movabletype-opensource (5.1.4+dfsg-4+deb7u3) wheezy-security; urgency=medium

  * Fix format string injection vulnerability in localisation of
    templates (CVE-2015-0845)

 -- Dominic Hargreaves <dom@earth.li>  Tue, 14 Apr 2015 23:24:22 +0100

movabletype-opensource (5.1.4+dfsg-4+deb7u2) wheezy-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * Add CVE-2014-9057.patch patch.
    CVE-2014-9057: SQL injection vulnerability in the XML-RPC interface.
    (Closes: #774192)
  * Add CVE-2015-1592.patch patch.
    CVE-2015-1592: The Perl Storable::thaw function is not properly used,
    allowing remote attackers to include and execute arbitrary local Perl
    files and possibly remotely execute arbitrary code.
  * Add CVE-2013-2184.patch patch.
    CVE-2013-2184: Unsafe use of Storable::thaw in the handling of comments
    to blog posts. (Closes: #712602)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 06 Mar 2015 10:56:52 +0100

movabletype-opensource (5.1.4+dfsg-4+deb7u1) stable-security; urgency=high

  * Add XSS security fixes from upstream release (CVE-2014-0977)
    (Closes: #734304)

 -- Dominic Hargreaves <dom@earth.li>  Wed, 08 Jan 2014 19:42:23 +0000

movabletype-opensource (5.1.4+dfsg-4) unstable; urgency=low

  * Merge the preinst added in the previous release with the original
    preinst, which prompted the user to configure the packages after
    installation (closes: #702065)

 -- Dominic Hargreaves <dom@earth.li>  Sun, 10 Mar 2013 17:14:28 +0000

movabletype-opensource (5.1.4+dfsg-3) unstable; urgency=medium

  * Add preinst to remove jquery symlink to avoid overwriting
    files from libjs-jquery (closes: #700063)

 -- Dominic Hargreaves <dom@earth.li>  Wed, 13 Feb 2013 23:19:20 +0000

movabletype-opensource (5.1.4+dfsg-2) unstable; urgency=low

  * Replace use of Digest::SHA1 with Digest::SHA1, as the former is no
    longer available in Debian (closes: #694476)

 -- Dominic Hargreaves <dom@earth.li>  Mon, 31 Dec 2012 22:32:54 +0000

movabletype-opensource (5.1.4+dfsg-1) unstable; urgency=low

  * Update copyright for codemirror
  * Switch Maintainer to a (nascent) team
  * New upstream relese
  * Update Standards-Version (no changes)

 -- Dominic Hargreaves <dom@earth.li>  Sun, 27 May 2012 16:09:43 +0100

movabletype-opensource (5.1.3+dfsg-1) unstable; urgency=high

  * New upstream release
    - fixes multiple security vulnerabilities (closes: #661064)

 -- Dominic Hargreaves <dom@earth.li>  Fri, 24 Feb 2012 11:07:02 +0000

movabletype-opensource (5.1.2+dfsg-3) unstable; urgency=low

  * Add Vcs-* headers
  * Correct debian/postinst to work correctly with new installs
    (closes: #657486)

 -- Dominic Hargreaves <dom@earth.li>  Thu, 26 Jan 2012 21:01:07 +0000

movabletype-opensource (5.1.2+dfsg-2) unstable; urgency=low

  * Ensure that debconf warning about schema upgrade is shown for this
    release
  * Correctly preserve ownership and mode of mt-config.cgi
  * Provide build-arch and build-indep targets, as recommended by
    Lintian

 -- Dominic Hargreaves <dom@earth.li>  Mon, 23 Jan 2012 22:24:45 +0000

movabletype-opensource (5.1.2+dfsg-1) experimental; urgency=low

  * New upstream release (closes: #582724)

 -- Dominic Hargreaves <dom@earth.li>  Sat, 14 Jan 2012 18:08:38 +0000

movabletype-opensource (4.3.7+dfsg-1) unstable; urgency=high

  * New upstream release
    - fixes information disclosure vulnerability (closes: #631437)

