pcre2 (10.39-3ubuntu0.2+11.0trisquel0) aramo-security; urgency=medium

  * Fetch and build as udeb dependency for debian-installer.

 -- Trisquel GNU/Linux developers <trisquel-devel@listas.trisquel.info>  Sun, 08 Nov 2026 00:30:29 +0000

pcre2 (10.39-3ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Fix large JIT stack allocation.
    - src/pcre2_jit_compile.c: Track oversized stack allocations and compute
      the growth threshold from the stack top instead of assuming the stack
      starts near its base, preventing an out-of-bounds write.
    - Authors: Zoltan Herczeg, Nicholas Wilson
    - 2b4038298072684b0fae29b15bedfb1a75bda46d
    - 6f9d7c1373262c541324a16a358785b33ef116cf
    - CVE-2026-103111
  * SECURITY UPDATE: Fix DFA workspace overflows
    - src/pcre2_dfa_match.c: Size new workspace blocks to fit the current
      ovector request and stop reusing a next block that is too small,
      preventing workspace overflow past the heap limit.
    - testdata/testinput6, testdata/testoutput6: Regression tests for the
      workspace overflow cases.
    - Author: Nicholas Wilson
    - c932e70451eafef922ebef364ac25042f0031135
    - CVE-2026-86145
  * SECURITY UPDATE: Fix pcre2_match to check for JIT support before JIT
    validation & execution
    - src/pcre2_internal.h: Declare the new jit_check_exec() helper.
    - src/pcre2_jit_misc.c: Add jit_check_exec() to verify the requested
      matching mode is compiled in before running JIT code.
    - src/pcre2_match.c: Gate the JIT fast path on jit_check_exec() so a
      missing JIT mode falls through to the interpreter's own UTF validation
      instead of skipping it.
    - Author: Zoltan Herczeg
    - f67db227af31bba7cdf2a7a00b97af91b588c2f5
    - CVE-2026-89156
  * SECURITY UPDATE: Use CU2BYTES for byte sizing in two allocation sites
    - src/pcre2_convert.c, src/pcre2_substring.c: Size allocations with
      CU2BYTES() instead of multiplying by PCRE2_CODE_UNIT_WIDTH, and reject
      lengths that would overflow the size calculation.
    - Author: Ilia Alshanetsky
    - 8156b3989a82f2ddf9504d8248496e9b124be7f3
    - CVE-2026-89157
  * SECURITY UPDATE: Fix compiler integer overflows
    - src/pcre2_compile.c: Guard pattern length accumulation against
      OFLOW_MAX and MAX_PATTERN_SIZE overflow.
    - Author: Nicholas Wilson
    - ec9c286d5c10cf1c388b58a442ccefded42254fd
    - CVE-2026-89158
  * SECURITY UPDATE: Fix invalid UTF backwards-scan reads
    - src/pcre2_extuni.c, src/pcre2_match.c: Bound backwards scans at
      check_subject rather than start_subject so they cannot read into an
      invalid UTF prefix before it has been validated.
    - testdata/testinput10, testdata/testoutput10, testdata/testinput12,
      testdata/testoutput12-16, testdata/testoutput12-32: Regression tests
      for backwards scans over invalid UTF prefixes.
    - Author: Nicholas Wilson
    - 4889caf31a4c5a6b3c051f0031bf2dbd78f2c287
    - CVE-2026-89160
  * SECURITY UPDATE: Fix leak & stale PCRE2_MD_COPIED_SUBJECT if
    pcre2_jit_match used with existing match context.
    - src/pcre2_jit_match.c: Free a previously copied subject and clear the
      PCRE2_MD_COPIED_SUBJECT flag before reusing a match data block.
    - src/pcre2test.c: Detect a wrongly-set or wrongly-cleared copied-subject
      state after a JIT match.
    - testdata/testinput17, testdata/testoutput17: Test the copied-subject
      handling on the JIT fast path.
    - Author: Nicholas Wilson
    - 1dcd0cf42a6a7cb62cc9a7c024196733abcfda95
    - CVE-2026-89161

 -- Kyle Kernick <kyle.kernick@canonical.com>  Thu, 15 Oct 2026 17:22:01 -0600

pcre2 (10.39-3ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read in pcre2_jit_compile
    - Fix a unicode property matching issue and an incorrect
      value reading in JIT in src/pcre2_jit_compile.c and
      src/pcre2_jit_test.c.
    - Fix a recursions issue in JIT caused by duplicated
      data transfers in src/pcre2_jit_compile.c and
      src/pcre2_jit_test.c.
    - CVE-2022-1586
    - CVE-2022-1587 

