glib2.0 (2.48.2-0ubuntu4.8) xenial-security; urgency=medium

  * SECURITY UPDATE: incorrect g_file_replace() symlink handling
    - debian/patches/CVE-2021-28153-pre1.patch: allow g_test_bug() to be
      used without g_test_bug_base() in /glib/gtestutils.c.
    - debian/patches/CVE-2021-28153-1.patch: fix a typo in a comment in
      gio/glocalfileoutputstream.c.
    - debian/patches/CVE-2021-28153-2.patch: stop using g_test_bug_base()
      in file tests in gio/tests/file.c.
    - debian/patches/CVE-2021-28153-3.patch: factor out a flag check in
      gio/glocalfileoutputstream.c.
    - debian/patches/CVE-2021-28153-4.patch: fix CREATE_REPLACE_DESTINATION
      with symlinks in gio/glocalfileoutputstream.c, gio/tests/file.c.
    - debian/patches/CVE-2021-28153-5.patch: add a missing O_CLOEXEC flag
      to replace() in gio/glocalfileoutputstream.c.
    - CVE-2021-28153

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 12 Mar 2021 12:35:32 -0500

glib2.0 (2.48.2-0ubuntu4.7) xenial-security; urgency=medium

  * SECURITY UPDATE: g_byte_array_new_take length truncation
    - debian/patches/CVE-2021-2721x/CVE-2021-27218.patch: do not accept too
      large byte arrays in glib/garray.c, glib/gbytes.c,
      glib/tests/bytes.c.
    - CVE-2021-27218
  * SECURITY UPDATE: integer overflow in g_bytes_new
    - debian/patches/CVE-2021-2721x/CVE-2021-27219*.patch: add internal
      g_memdup2() function and use it instead of g_memdup() in a bunch of
      places.
    - CVE-2021-27219

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 03 Mar 2021 07:23:43 -0500

glib2.0 (2.48.2-0ubuntu4.6) xenial-security; urgency=medium

  * No-change rebuild for -security

 -- Alex Murray <alex.murray@canonical.com>  Tue, 24 Mar 2020 11:28:34 +1030

glib2.0 (2.48.2-0ubuntu4.5) xenial; urgency=medium

  * d/p/gcredentialsprivate-Document-the-various-private-macros.patch,
    d/p/credentials-Invalid-Linux-struct-ucred-means-no-informati.patch,
    d/p/GDBus-prefer-getsockopt-style-credentials-passing-APIs.patch:
    - Ensure libdbus clients can authenticate with a GDBusServer like
      the one in ibus. The patches cherry picked from 2.62.2-2 in focal
      in order to allow the ibus fix of CVE-2019-14822 to be re-enabled
      without breaking ibus for Qt applications (LP: #1844853).

 -- Gunnar Hjalmarsson <gunnarhj@ubuntu.com>  Thu, 31 Oct 2019 00:48:00 +0100

glib2.0 (2.48.2-0ubuntu4.4) xenial-security; urgency=medium

  * SECURITY REGRESSION: regression in last security update (LP: #1838890)
    - debian/patches/CVE-2019-13012-regression.patch: fix a
      memory leak introduced by the last security update while
      not properly handled the g_file_get_patch function in
      gio/gkeyfilesettingsbackend.c.

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 05 Aug 2019 12:09:36 -0300

glib2.0 (2.48.2-0ubuntu4.3) xenial-security; urgency=medium

  * SECURITY UPDATE: Not properly restrict directory and file permissions
    - debian/patches/CVE-2019-13012.patch: changes the permissions when
      a directory is created, using 700 instead 777 in
      gio/gkeyfilesettingsbackend.c and changes test to run in a temp
      directory in gio/tests/gsettings.c.
    - CVE-2019-13012

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Wed, 03 Jul 2019 15:24:33 -0300

glib2.0 (2.48.2-0ubuntu4.2) xenial-security; urgency=medium

  * SECURITY UPDATE: Less restrictive permissions during copying
    - debian/patches/CVE-2019-12450.patch: limit access to file when
      copying in file_copy_fallback in file gio/gfile.c.
    - CVE-2019-12450

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Wed, 05 Jun 2019 13:49:53 -0300

glib2.0 (2.48.2-0ubuntu4.1) xenial-security; urgency=medium

  * SECURITY UPDATE: NULL pointer deference
    - debian/patches/CVE-2018-16428.patch: fix in glib/gmarkup.c,
      glib/tests/Makefile.am,
      glib/tests/markups/fail-51.expected,
      glib/tests/markups/fail-51.gmarkup.
    - CVE-2018-16428
  * SECURITY UPDATE: Read out-of-bounds
    - debian/patches/CVE-2018-16429.patch: fix in glib/gmarkup.c and
      glib/tests/Makefile.am,
      glib/tests/markups/fail-50.expected,
      glib/tests/markups/fail-50.gmarkup.
    - CVE-2018-16429

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 17 Sep 2018 10:58:18 -0300

glib2.0 (2.48.2-0ubuntu4) xenial; urgency=medium

  * Add a versioned Pre-Depends for dpkg because the libglib2.0-0 -await
    trigger requires a newer dpkg than the one in Ubuntu 14.04. (LP: #1784065)

 -- Brian Murray <brian@ubuntu.com>  Mon, 30 Jul 2018 08:29:26 -0700

glib2.0 (2.48.2-0ubuntu3) xenial; urgency=medium

  * tests-gdatetime-Use-a-real-rather-than-invented-timezone.patch:
    Cherry-pick upstream fix to make glib2.0 build again and tests
    run again with time zone changes.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 16 Jul 2018 11:56:58 +0200

# For older changelog entries, run 'apt-get changelog libglib2.0-data'