 -- Dominic Hargreaves <dom@earth.li>  Thu, 23 Jun 2011 22:53:29 +0100

movabletype-opensource (4.3.6.1+dfsg-1) unstable; urgency=high

  * New upstream release
    - fixes unspecified security vulnerabilities (closes: #629937)
  * Update Standards-Version (no changes)

 -- Dominic Hargreaves <dom@earth.li>  Thu, 09 Jun 2011 19:28:48 +0100

movabletype-opensource (4.3.6+dfsg-1) unstable; urgency=high

  * New upstream release
    - fixes unspecified security vulnerabilities (closes: #627936)
  * Update versioned dependency on libdata-objectdriver-perl to 0.08
    following bundled version number

 -- Dominic Hargreaves <dom@earth.li>  Wed, 25 May 2011 23:34:08 +0100

movabletype-opensource (4.3.5+dfsg-3) unstable; urgency=low

  * Check for existence of dbconfig-common in debian/config before
    using it (closes: #499598)
  * Update Standards-Version (no changes)
  * Update to debhelper compatibility level 7
  * Update source format version to 3.0 (quilt)

 -- Dominic Hargreaves <dom@earth.li>  Sat, 05 Feb 2011 18:14:06 +0000

movabletype-opensource (4.3.5+dfsg-2) unstable; urgency=low

  * Correct dependency on sqlite3 to sqlite to satisfy dbconfig-common
    (closes: #606705)

 -- Dominic Hargreaves <dom@earth.li>  Sat, 11 Dec 2010 11:31:07 +0000

movabletype-opensource (4.3.5+dfsg-1) unstable; urgency=high

  * New upstream release
    - fixes various unspecified XSS/SQL vulnerabilities (closes: #606311)

 -- Dominic Hargreaves <dom@earth.li>  Wed, 08 Dec 2010 20:34:44 +0000

movabletype-opensource (4.3.4+dfsg-2) unstable; urgency=low

  * Adjust database-related dependencies to avoid dbconfig failure
    on a minimal system (closes: #603867)

 -- Dominic Hargreaves <dom@earth.li>  Sat, 20 Nov 2010 15:44:32 +0000

movabletype-opensource (4.3.4+dfsg-1) unstable; urgency=low

  * Remove non-free flash components from upstream tarball and
    include the NoStats plugin which disables their use in the
    application (closes: #591975)
  * Include information about how to re-enable the flash components
    in README.Debian

 -- Dominic Hargreaves <dom@earth.li>  Wed, 06 Oct 2010 21:31:37 +0100

movabletype-opensource (4.3.4-2) unstable; urgency=low

  * Add Spanish debconf translation (closes: #580853)
  * Add Danish debconf translation (closes: #587799)
  * Move the Zemanta plugin to a separate package owing to privacy
    concerns (closes: #591673)
  * Add NEWS.Debian mentioning the above change

 -- Dominic Hargreaves <dom@earth.li>  Tue, 24 Aug 2010 19:44:01 +0100

movabletype-opensource (4.3.4-1) unstable; urgency=low

  * New upstream release
    - bump schema version in debian/config
  * Update URL in debian/watch file (closes: #567950)
  * Update Standards-Version (no changes)

 -- Dominic Hargreaves <dom@earth.li>  Sun, 21 Feb 2010 18:08:19 +0000

movabletype-opensource (4.3.3-1) unstable; urgency=low

  * New upstream release
    - fixes missing authorization checks in CMS:
      http://www.movabletype.org/2010/01/considering_an_mt_4_upgrade_review_the_movable_type_433_chan.html
  * Add Russian debconf translation (closes: #551575)
  * Add missing link to search_templates in CGI dir (LP: #486402)
  * Apply http://code.sixapart.com/trac/movabletype/changeset/5205
    to fix a show-stopper bug introduced in 4.33.

