php3 (3:3.0.18-23.1woody3) stable-security; urgency=high

  * Backport fixes to functions/image.c from the 4.3 branch:
    - Avoid infinite loops in the php3_skip_variable() function and the
      php3_read_APP() function which were being called indirectly by
      getimagesize() function.  As this function is commonly called
      with untrusted data, this becomes a remote DoS. [functions/image.c]
    - Addresses CAN-2005-0525 (for refrence, PHP 3.0.18 is not vulnerable
      to CAN-2005-0524, the sister bug to this one) 

 -- Adam Conrad <adconrad@0c3.net>  Tue,  5 Apr 2005 09:21:20 +0000

php3 (3:3.0.18-23.1woody2) stable-security; urgency=high

  * Backport of several security fixes from the 4.3 branch
    - NULLify appname and server_message on shutdown of SQL extensions
    - Fixed strip_tags() to correctly handle '\0' characters.
    - Added missing safe_mode checks inside itpc.
  * Update control to reflect my adoption of php3, so Petr will stop
    getting emails about it.

 -- Adam Conrad <adconrad@0c3.net>  Tue, 20 Jul 2004 11:35:02 +1000

php3 (3:3.0.18-23.1woody1) stable-security; urgency=high

  * Non-maintainer upload by the security team
  * Backport security fixes from 4.2.3+ to stop CR/LF injection
    - Strip control characters from To and Subject fields in mail()
    - Strip control characters from URLs in fopen()

 -- Matt Zimmerman <mdz@debian.org>  Thu, 12 Sep 2002 16:39:55 -0400

php3 (3:3.0.18-23.1) unstable; urgency=low

  * NMU
  * Fix ia64 build errors.  Patch in bts.  Closes: #142386
  * Add missing build-depends libssl-dev

 -- LaMont Jones <lamont@debian.org>  Tue,  3 Sep 2002 10:42:22 -0600

php3 (3:3.0.18-23) unstable; urgency=medium

  * OK. There is something strange in the security upload :-(
    Rebuild because of broken ldap (closes: #138907)
  * Closing forgotten bug about the security fix in last upload
    (closes: #136194)
  * tempnam was fixed in -18. (closes: #122354)
  * TTF is not again working (I hope) in gd (closes: #106075)

 -- Petr Cech <cech@debian.org>  Wed, 20 Mar 2002 16:17:22 +0100

php3 (3:3.0.18-22) unstable; urgency=high

  * Security fix from 27th for fileupload

 -- Petr Cech <cech@debian.org>  Thu, 28 Feb 2002 10:38:46 +0100

php3 (3:3.0.18-21) unstable; urgency=high

  * Fix spelling (closes: #125236)
  * debian/control: s/freetype2/libttf/
  * debian/rules: (reason for high) massive fix of build of modules. almost
    every one was really broken :-(( for I don't know how long
    - remove dh_testversion as we already builddepend on it

 -- Petr Cech <cech@debian.org>  Thu, 21 Feb 2002 23:53:48 +0100

php3 (3:3.0.18-20) unstable; urgency=low

  * Rebuild with apache 1.3.23 and change depends to
    apache-common (>= 1.3.23) per request of apache maintainer.

 -- Petr Cech <cech@debian.org>  Thu, 14 Feb 2002 12:43:19 +0100

php3 (3:3.0.18-19) unstable; urgency=low

  * Fix bug #129465, which was the result of a fix for ldap (and probably
    other) breakages (Closes: #129465)

 -- Petr Cech <cech@debian.org>  Fri, 18 Jan 2002 14:28:45 +0100

php3 (3:3.0.18-18) unstable; urgency=low

  * Fix tempnam() wanting suffix to have "XXXXXX" in it. Result of -11 change
  * Fix ldap functions (closes: #119434)

 -- Petr Cech <cech@debian.org>  Fri, 30 Nov 2001 10:52:24 +0100

php3 (3:3.0.18-17) unstable; urgency=low

  * Recompile with apache 1.3.22
  * -DAP_COMPAT_H to snmp.c to avoid conflicting declaration of some functions
    (closes: #114421)
  * In ImageMagic 5.3.9 struct Image doesn't have filesize. Anybody knows why?

 -- Petr Cech <cech@debian.org>  Fri, 26 Oct 2001 16:06:59 +0200

php3 (3:3.0.18-16) unstable; urgency=low

  * OK. Recompile for libc-client2001 (closes: #108962)
  * Upgrade build-depends

 -- Petr Cech <cech@debian.org>  Wed, 22 Aug 2001 23:02:53 +0200

php3 (3:3.0.18-15) unstable; urgency=low

  * Recompile for apache 1.3.20.