 -- David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>  Tue, 20 Sep 2022 12:46:17 +0200

pcre2 (10.39-3build1) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 17:22:31 +0100

pcre2 (10.39-3) unstable; urgency=medium

  * Enable JIT on s390x (Closes: #999836)
  * Re-enable JIT on MIPS (Closes: #892488)

 -- Matthew Vernon <matthew@debian.org>  Wed, 17 Nov 2021 14:52:42 +0000

pcre2 (10.39-2) unstable; urgency=medium

  * Update long descriptions of runtime packages (Closes: #978013)
  * Source-only upload (-1 was binary to get through NEW)
  * Depend on libc-dev rather than libc6-dev (Closes: #989729)

 -- Matthew Vernon <matthew@debian.org>  Mon, 08 Nov 2021 23:47:21 +0000

pcre2 (10.39-1) unstable; urgency=medium

  * New upstream release
  * Update watch file to reflect new upstream home on github
  * libpcre2-posix soname updated

 -- Matthew Vernon <matthew@debian.org>  Sat, 06 Nov 2021 13:56:27 +0000

pcre2 (10.36-2) unstable; urgency=medium

  * Upload to unstable

 -- Matthew Vernon <matthew@debian.org>  Sun, 13 Dec 2020 16:23:03 +0000

pcre2 (10.36-1) experimental; urgency=medium

  * New upstream version
  * Fix watch file

 -- Matthew Vernon <matthew@debian.org>  Mon, 07 Dec 2020 12:35:19 +0000

pcre2 (10.35-2) unstable; urgency=medium

  * Upload to unstable

 -- Matthew Vernon <matthew@debian.org>  Fri, 04 Dec 2020 09:52:04 +0000

pcre2 (10.35-1) experimental; urgency=medium

  * New upstream version
  * Bump standards-version to 4.5.1

 -- Matthew Vernon <matthew@debian.org>  Fri, 27 Nov 2020 09:25:08 +0000

pcre2 (10.34-7) unstable; urgency=medium

  * Upstream patch to fix segfault in rspamd (Closes: #946221)

 -- Matthew Vernon <matthew@debian.org>  Sat, 07 Dec 2019 17:06:59 +0000

pcre2 (10.34-6) unstable; urgency=high

  * Replace: and Conflict: the previous libpcre2-posix0 package (which
    erroneously had the soname 2 library in) (Closes: #946279, #946290, #946311)
  * Can now make a source-only upload now libpcre2-posix2 has made it
    through NEW. We need that so we can migrate to testing (Closes: #946275)

 -- Matthew Vernon <matthew@debian.org>  Sat, 07 Dec 2019 14:34:25 +0000

pcre2 (10.34-5) unstable; urgency=medium

  * Sacrifice an integer so I can do a binary upload for the new
    libpcre2-posix package name :-(

 -- Matthew Vernon <matthew@debian.org>  Tue, 03 Dec 2019 21:14:29 +0000

pcre2 (10.34-4) unstable; urgency=high

  * Add symbols files (Closes: #945973)
  * Update libpcre2-posix name to match soname

 -- Matthew Vernon <matthew@debian.org>  Tue, 03 Dec 2019 19:20:54 +0000

pcre2 (10.34-3) unstable; urgency=medium

  * Remove -dbg package from debian/control as well

 -- Matthew Vernon <matthew@debian.org>  Mon, 02 Dec 2019 11:58:33 +0000

pcre2 (10.34-2) unstable; urgency=high

  * Try an upstream patch to fix an ARM bug (apropos 945972)
  * Remove -dbg in favour of -dbgsyms, thanks to Michael Biebl
    <biebl@debian.org> for the patch (Closes: #891624)

 -- Matthew Vernon <matthew@debian.org>  Mon, 02 Dec 2019 11:22:32 +0000

pcre2 (10.34-1) unstable; urgency=medium

  * New upstream release

 -- Matthew Vernon <matthew@debian.org>  Thu, 28 Nov 2019 16:28:31 +0000

pcre2 (10.32-5) unstable; urgency=high

  * Patch from Guillem Jover <guillem@debian.org> to only use SSE2
    instructions on those i386 CPUs that support them (Closes: #925360)