 -- Dominic Hargreaves <dom@earth.li>  Sun, 24 Jan 2010 16:47:58 +0000

movabletype-opensource (4.3.2-1) unstable; urgency=low

  * New upstream release (closes: #544206)

 -- Dominic Hargreaves <dom@earth.li>  Tue, 06 Oct 2009 22:09:27 +0100

movabletype-opensource (4.2.6.1-2) unstable; urgency=low

  * Don't allow any access to mt-wizard.cgi by default as it shouldn't
    normally be needed and presents an unnecessary security exposure
  * Fix error in postinst when apache isn't installed (closes: #534104)
  * Update Standards-Version (no changes)

 -- Dominic Hargreaves <dom@earth.li>  Sat, 19 Sep 2009 15:15:44 +0100

movabletype-opensource (4.2.6.1-1) unstable; urgency=low

  * New upstream release
  * Update Standards-Version (no changes)
  * Don't specify full path to apache2ctl in postinst (thanks, Lintian)
  * Remove unused Lintian overrides
  * Don't install empty directory in extlib

 -- Dominic Hargreaves <dom@earth.li>  Fri, 19 Jun 2009 23:03:15 +0100

movabletype-opensource (4.2.6-1) unstable; urgency=low

  * New upstream release
  * Add missing ${misc:Depends} on debian/control (thanks, lintian)
  * Don't ignore errors in maintainer scripts (thanks, lintian)
  * Depend on libtheschwartz-perl and libdata-objectdriver-perl again
    and remove bundled copy
  * Pass --debconf-ok to ucf (closes: #519757)
  * Update Standards-Version (no changes)
  * Fix several bugs in the multiple instance suggested procedure in
    README.Debian (closes: #521114)

 -- Dominic Hargreaves <dom@earth.li>  Sat, 13 Jun 2009 15:47:52 +0100

movabletype-opensource (4.2.3-1) unstable; urgency=medium

  * Urgency medium due to security fixes
  * New upstream release: contains XSS security fixes and minor bugfixes

 -- Dominic Hargreaves <dom@earth.li>  Thu, 11 Dec 2008 20:00:05 +0000

movabletype-opensource (4.2.1-3) unstable; urgency=high

  * Urgency high due to security fix targetted at lenny
  * Fix multiple XSS issues (CVE-2008-4634). Thanks to Nico Golde for
    providing the patch, extracted from a release made by
    Six Apart KK (closes: #503114)

 -- Dominic Hargreaves <dom@earth.li>  Tue, 18 Nov 2008 17:55:33 +0000

movabletype-opensource (4.2.1-2) unstable; urgency=low

  * Fix SignIn widget by adapting JSON related code to new JSON.pm
    behaviour (closes: #498747). Thanks to Peter Gervai for the fix.

 -- Dominic Hargreaves <dom@earth.li>  Sat, 20 Sep 2008 23:50:53 +0100

movabletype-opensource (4.2.1-1) unstable; urgency=low

  * New upstream release (version 4.21)
    - fixes archive mapping bug (closes: #496776)
  * Change MTA dependencies to exim4 | mail-transport-agent. This is still
    not ideal but the best we can do pending a global fix (closes: #495858)

 -- Dominic Hargreaves <dom@earth.li>  Sun, 31 Aug 2008 22:01:39 +0100

movabletype-opensource (4.2-1) unstable; urgency=medium

  * New upstream final release
    - contains translation/doc updates and small bugfixes
  * Preserve urgency from previous release

 -- Dominic Hargreaves <dom@earth.li>  Wed, 13 Aug 2008 22:30:03 +0100

movabletype-opensource (4.2~rc5-1) unstable; urgency=medium

  * New upstream release candidate
  * Urgency medium as new release includes some preventative security fixes:
    http://www.movabletype.org/2008/08/movable_type_42_rc5_and_security_updates.html

 -- Dominic Hargreaves <dom@earth.li>  Sat,  9 Aug 2008 15:13:40 +0100

movabletype-opensource (4.2~rc4-1) unstable; urgency=low

  * New upstream release
  * Include SendMailPath explicitly as in some cases it seems
    to be required (closes: #491618)
  * Add versioned Depends on libclass-trigger-perl (>= 0.13-1)
    as the version in etch is not compatible with MT.