 -- Petr Cech <cech@debian.org>  Fri, 15 Jun 2001 02:25:20 +0200

php3 (3:3.0.18-14) unstable; urgency=low

  * Try to fix ereg_*() problems (closes: #97674)
    That's the same fix as in apache - regex/regex.h s/off_t regoff_t/int regoff_t/

 -- Petr Cech <cech@debian.org>  Mon, 21 May 2001 13:44:16 +0200

php3 (3:3.0.18-13) unstable; urgency=low

  * Remove php3-pgsql module and move it to non-US (closes: #97122)

 -- Petr Cech <cech@debian.org>  Tue, 15 May 2001 15:50:52 +0200

php3 (3:3.0.18-12) unstable; urgency=low

  * Recompile for apache 1.3.19 (closes: #79596) 

 -- Petr Cech <cech@debian.org>  Tue, 27 Mar 2001 11:56:03 +0200

php3 (3:3.0.18-11) unstable; urgency=medium

  * Use mkstemp() instead of tmpnam();
  * functions/head.c: s/X-Powered-By/X-CGI-Powered-By/ (closes: #69528)
  * debian/control: - s/libsnmp4.1-dev/libsnmp4.2-dev/
                      add xlibs-dev to build-depends just for sure
		    - postgresql-dev (>= 7.0.3-3) for libpgsql2.1
  * Recompile with new postgresql-dev to depend on libpgsql2.1 (closes: #86705)

 -- Petr Cech <cech@debian.org>  Thu, 20 Feb 2001 10:39:22 +0100

php3 (3:3.0.18-10) unstable; urgency=medium

  * Fix arch only build - again :(( (closes: #81569)
  * debian/control: s/libc-client4.7-dev/libc-client2000-dev/
  * rebuild with fixed dpkg
  * apply some more CVS fixes
  * configuration-scanner.lex: fix the infamous "  extension  =" bug
  * add libdb2-dev to build-depends (closes: #81791)

 -- Petr Cech <cech@debian.org>  Wed, 10 Jan 2001 13:27:30 +0100

php3 (3:3.0.18-9) unstable; urgency=low

  * Don't know why, but php3-gd is build without any format support. Used
    an ugly hack. If you recompile with != libgd-gif1 1.3 DO READ ./debian/rules

 -- Petr Cech <cech@debian.org>  Thu,  4 Jan 2001 21:59:25 +0100

php3 (3:3.0.18-8) unstable; urgency=low

  * Recompile with apache 1.3.14-2. This will hopefully fix those segfaults.
  * Build-depends on needed apache.

 -- Petr Cech <cech@debian.org>  Thu, 14 Dec 2000 16:12:15 +0100

php3 (3:3.0.18-7) unstable; urgency=low

  * Rebuild for apache 1.3.14-1

 -- Petr Cech <cech@debian.org>  Fri,  1 Dec 2000 01:15:55 +0100

php3 (3:3.0.18-6) unstable; urgency=low

  * Rebuild for apache 1.3.12-2.2

 -- Petr Cech <cech@debian.org>  Thu, 30 Nov 2000 19:11:32 +0100

php3 (3:3.0.18-5) unstable; urgency=low

  * Fix build of php3-imap.

 -- Petr Cech <cech@debian.org>  Wed, 22 Nov 2000 00:48:28 +0100

php3 (3:3.0.18-4) unstable; urgency=low

  * Sigh. Recompile with distribution libmysqlclient10-dev 3.23.5-4

 -- Petr Cech <cech@debian.org>  Tue, 21 Nov 2000 17:03:18 +0100

php3 (3:3.0.18-3) unstable; urgency=low

  * Backoff versioning changes on 3.0.18-2. Breaks module loading and
    other stuff (closes: #77614, #77525, #77365)

 -- Petr Cech <cech@debian.org>  Tue, 21 Nov 2000 13:27:22 +0100

php3 (3:3.0.18-2) unstable; urgency=low

  * --enable-versioning
  * This is not really 3.0.18, but ...
  * Update functions/crypt.c from CVS - be really random
  * Update functions/gd.c from CVS - backport imagetypes()
  * Fix conflicts on php4 in debian/control

 -- Petr Cech <cech@debian.org>  Tue, 14 Nov 2000 11:48:07 +0100

php3 (3:3.0.18-1) unstable; urgency=medium

  * New upstream release.
  * Fixed enctype="multipart/form-data" bug.

 -- Petr Cech <cech@debian.org>  Sun, 22 Oct 2000 17:08:07 +0200

php3 (3:3.0.17-1) unstable; urgency=high

  * New upstream release. Fixes format string secuity holes.
  * Add symlink index.html -> manual.html (closes: #58249)
  * tr "\t" " " to please Joey (closes: #62731)
  * Updated build-depends.