 -- Matthew Vernon <matthew@debian.org>  Mon, 25 Mar 2019 19:56:19 +0000

pcre2 (10.32-4) unstable; urgency=medium

  * Take patch from Jeremy Bicha to build with
    --disable-pcre2grep-callout: A grep tool should not be expected to
    execute commands (Closes: #920273) (LP: #1636666)

 -- Matthew Vernon <matthew@debian.org>  Thu, 24 Jan 2019 09:20:51 +0000

pcre2 (10.32-3) unstable; urgency=medium

  * Sacrifice an integer to dgit (previous upload didn't work)

 -- Matthew Vernon <matthew@debian.org>  Sun, 28 Oct 2018 14:19:04 +0000

pcre2 (10.32-2) unstable; urgency=medium

  * Take Ondřej Nový's patch to remove redundant Priority field in -dbg
    package

 -- Matthew Vernon <matthew@debian.org>  Fri, 26 Oct 2018 20:01:53 +0100

pcre2 (10.32-1) unstable; urgency=medium

  * New upstream release

 -- Matthew Vernon <matthew@debian.org>  Fri, 26 Oct 2018 19:27:13 +0100

pcre2 (10.31-3) unstable; urgency=medium

  * Disable JIT on mips* (apropos #892488)

 -- Matthew Vernon <matthew@debian.org>  Sat, 10 Mar 2018 00:31:33 +0000

pcre2 (10.31-2) unstable; urgency=low

  * Point to salsa repo in vcs* fields
  * priority extra -> optional
  * Add homepage link in debian/control
  * Update to newer standards-version

 -- Matthew Vernon <matthew@debian.org>  Sat, 24 Feb 2018 14:57:26 +0000

pcre2 (10.31-1) unstable; urgency=medium

  * New upstream version (Closes: #883224)

 -- Matthew Vernon <matthew@debian.org>  Sat, 24 Feb 2018 12:13:02 +0000

pcre2 (10.22-6) unstable; urgency=medium

  [ Cyril Brulebois ]
  * Add a libpcre2-8-0-udeb, needed by vte2.91 (Closes: #887674)
  * Enable parallel building.

 -- Matthew Vernon <matthew@debian.org>  Sat, 03 Feb 2018 18:44:08 +0000

pcre2 (10.22-5) unstable; urgency=medium

  * Add Vcs-{Git,Browser} fields to debian/control

 -- Matthew Vernon <matthew@debian.org>  Fri, 01 Dec 2017 17:35:06 +0000

pcre2 (10.22-4) unstable; urgency=low

  * Add README.source explaining packaging workflow (Closes: #862425)

 -- Matthew Vernon <matthew@debian.org>  Thu, 30 Nov 2017 14:17:39 +0000

pcre2 (10.22-3) unstable; urgency=medium

  * CVE-2017-7186: invalid Unicode property lookup may cause denial of
    service (Closes: #858233)

 -- Matthew Vernon <matthew@debian.org>  Tue, 21 Mar 2017 22:33:58 +0000

pcre2 (10.22-2) unstable; urgency=low

  * re-upload with source :-(

 -- Matthew Vernon <matthew@debian.org>  Tue, 02 Aug 2016 19:27:58 +0100

pcre2 (10.22-1) unstable; urgency=low

  * New upstream release

 -- Matthew Vernon <matthew@debian.org>  Tue, 02 Aug 2016 18:59:19 +0100

pcre2 (10.21-1) unstable; urgency=low

  * New upstream version
  * Upstream patch to fix workspace overflow for (*ACCEPT) with deeply
    nested parentheses (Closes: #815920)

 -- Matthew Vernon <matthew@debian.org>  Sat, 27 Feb 2016 15:21:34 +0000

pcre2 (10.20-3) unstable; urgency=low

  * Enable JIT on ppc64 & ppc64el (Closes: #806388)

 -- Matthew Vernon <matthew@debian.org>  Fri, 27 Nov 2015 08:16:38 +0000

pcre2 (10.20-2) unstable; urgency=low

  * remove unnecessary -L settings (Closes: #805941)
  * Improve makefile syntax, and add JIT on arm64

 -- Matthew Vernon <matthew@debian.org>  Tue, 24 Nov 2015 20:39:15 +0000

pcre2 (10.20-1) unstable; urgency=low

  * Initial debian version (Closes: #805728)

 -- Matthew Vernon <matthew@debian.org>  Sun, 22 Nov 2015 15:58:38 +0000