 -- Dominic Hargreaves <dom@earth.li>  Wed, 23 Jul 2008 22:56:37 +0100

movabletype-opensource (4.2~rc3-2) unstable; urgency=low

  * Set captcha image source path in default config (closes: #489306)
  * Add Depends on libclass-trigger-perl, libdbi-perl,
    libclass-data-inheritable-perl needed for bundled Data::ObjectDriver
    (closes: #489930)

 -- Dominic Hargreaves <dom@earth.li>  Tue,  8 Jul 2008 22:22:07 +0100

movabletype-opensource (4.2~rc3-1) unstable; urgency=low

  * New upstream release candidate
  * Add Swedish debconf translation (closes: #487739)
  * Include local versions of TheSchwartz and Data::ObjectDriver as
    MT distribution includes newer versions than on CPAN
  * Recommend libarchive-zip-perl

 -- Dominic Hargreaves <dom@earth.li>  Wed,  2 Jul 2008 01:52:49 +0100

movabletype-opensource (4.2~rc2-2) unstable; urgency=low

  * lib/MT/CMS/Entry.pm, lib/MT/CMS/Asset.pm: update JSON constructor
    calls to new API (closes: #486882)
  * Fix crazy typo in debian/control Depends

 -- Dominic Hargreaves <dom@earth.li>  Fri, 20 Jun 2008 00:25:02 +0100

movabletype-opensource (4.2~rc2-1) unstable; urgency=low

  * New upstream release candidate
  * Update Standards-Version (no changes)
  * Ensure that schema upgrade message is always seen

 -- Dominic Hargreaves <dom@earth.li>  Fri, 13 Jun 2008 23:28:40 +0100

movabletype-opensource (4.2~rc1-1) experimental; urgency=low

  * New upstream release candidate
    - Add Depends on liblucene-queryparser-perl
  * Add Depends on libjson-perl to movabletype-plugin-core to be
    strictly correct
  * Update debconf translations (closes: #475871, #478736, #480631, #483077,
    #483597, #478736, #483979, #475871)
  * Include schema upgrade notice when installing new upstream releases
  * Add exact versioned depends on movabletype-opensource to
    movabletype-plugin-core for safety
  * Add Galician, Czech, Basque, Japanese debconf translations
    (closes: #482579, #482803, #482852, #483203, #483513)
  * New debconf question to ask whether to reload Apache configuration
    and only reload it when we need to
  * Set permissions of SQLite database file so that web server can access
    it (closes: #484692)

 -- Dominic Hargreaves <dom@earth.li>  Sat,  7 Jun 2008 18:56:24 +0100

movabletype-opensource (4.1-6) unstable; urgency=low

  * patch plugins/StyleCatcher/lib/StyleCatcher/CMS.pm:
    - don't try and pass pretty-printing options in JSON call;
      they are not available in new JSON versions (closes: #476266)

 -- Dominic Hargreaves <dom@earth.li>  Tue, 15 Apr 2008 20:51:11 +0100

movabletype-opensource (4.1-5) unstable; urgency=high

  * Fix typo in default configuration causing files to be created
    with an insecure umask
  * Add German debconf translation (closes: #472670)
  * Add French debconf translation (closes: #474635)

 -- Dominic Hargreaves <dom@earth.li>  Thu, 10 Apr 2008 22:52:58 +0100

movabletype-opensource (4.1-4) unstable; urgency=low

  * Add Portuguese debconf translation (closes: #471955)

 -- Dominic Hargreaves <dom@earth.li>  Mon, 24 Mar 2008 12:44:27 +0000

movabletype-opensource (4.1-3) unstable; urgency=low

  * libdbd-sqlite-perl should be libdbd-sqlite3-perl
  * Add Provides: movabletype for more obvious installation

 -- Dominic Hargreaves <dom@earth.li>  Fri, 21 Mar 2008 10:31:33 +0000

movabletype-opensource (4.1-2) unstable; urgency=low

  * Fix permissions of configuration file (may include database
    passwords).
  * Move static content to /usr/share, and include an apache2 config
    snippet.
  * Fix behaviour of debconf prompting

 -- Dominic Hargreaves <dom@earth.li>  Tue, 11 Mar 2008 23:15:54 +0000

movabletype-opensource (4.1-1) unstable; urgency=low

  * Initial Release. (Closes: #427709)

 -- Dominic Hargreaves <dom@earth.li>  Thu,  6 Mar 2008 21:43:53 +0000