 -- Petr Cech <cech@debian.org>  Thu, 12 Oct 2000 16:43:26 +0200

php3 (3:3.0.16-4) unstable; urgency=low

  * New maintainer (oh boy).
  * Apply fix for imap.c. (closes: #62711).
  * Fix compilation of magick.c with imagemagick 5.2.x.
  * and Build-depend on new imagemagick.

 -- Petr Cech <cech@debian.org>  Tue, 13 Jun 2000 11:02:49 +0000

php3 (3:3.0.16-3) unstable; urgency=low

  * Compile with latest libraries from woody, update Build-Depends
    accordingly (Closes: #61867)

 -- Gergely Madarasz <gorgo@sztaki.hu>  Wed, 19 Apr 2000 14:28:18 +0200

php3 (3:3.0.16-2) frozen unstable; urgency=low

  * Fix build dependency (Closes: #62367)

 -- Gergely Madarasz <gorgo@sztaki.hu>  Sun, 16 Apr 2000 03:13:58 +0200

php3 (3:3.0.16-1) frozen unstable; urgency=low

  * Upstream bugfix release including support for UCD-SNMP 4.1
    (See http://www.php.net/ChangeLog.php3 for full list of changes)
  * Compile with libsnmp4.1

 -- Gergely Madarasz <gorgo@sztaki.hu>  Fri,  7 Apr 2000 12:27:59 +0200

php3 (3:3.0.15-2) frozen unstable; urgency=low

  * Apply patch from NMU, build on a standard php3 build system 
    (Closes: #59563, #59708, #59972, #60036)

 -- Gergely Madarasz <gorgo@sztaki.hu>  Sat, 11 Mar 2000 15:19:46 +0100

php3 (3:3.0.15-1) frozen unstable; urgency=low

  * New upstream bugfix release with security fixes for safe mode
  * Enabled ftp module
  * Fix some lintian warnings (/usr/doc links, shlib with non-pic code)

 -- Gergely Madarasz <gorgo@sztaki.hu>  Mon, 28 Feb 2000 18:02:23 +0100

php3 (3:3.0.14-2) unstable; urgency=low

  * Fix gd support

 -- Gergely Madarasz <gorgo@sztaki.hu>  Thu, 13 Jan 2000 13:53:54 +0100

php3 (3:3.0.14-1) unstable; urgency=low

  * New upstream bugfix version

 -- Gergely Madarasz <gorgo@sztaki.hu>  Wed, 12 Jan 2000 13:45:32 +0100

php3 (3:3.0.13-2) unstable; urgency=low

  * Compile against t1lib1 (Closes: #54071)
  * Fix build dependencies (Closes: #54363)
  * Fix apache dependency version extraction...

 -- Gergely Madarasz <gorgo@sztaki.hu>  Mon, 10 Jan 2000 15:40:49 +0100

php3 (3:3.0.13-1) unstable; urgency=low

  * New upstream version
  * Fix builddeps (Closes: #52782)

 -- Gergely Madarasz <gorgo@sztaki.hu>  Tue,  4 Jan 2000 15:52:54 +0100

php3 (1:3.0.12-9) unstable; urgency=low

  * Recompile with libc-client4.7 (Closes: #51939)
  * Fix freetype include path (Closes: #50618)
  * 50879 should be fixed by current libpq (Closes: #50879)
  * Add Steve Haslam's patch for php3-ldap (Closes: #50382)
  * Add Build-Depends: to control file
  * Bump standards version to 3.1.1  

 -- Gergely Madarasz <gorgo@sztaki.hu>  Wed,  8 Dec 1999 15:16:05 +0100

php3 (1:3.0.12-8) unstable; urgency=low

  * Recompile with libc-client4.6

 -- Gergely Madarasz <gorgo@sztaki.hu>  Fri,  5 Nov 1999 19:34:00 +0100

php3 (1:3.0.12-7) unstable; urgency=low

  * Rebuild with new libbz2 libraries (Closes: #47599, #47600)
  * Remove shlibs.local

 -- Gergely Madarasz <gorgo@sztaki.hu>  Tue, 19 Oct 1999 20:30:13 +0200

php3 (1:3.0.12-6) unstable; urgency=low

  * snmp module compiled with libsnmp4.0
  * gd module compiled with libgd-gif (closes: #45247, #45108)
  * Add libsnmp4.0 to shlibs.local since its shlibs file is broken

