control: Add missing Depends to libheif-dev (Closes: #978176)
  * debian/patches: Initialize valid_values to nullptr

 -- Sebastian Ramacher <sramacher@debian.org>  Sat, 02 Jan 2021 15:23:12 +0100

libheif (1.10.0-1) unstable; urgency=medium

  * Imported Upstream version 1.10.0
  * Update "Standards-Version" to 4.5.1
  * Remove patch applied upstream.
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Wed, 16 Dec 2020 17:23:17 +0100

libheif (1.9.1-1) unstable; urgency=medium

  * Imported Upstream version 1.9.1
  * Update symbols for new upstream version.
  * Build with libde265 >= 1.0.7 to get NCLX API.
  * Update to debhelper compat level 13.
  * Add patch to support building against system-installed dav1d.
  * Build with "libdav1d-dev" to get faster AVIF decoder.

 -- Joachim Bauch <bauch@struktur.de>  Mon, 28 Sep 2020 09:27:40 +0200

libheif (1.8.0-1) unstable; urgency=medium

  * Add "Rules-Requires-Root", no root necessary.
  * Imported Upstream version 1.8.0
  * Update symbols for new upstream version.
  * Build with "libaom-dev" to get AVIF support.
  * Update "Standards-Version" to 4.5.0

 -- Joachim Bauch <bauch@struktur.de>  Thu, 27 Aug 2020 16:07:58 +0200

libheif (1.6.1-1) unstable; urgency=medium

  * Imported Upstream version 1.6.1

 -- Joachim Bauch <bauch@struktur.de>  Fri, 20 Dec 2019 10:31:19 +0100

libheif (1.6.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * Bump Standards-Version to 4.4.1

  [ Joachim Bauch ]
  * Imported Upstream version 1.6.0
  * Update symbls for new upstream version.
  * Install man pages.

 -- Joachim Bauch <bauch@struktur.de>  Fri, 08 Nov 2019 14:23:21 +0100

libheif (1.5.1-1) unstable; urgency=medium

  * Imported Upstream version 1.5.1
  * Update to debhelper compat level 12 and add debian/not-installed
  * Enable hardening.
  * Stop parsing changelog manually.
  * Fix "get-head-source" and don't include date in filename.
  * Specify "Build-Depends-Package" in symbols.

 -- Joachim Bauch <bauch@struktur.de>  Fri, 30 Aug 2019 10:30:36 +0200

libheif (1.5.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat
  * Bump Standards-Version to 4.4.0

  [ Joachim Bauch ]
  * Imported Upstream version 1.5.0
  * Update symbols for new upstream version.
  * Add copyright entries for new files in test/
  * Add missing copyright entry for files in scripts/
  * The examples are MIT licensed since 1.4.0
  * Remove patches no longer needed (fixed upstream).

  [ Mattia Rizzolo ]
  * Drop now unneeded debian/source/include-binaries

 -- Joachim Bauch <bauch@struktur.de>  Fri, 16 Aug 2019 16:29:09 +0200

libheif (1.4.0-2) unstable; urgency=medium

  * Team upload.
  * Upload to unstable.
  * debian/patches: Apply upstream fixes for CVE-2019-11471. (Closes: #928210)

 -- Sebastian Ramacher <sramacher@debian.org>  Sat, 06 Jul 2019 15:37:07 +0200

libheif (1.4.0-1) experimental; urgency=medium

  * Imported Upstream version 1.4.0
  * Add new package containing the gdk-pixbuf loader.
  * Update "Standards-Version" to 4.3.0
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Tue, 02 Apr 2019 10:17:10 +0200

libheif (1.3.2-1) unstable; urgency=medium

  * Imported Upstream version 1.3.2
  * Update "Standards-Version" to 4.1.4
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 21 Jun 2018 15:40:05 +0200

libheif (1.2.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/copyright: Use https protocol in Format field

  [ Joachim Bauch ]
  * Imported Upstream version 1.2.0
  * Remove patch now in upstream.
  * Update symbols for new upstream version.
  * Add new package "heif-thumbnailer".

 -- Joachim Bauch <bauch@struktur.de>  Mon, 28 May 2018 16:12:56 +0200

libheif (1.1.0-2) unstable; urgency=medium

  * Add patch to fix compile errors on mips, ppc and other platforms.

 -- Joachim Bauch <bauch@struktur.de>  Thu, 19 Apr 2018 09:04:15 +0200

libheif (1.1.0-1) unstable; urgency=medium

  [ Joachim Bauch ]
  * d/control: Set Maintainer to Debian Multimedia Maintainers
  * d/control: Set Vcs-* to salsa.debian.org

  [ Felipe Sateler ]
  * Change maintainer address to debian-multimedia@lists.debian.org

  [ Joachim Bauch ]
  * Use default branch/tag names.
  * Imported Upstream version 1.1.0
  * Add dependency on "libx265-dev".
  * Update symbols for new upstream version.

 -- Joachim Bauch <bauch@struktur.de>  Wed, 18 Apr 2018 16:28:10 +0200

libheif (1.0.0-1) unstable; urgency=medium

  * Initial release. (Closes: #888278)

 -- Joachim Bauch <bauch@struktur.de>  Sun, 18 Mar 2018 14:55:50 +0100