 -- Gergely Madarasz <gorgo@sztaki.hu>  Mon, 20 Sep 1999 14:09:21 +0200

php3 (1:3.0.12-5) unstable; urgency=low

  * php3 modules depend on exact version of main php3 packages

 -- Gergely Madarasz <gorgo@sztaki.hu>  Thu,  9 Sep 1999 01:13:37 +0200

php3 (1:3.0.12-4) unstable; urgency=low

  * /usr/doc -> /usr/share/doc in all files
  * debhelper 2.0.40 needed to build
  * Standards-version: 3.0.1
  * zlib fixes (Closes: #44357)
  * Build with pcre support
  * new module: mhash

 -- Gergely Madarasz <gorgo@sztaki.hu>  Tue,  7 Sep 1999 13:15:50 +0200

php3 (1:3.0.12-3) unstable; urgency=low

  * Change maintainer address
  * Link magick module against shared bzip2 library (add shlibs.local
    because bzip2's is broken)
  * Build with apache 1.3.9
  * Remove libpam check from configure.in, hope to fix several RC bugs 
    with this

 -- Gergely Madarasz <gorgo@sztaki.hu>  Wed,  1 Sep 1999 00:39:33 +0200

php3 (1:3.0.12-2) unstable; urgency=low

  * use RTLD_NOW instead of RTLD_LAZY for module load - better
    safe than sorry
  * compile snmp module with ucd snmp
  * compile two versions of the cgi: unsafe (without cgi redirect enforced) 
    and safe (with cgi redirect enforced), the former is in /usr/bin, can
    be used as a #! interpreter

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Thu, 12 Aug 1999 18:40:14 +0200

php3 (1:3.0.12-1) unstable; urgency=low

  * New upstream version
  * Turn off dba support (I suspect the mix of various db libs linked
    is responsible for some segfaults)
  * Sendmail is /usr/sbin/sendmail

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Mon,  2 Aug 1999 13:56:30 +0200

php3 (1:3.0.11-3) unstable; urgency=low

  * Fix pgsql segfault problem (closes: #40874)

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Tue,  6 Jul 1999 21:27:49 +0200

php3 (1:3.0.11-2) unstable; urgency=low

  * Get rid of rpaths in the code
  * Add snmp module packages
  * Add imagemagick module packages

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Mon,  5 Jul 1999 15:57:30 +0200

php3 (1:3.0.11-1) unstable; urgency=low

  * New upstream version
  * Compile mysql module with libmysqlclient6 (should work with potato mysql)
    closes: #38829, #39688, #35532, #36938, #38304, #39510, #39586, #39587, #39589, #39590
  * Compile gd module with t1lib support
  * Compile with dba (gdbm and db2) and gettext support
  * Fix apxs path
    closes: #36524, #36996, #40188
  * Add patch from CVS to fix regex problems

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Fri,  2 Jul 1999 01:22:07 +0200

php3 (1:3.0.7-2) unstable; urgency=low

  * Compile with apache 1.3.6 and glibc 2.1

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Mon, 29 Mar 1999 13:04:24 +0200

php3 (1:3.0.7-1) unstable; urgency=low

  * New upstream version
  * Add nis(YP) support
  * Turn off hyperwave support because it does not compile
  * Modify cgi detection code so #!/usr/lib/cgi-bin/php3 type scripts
    work as cgi scripts too (Closes: #33531)
  * Fixes for glibc2.1 build (Closes: #33869)
  * Add shlibs.local because of wrong libpgsql2 shlibs file

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Tue,  2 Mar 1999 09:42:34 +0100

php3 (1:3.0.6-2) unstable; urgency=low

  * Build php3-xml and php3-ldap packages too
  * Modify rules file to work with a list of modules instead of copying, 
    linking, generating shlibs for each in a separate line

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Fri, 15 Jan 1999 01:02:32 +0100

php3 (1:3.0.6-1) unstable; urgency=low

  * New upstream release

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Mon, 11 Jan 1999 18:39:33 +0100

php3 (1:3.0.5-3) froxzen unstable; urgency=low

  * Add Suggests lines (php3 -> php3-cgi, etc, #31118)
  * php3-gd fixes, compile with freetype2, libgd1g 1.3, 
    add shlibs.local since libgd1g has a bad shlibs file (#31231)
  * Documentation fixes (#31437)
  * Incorporate NMU patch (#30709)
  * Compile with correct pgsql defines (#31136)

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Mon,  4 Jan 1999 15:33:11 +0100

php3 (1:3.0.5-2) unstable; urgency=low

  * Fix the crypt module
  * Removed the LIBGD defines from debian/rules, put them in
    gd.c and gdttf.c so it correctly sees we have libgd1.3

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Mon, 12 Oct 1998 20:49:58 +0200

php3 (1:3.0.5-1) unstable; urgency=low

  * New upstream version
  * Compile with apache 1.3.3
  * Merged in the imap modules

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Wed,  7 Oct 1998 23:23:10 +0200

php3 (1:3.0.4-1) unstable; urgency=low

  * New upstream version
  * Compile with apache 1.3.2 (#27148)
  * Depend on apache-common so it can work with apache-ssl (#26691, #26234)
  * Check for apache-sslconfig in the postinst (#26234)
  * Add shlibs.local because zlib1g has broken shlibs file 
    (should be >= 1.1.1) (#25256)
  * Depend on exact upstream version of apache
  * Fixed by previous version, forgot to close: #25080, #25429

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Wed, 30 Sep 1998 22:05:46 +0200

php3 (1:3.0.3-1) unstable; urgency=low

  * New upstream version
  * Compile with apache 1.3.1 
  * Remove the apxs hack from the Makefile, RTLD_GLOBAL in apache works now
  * Split the cgi from the main package, do the same with the modules,
    modify rules files, fix dependency information, remove preinst hack
  * Add php3-mysql and php3-gd to this main source package since libgd and
    mysql-dev are in main now

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Fri, 21 Aug 1998 02:19:16 +0200

php3 (1:3.0-2) frozen unstable; urgency=low

  * Fix preinst so it doesnt say it has old apache installed when there is
    no apache installed
  * Fix description of php3-doc

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Thu, 11 Jun 1998 13:36:57 +0200

php3 (1:3.0-1) frozen unstable; urgency=low

  * The final version is finally here.
  * Compile with apache 1.3.0
  * Some fixes on the dependency of the modules on php3, now makes it
    impossible to use the module with a different version of php3 and get 
    apache segfaults
  * Remove the conflict on old apache, because it made apache+php3 upgrade 
    impossible, now asks the user in preinst if he really wants to do this.
    (closes: #23279 (important))
  * Use apxs for build
  * Include zlib support

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Sat,  10 Jun 1998 22:10:12 +0200

php3 (3.0rc4-2) frozen unstable; urgency=low

  * some changes regarding headers in php3-dev to enable compiling
    php3-contrib (current php3-contrib doesnt work with current php3,
    should have been submitted as a grave bug)
  * add patch to fix #21755

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Wed, 20 May 1998 20:51:19 +0200

php3 (3.0rc4-1) frozen unstable; urgency=medium

  * strip out the dbase dir from orig.tar.gz because it is non-free
  * rework debian/rules for a cleaner build
  * /usr/doc/php3/manual removed (Closes: #19112)
  * Documentation now has extension .html (Closes: #19109)
  * Comes with nearly full documentation (Closes: #19057)
  * Compile with postgresql 6.3.2 (Closes: #20829, #21755)
    add shlibs.local because current libpgsql doesnt have it
  * Compile with apache 1.3b6 (Closes: #21902)
  * Register php3-doc with doc-base (Closes: #19110, #21409) 
  * New upstream source, release candidate 4

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Tue, 28 Apr 1998 19:07:26 +0200

php3 (3.0b6-1) unstable; urgency=low

  * New upstream beta

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Wed,  4 Mar 1998 21:14:24 +0100

php3 (3.0b5-1) unstable; urgency=low

  * Finally I could manage to build the docs, so there is a new package:
      php3-doc (the manual is not complete yet)
  * Postinst and prerm scripts for use with apache
  * Remove the dh_du call from the binary target
  * Put the extra directory in doc too
  * Added dependency on mime-support (>= 2.13-1) for php mime types
  * New upstream beta with lots of bugfixes, please read the upstream
      changelog
   
 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Wed, 25 Feb 1998 13:22:18 +0100

php3 (3.0b4-1) unstable; urgency=low

  * No longer depends on apache, just recommend it.
       the cgi version can work without apache
  * New upstream release

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Tue,  3 Feb 1998 19:39:11 +0100

php3 (3.0b3-2) unstable; urgency=low

  * Argh! wrong symlinks in the previous version.

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Tue,  3 Feb 1998 02:09:35 +0100

php3 (3.0b3-1) unstable; urgency=low

  * Link modules for the apache module against mod_php3.so
  * Build loadable modules
  * Modified configure.in to disable libgd support by default
  * Modified configure.in to find apache headers in /usr/include/apache-1.3
  * Initial Release.

 -- Gergely Madarasz <gorgo@caesar.elte.hu>  Sun, 25 Jan 1998 01:04:04 +0100

Local variables:
mode: debian-changelog
add-log-mailing-address: "cech@debian.org"
End: