Merge ~mateus-morais/ubuntu/+source/avahi:merge-0.8-14-plucky into ubuntu/+source/avahi:debian/sid

[Mateus Rodrigues de Morais]

Merging upstream avahi 0.8-14 on plucky.

PPA build for testing: https://launchpad.net/~mateus-morais/+archive/ubuntu/plucky-merges

Autopkgtests:
- amd64: [PASS](https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-mateus-morais-plucky-merges/plucky/amd64/a/avahi/20241204_125946_6a7ab@/log.gz)
- arm64: [PASS](https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-mateus-morais-plucky-merges/plucky/arm64/a/avahi/20241204_130300_c6ad4@/log.gz)
- armhf: [PASS](https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-mateus-morais-plucky-merges/plucky/armhf/a/avahi/20241204_131452_ac44b@/log.gz)
- ppc64el: [PASS](https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-mateus-morais-plucky-merges/plucky/ppc64el/a/avahi/20241204_133857_44ed8@/log.gz)
- s390x: [PASS](https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-mateus-morais-plucky-merges/plucky/s390x/a/avahi/20241204_145030_212b1@/log.gz)

[Nick Rosbrook (enr0n)]

Praise: thanks for carefully considering the security patches, and figuring out which ones we needed to keep, and for detailing everything nicely in the changelog.

LGTM, and sponsored.

review: Approve

[Mateus Rodrigues de Morais (mateus-morais)]

Thank you!

diff --git a/debian/changelog b/debian/changelog
index bd897d8..8b9d2b7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,52 @@
+avahi (0.8-14ubuntu1) plucky; urgency=medium
+
+  * Merge with Debian unstable (LP: #2090963). Remaining changes:
+    - Disable lto, see https://bugzilla.redhat.com/show_bug.cgi?id=1907727
+    - avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
+      avahi-client-fix-resource-leak.patch: Issues discovered by static
+      analysis (Upstream pull request #202)
+    - SECURITY UPDATE: Reachable assertions exist in domain functions in
+      avahi-common
+      + debian/patches/CVE-2023-38470-2.patch: bail out when escaped
+        labels can't fit into ret
+      + CVE-2023-38470
+    - SECURITY UPDATE: Reachable assertions exist in server functions in
+      avahi-core
+      + debian/patches/CVE-2023-38471-2.patch: core: return errors from
+        avahi_server_set_host_name properly
+      + CVE-2023-38471
+  * Dropped changes, included in Debian:
+    - SECURITY UPDATE: Reachable assertions exist in server functions of
+      avahi-core
+      + debian/patches/CVE-2023-38469-1.patch: reject overly long TXT
+        resource records
+      + debian/patches/CVE-2023-38469-2.patch: tests: pass overly long TXT
+        resource records
+      + CVE-2023-38469
+    - SECURITY UPDATE: Reachable assertions exist in domain functions in
+      avahi-common
+      + debian/patches/CVE-2023-38470-1.patch: Ensure each label is at least
+        one byte long
+    - SECURITY UPDATE: Reachable assertions exist in server functions in
+      avahi-core
+      + debian/patches/CVE-2023-38471-1.patch: core: extract host name using
+        avahi_unescape_label()
+    - SECURITY UPDATE: Reachable assertions exist in dbus functions in
+      avahi-daemon
+      + debian/patches/CVE-2023-38472.patch: core: make sure there is rdata
+        to process before parsing it
+      + CVE-2023-38472
+    - SECURITY UPDATE: Reachable assertions exist in alternative functions
+      in avahi-common
+      + debian/patches/CVE-2023-38473.patch: common: derive alternative host
+        name from its unescaped version
+      + CVE-2023-38473
+  * Dropped changes, no longer needed:
+    - avahi-autoipd: Demote isc-dhcp-client from Recommends to Suggests.
+      Debian dropped isc-dhcp-client from Recommends altogether.
+
+ -- Mateus Rodrigues de Morais <[e-mail]>  Tue, 03 Dec 2024 17:57:06 -0300
+
 avahi (0.8-14) unstable; urgency=medium
 
   [ Simon McVittie ]
@@ -48,6 +97,81 @@ avahi (0.8-14) unstable; urgency=medium
 
  -- Michael Biebl <[e-mail]>  Sat, 30 Nov 2024 22:54:34 +0100
 
+avahi (0.8-13ubuntu6) noble; urgency=medium
+
+  * avahi-autoipd: Demote isc-dhcp-client from Recommends to Suggests
+    (LP: #2058242)
+
+ -- Benjamin Drung <[e-mail]>  Fri, 05 Apr 2024 12:57:26 +0200
+
+avahi (0.8-13ubuntu5) noble; urgency=medium
+
+  * No-change rebuild for CVE-2024-3094
+
+ -- Steve Langasek <[e-mail]>  Sun, 31 Mar 2024 07:28:17 +0000
+
+avahi (0.8-13ubuntu4) noble; urgency=medium
+
+  * No-change rebuild against libglib2.0-0t64
+
+ -- Steve Langasek <[e-mail]>  Mon, 11 Mar 2024 22:03:07 +0000
+
+avahi (0.8-13ubuntu3) noble; urgency=medium
+
+  * No-change rebuild against libglib2.0-0t64
+
+ -- Steve Langasek <[e-mail]>  Fri, 08 Mar 2024 03:51:49 +0000
+
+avahi (0.8-13ubuntu2) noble; urgency=medium
+
+  * SECURITY UPDATE: Reachable assertions exist in server functions of
+    avahi-core
+    - debian/patches/CVE-2023-38469-1.patch: reject overly long TXT
+      resource records
+    - debian/patches/CVE-2023-38469-2.patch: tests: pass overly long TXT
+      resource records
+    - CVE-2023-38469
+
+  * SECURITY UPDATE: Reachable assertions exist in domain functions in
+    avahi-common
+    - debian/patches/CVE-2023-38470-1.patch: Ensure each label is at least
+      one byte long
+    - debian/patches/CVE-2023-38470-2.patch: bail out when escaped labels
+      can't fit into ret
+    - CVE-2023-38470
+
+  * SECURITY UPDATE: Reachable assertions exist in server functions in
+    avahi-core
+    - debian/patches/CVE-2023-38471-1.patch: core: extract host name using
+      avahi_unescape_label()
+    - debian/patches/CVE-2023-38471-2.patch: core: return errors from
+      avahi_server_set_host_name properly
+    - CVE-2023-38471
+
+  * SECURITY UPDATE: Reachable assertions exist in dbus functions in
+    avahi-daemon
+    - debian/patches/CVE-2023-38472.patch: core: make sure there is rdata
+      to process before parsing it
+    - CVE-2023-38472
+
+  * SECURITY UPDATE: Reachable assertions exist in alternative functions
+    in avahi-common
+    - debian/patches/CVE-2023-38473.patch: common: derive alternative host
+      name from its unescaped version
+    - CVE-2023-38473
+
+ -- Nick Galanis <[e-mail]>  Mon, 20 Nov 2023 13:51:34 +0200
+
+avahi (0.8-13ubuntu1) noble; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Disable lto, see https://bugzilla.redhat.com/show_bug.cgi?id=1907727
+    - avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
+      avahi-client-fix-resource-leak.patch: Issues discovered by static analysis
+      (Upstream pull request #202)
+
+ -- Nick Rosbrook <[e-mail]>  Thu, 16 Nov 2023 15:20:09 -0500
+
 avahi (0.8-13) unstable; urgency=medium
 
   * Team upload
@@ -129,6 +253,25 @@ avahi (0.8-11) unstable; urgency=medium
 
  -- Michael Biebl <[e-mail]>  Thu, 07 Sep 2023 21:43:48 +0200
 
+avahi (0.8-10ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2020383). Remaining changes:
+    + Disable lto, see https://bugzilla.redhat.com/show_bug.cgi?id=1907727
+    + avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
+      avahi-client-fix-resource-leak.patch: Issues discovered by static analysis
+      (Upstream pull request #202)
+  * Dropped changes, included in Debian:
+    + avoid-infinite-loop-in-avahi-daemon-by-handling-hup-event-in-client-work.patch:
+      Avoid infinite-loop in avahi-daemon by handling HUP event in client_work()
+      (Upstream pull request #330)
+  * Dropped changes, no longer needed:
+    + debian/avahi-daemon.postinst: remove the deprecated conffiles
+      if-up/down entries on upgrade, use a simple logic and no
+      dpkg-maintscript-helper since there is no configuration worth saving
+      (All releases from which upgrades are supported have a new enough version)
+
+ -- Nick Rosbrook <[e-mail]>  Tue, 23 May 2023 10:02:00 -0400
+
 avahi (0.8-10) unstable; urgency=medium
 
   [ Felix Geyer ]
@@ -190,6 +333,24 @@ avahi (0.8-7) unstable; urgency=medium
 
  -- Michael Biebl <[e-mail]>  Tue, 10 Jan 2023 09:33:02 +0100
 
+avahi (0.8-6ubuntu1) kinetic; urgency=medium
+
+  * Merge from Debian unstable, remaining changes:
+    + debian/avahi-daemon.postinst: remove the deprecated conffiles
+      if-up/down entries on upgrade, use a simple logic and no
+      dpkg-maintscript-helper since there is no configuration worth saving
+    + Disable lto, see https://bugzilla.redhat.com/show_bug.cgi?id=1907727
+    + avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
+      avahi-client-fix-resource-leak.patch: Issues discovered by static analysis
+      (Upstream pull request #202)
+    + avoid-infinite-loop-in-avahi-daemon-by-handling-hup-event-in-client-work.patch:
+      Avoid infinite-loop in avahi-daemon by handling HUP event in client_work()
+      (Upstream pull request #330)
+  * Dropped changes, included in Debian:
+    + SECURITY UPDATE: DoS in avahi_s_host_name_resolver_start
+
+ -- Graham Inggs <[e-mail]>  Mon, 22 Aug 2022 12:33:46 +0000
+
 avahi (0.8-6) unstable; urgency=medium
 
   [ Luca Boccassi ]
@@ -216,6 +377,50 @@ avahi (0.8-6) unstable; urgency=medium
 
  -- Michael Biebl <[e-mail]>  Sun, 05 Jun 2022 18:33:10 +0200
 
+avahi (0.8-5ubuntu5) jammy; urgency=medium
+
+  * No-change rebuild for ppc64el baseline bump.
+
+ -- Łukasz 'sil2100' Zemczak <[e-mail]>  Wed, 23 Mar 2022 10:42:05 +0100
+
+avahi (0.8-5ubuntu4) impish; urgency=medium
+
+  * SECURITY UPDATE: DoS in avahi_s_host_name_resolver_start
+    - debian/patches/CVE-2021-3502.patch: fix multiple null pointer crashes
+      in avahi-core/browse-dns-server.c, avahi-core/browse-domain.c,
+      avahi-core/browse-service-type.c, avahi-core/browse-service.c,
+      avahi-core/browse.c, avahi-core/resolve-address.c,
+      avahi-core/resolve-host-name.c, avahi-core/resolve-service.c.
+    - CVE-2021-3502
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 06 Jul 2021 10:13:47 -0400
+
+avahi (0.8-5ubuntu3) hirsute; urgency=medium
+
+  * avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch,
+    avahi-client-fix-resource-leak.patch: Issues discovered by static analysis
+    (Upstream pull request #202).
+  * avoid-infinite-loop-in-avahi-daemon-by-handling-hup-event-in-client-work.patch:
+    Avoid infinite-loop in avahi-daemon by handling HUP event in client_work()
+    (Upstream pull request #330).
+
+ -- Till Kamppeter <[e-mail]>  Thu,  8 Apr 2021 15:24:07 +0200
+
+avahi (0.8-5ubuntu2) hirsute; urgency=medium
+
+  * Disable lto. See https://bugzilla.redhat.com/show_bug.cgi?id=1907727.
+
+ -- Matthias Klose <[e-mail]>  Mon, 22 Mar 2021 20:47:51 +0100
+
+avahi (0.8-5ubuntu1) hirsute; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/avahi-daemon.postinst: remove the deprecated conffiles
+      if-up/down entries on upgrade, use a simple logic and no
+      dpkg-maintscript-helper since there is no configuration worth saving
+
+ -- Till Kamppeter <[e-mail]>  Wed, 24 Feb 2021 23:53:07 +0100
+
 avahi (0.8-5) unstable; urgency=medium
 
   * d/avahi-daemon.maintscript: Drop removal of symlink, they're not normal
@@ -237,6 +442,25 @@ avahi (0.8-4) unstable; urgency=medium
 
  -- Sjoerd Simons <[e-mail]>  Fri, 05 Feb 2021 09:21:16 +0100
 
+avahi (0.8-3ubuntu2) hirsute; urgency=medium
+
+  * debian/avahi-daemon.links:
+    - remove buggy symlink, the target doesn't exist anymore (lp: #1901090)
+  * debian/avahi-daemon.postinst:
+    - remove the deprecated conffiles if-up/down entries on upgrade,
+      use a simple logic and no dpkg-maintscript-helper since there is no
+      configuration worth saving
+
+ -- Sebastien Bacher <[e-mail]>  Tue, 10 Nov 2020 15:03:56 +0100
+
+avahi (0.8-3ubuntu1) groovy; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Remove avahi-daemon-check-dns.sh hack, the feature is provided by
+      libnss-mdns now
+
+ -- Steve Langasek <[e-mail]>  Tue, 09 Jun 2020 13:47:56 -0700
+
 avahi (0.8-3) unstable; urgency=medium
 
   * Team upload
@@ -279,6 +503,25 @@ avahi (0.8-2) experimental; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Sun, 24 May 2020 11:20:46 +0100
 
+avahi (0.8-1ubuntu1) groovy; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Remove avahi-daemon-check-dns.sh hack, the feature is provided by
+      libnss-mdns now
+  * Dropped changes, included upstream:
+     - debian/patches/CVE-2017-6519-and-CVE-2018-1000845.patch:
+       fix in avahi-core/server.c.
+    - debian/patches/local-only-services-support.patch:
+      replaced by the upstream commited version, part of the code which
+      was there to workaround a ippusbxd issue has been removed since
+      the problem has been resolved in cups now
+    - local-only-services-support.patch: Added support for advertising
+  * Dropped changes:
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, for
+      maas-enlist-udeb: dropped, d-i no longer used for installing maas.
+
+ -- Steve Langasek <[e-mail]>  Wed, 20 May 2020 15:00:00 -0700
+
 avahi (0.8-1) unstable; urgency=medium
 
   * Team upload
@@ -360,6 +603,63 @@ avahi (0.7-5) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Fri, 13 Dec 2019 16:00:32 +0000
 
+avahi (0.7-4ubuntu7) focal; urgency=medium
+
+  * Remove avahi-daemon-check-dns.sh hack, the feature is provided by
+    libnss-mdns now (lp: #1870824)
+  * debian/patches/local-only-services-support.patch:
+    - replaced by the upstream commited version, part of the code which
+      was there to workaround a ippusbxd issue has been removed since
+      the problem has been resolved in cups now
+
+ -- Sebastien Bacher <[e-mail]>  Wed, 08 Apr 2020 13:43:27 +0200
+
+avahi (0.7-4ubuntu6) focal; urgency=medium
+
+  * No-change rebuild to generate dependencies on python2.
+
+ -- Matthias Klose <[e-mail]>  Tue, 17 Dec 2019 12:30:55 +0000
+
+avahi (0.7-4ubuntu5) disco; urgency=medium
+
+  * SECURITY UPDATE: Denial of service
+    - debian/patches/CVE-2017-6519-and-CVE-2018-1000845.patch:
+      fix in avahi-core/server.c.
+    - CVE-2017-6519
+    - CVE-2018-1000845
+
+ -- Leonidas S. Barbosa <[e-mail]>  Wed, 30 Jan 2019 12:33:23 -0300
+
+avahi (0.7-4ubuntu4) disco; urgency=medium
+
+  * No-change rebuild against latest binid9
+
+ -- Jeremy Bicha <[e-mail]>  Fri, 14 Dec 2018 17:25:36 -0500
+
+avahi (0.7-4ubuntu3) disco; urgency=medium
+
+  * Rebuild against new libgdbm6.
+
+ -- Gianfranco Costamagna <[e-mail]>  Sat, 03 Nov 2018 15:15:41 +0100
+
+avahi (0.7-4ubuntu2) cosmic; urgency=medium
+
+  * debian/avahi-daemon-check-dns.sh: On some hardware, the 'host'
+    command gets stuck and does not timeout as it should leaving this script
+    and boot-up hanging indefinitely. Launch host with 'timeout' to kill it
+    after 5 seconds in these cases as a workaround. (LP #1752411)
+
+ -- Trent Lloyd <[e-mail]>  Tue, 21 Aug 2018 14:56:18 +0800
+
+avahi (0.7-4ubuntu1) cosmic; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, for
+      maas-enlist-udeb.
+    - local-only-services-support.patch: Added support for advertising
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 04 May 2018 09:53:20 +0200
+
 avahi (0.7-4) unstable; urgency=medium
 
   * Team upload
@@ -380,6 +680,15 @@ avahi (0.7-4) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Fri, 27 Apr 2018 11:59:11 +0100
 
+avahi (0.7-3.1ubuntu1) bionic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, for
+      maas-enlist-udeb.
+    - local-only-services-support.patch: Added support for advertising
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 02 Feb 2018 15:56:06 +0100
+
 avahi (0.7-3.1) unstable; urgency=medium
 
   * Non-maintainer upload.
@@ -389,6 +698,25 @@ avahi (0.7-3.1) unstable; urgency=medium
 
  -- Gianfranco Costamagna <[e-mail]>  Fri, 02 Feb 2018 15:51:42 +0100
 
+avahi (0.7-3ubuntu2) bionic; urgency=low
+
+  * local-only-services-support.patch: Added support for advertising
+    local-only services on the loopback ("lo", "localhost") device. This
+    is especially needed for making CUPS and cups-browsed auto-discover
+    IPP-over-USB printers using ippusbxd (LP: #1736757, Upstream issue #125).
+
+ -- Till Kamppeter <[e-mail]>  Tue,  9 Jan 2017 21:35:51 -0200
+
+avahi (0.7-3ubuntu1) bionic; urgency=low
+
+  * Merge from Debian unstable (LP: #1735960).  Remaining changes:
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, for
+      maas-enlist-udeb.
+  * debian/patches/no-systemd-also.patch: Don't use 'Also=' in dnsconfd
+    systemd unit.  Closes: #878911.
+
+ -- Steve Langasek <[e-mail]>  Tue, 02 Jan 2018 17:27:56 -0800
+
 avahi (0.7-3) unstable; urgency=medium
 
   * Brown paper bag release.
@@ -457,6 +785,14 @@ avahi (0.6.32-2) unstable; urgency=medium
 
  -- Michael Biebl <[e-mail]>  Mon, 23 Jan 2017 09:41:58 +0100
 
+avahi (0.6.32-1ubuntu1) yakkety; urgency=medium
+
+  * Merge from Debian unstable, remaining changes:
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, for
+      maas-enlist-udeb.
+
+ -- Martin Pitt <[e-mail]>  Mon, 04 Jul 2016 15:27:54 +0200
+
 avahi (0.6.32-1) unstable; urgency=medium
 
   [ Michael Biebl ]
@@ -480,6 +816,34 @@ avahi (0.6.32-1) unstable; urgency=medium
 
  -- Michael Biebl <[e-mail]>  Mon, 27 Jun 2016 22:54:00 +0200
 
+avahi (0.6.32~rc+dfsg-1ubuntu2) xenial; urgency=medium
+
+  * Put back libavahi-common3-udeb and libavahi-core7-udeb, they are being
+    used by maas-enlist-udeb.
+
+ -- Martin Pitt <[e-mail]>  Tue, 24 Nov 2015 11:32:59 +0100
+
+avahi (0.6.32~rc+dfsg-1ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable, remaining changes:
+    - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart,
+      debian/avahi-cups-reload.upstart
+  * Dropped Ubuntu changes:
+    - debian/control: Add versioned dependency on the dbus that satisfies our
+      upstart job dependency. This happened before precise already.
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+      that we can use them for Eucalyptus integration in the installer.
+      Eucalyptus is long gone, and these udebs haven't been used in a long
+      time.
+    - d/p/skip-nproc-in-container.patch: Detect whether we are running in a
+      container, and do not set rlimit_nproc if so. Current LXC does not
+      create /run/container_type any more so the patch is a no-op. It's also
+      not necessary any more as avahi does not fail if it cannot set the
+      rlimit.
+  * Drop obsolete dh_installinit --upstart-only option. (LP: #1519228)
+
+ -- Martin Pitt <[e-mail]>  Tue, 24 Nov 2015 09:17:30 +0100
+
 avahi (0.6.32~rc+dfsg-1) unstable; urgency=medium
 
   * Team upload.
@@ -515,6 +879,48 @@ avahi (0.6.31-5) unstable; urgency=medium
 
  -- Michael Biebl <[e-mail]>  Mon, 13 Apr 2015 21:51:24 +0200
 
+avahi (0.6.31-4ubuntu4) vivid; urgency=medium
+
+  * No change rebuild to get debug symbols on all architectures.
+
+ -- Brian Murray <[e-mail]>  Mon, 17 Nov 2014 09:22:40 -0800
+
+avahi (0.6.31-4ubuntu3) utopic; urgency=medium
+
+  * Drop upstart dependency. We ship init scripts for sysv, upstart, and
+    systemd now. (LP: #1351306)
+
+ -- Martin Pitt <[e-mail]>  Fri, 01 Aug 2014 15:16:40 +0200
+
+avahi (0.6.31-4ubuntu2) utopic; urgency=high
+
+  * No change rebuild against new dh_installinit, to call update-rc.d at
+    postinst.
+
+ -- Dimitri John Ledkov <[e-mail]>  Wed, 28 May 2014 10:39:06 +0100
+
+avahi (0.6.31-4ubuntu1) trusty; urgency=medium
+
+  * Merge from Debian unstable, remaining changes:
+    - debian/control: Add versioned dependency on the dbus that satisfies our
+      upstart job dependency.
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+      that we can use them for Eucalyptus integration in the installer.
+    - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart,
+      debian/avahi-cups-reload.upstart
+    - d/p/skip-nproc-in-container.patch: Detect whether we are running in a
+      container, and do not set rlimit_nproc if so.
+  * Dropped changes, included in Debian:
+    - d/p/so_reuseport-may-not-exist-in-running-kernel.patch:  If
+      SO_REUSEPORT returns ENOPROTOOPT, continue as if we did not have the
+      call at all.
+    - d/p/avahi-core-reserve-space-for-record-data-when-size-estimate.patch:
+      fix a bug where avahi will use 100% CPU after cups is restarted.
+    - Add two new symbols to libavahi-core7.symbols file.
+    - d/p/suse-patch-gtk-box.patch: Use gtk_box API.
+
+ -- Steve Langasek <[e-mail]>  Tue, 31 Dec 2013 00:04:39 -0800
+
 avahi (0.6.31-4) unstable; urgency=medium
 
   * Team upload.
@@ -533,6 +939,31 @@ avahi (0.6.31-4) unstable; urgency=medium
 
  -- Laurent Bigonville <[e-mail]>  Thu, 26 Dec 2013 18:24:41 +0100
 
+avahi (0.6.31-3ubuntu1) trusty; urgency=medium
+
+  * Merge from Debian unstable, remaining changes:
+    - debian/control: Add versioned dependency on the dbus that satisfies our
+      upstart job dependency.
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+      that we can use them for Eucalyptus integration in the installer.
+    - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart,
+      debian/avahi-cups-reload.upstart
+    - d/p/avahi-core-reserve-space-for-record-data-when-size-estimate.patch:
+      fix a bug where avahi will use 100% CPU after cups is restarted.
+    - d/p/suse-patch-gtk-box.patch: Use gtk_box API.
+    - Add two new symbols to libavahi-core7.symbols file.
+    - d/p/so_reuseport-may-not-exist-in-running-kernel.patch:  If
+      SO_REUSEPORT returns ENOPROTOOPT, continue as if we did not have the
+      call at all.
+    - d/p/skip-nproc-in-container.patch: Detect whether we are running in a
+      container, and do not set rlimit_nproc if so.
+  * Dropped changes, included in Debian:
+    - Build-depend on and use dh_autotools-dev to fix FTBFS on new arches.
+    - debian/avahi-{daemon,dnsconfd}.links: Remove systemd configuration
+      symlinks.  Superseded by dh-systemd.
+
+ -- Steve Langasek <[e-mail]>  Fri, 13 Dec 2013 15:56:07 -0800
+
 avahi (0.6.31-3) unstable; urgency=low
 
   * Team upload.
@@ -561,6 +992,55 @@ avahi (0.6.31-3) unstable; urgency=low
 
  -- Laurent Bigonville <[e-mail]>  Sat, 07 Dec 2013 16:24:13 +0100
 
+avahi (0.6.31-2ubuntu5) trusty; urgency=low
+
+  * d/p/skip-nproc-in-container.patch: Detect whether we are running in a
+    container, and do not set rlimit_nproc if so (LP: #1251257)
+
+ -- Serge Hallyn <[e-mail]>  Mon, 18 Nov 2013 20:44:14 +0000
+
+avahi (0.6.31-2ubuntu4) saucy; urgency=low
+
+  * When userspace defines SO_REUSEPORT we will attempt to enable socket
+    port number reuse.  However if the running kernel does not support
+    this call it will fail preventing daemon startup.  If this call is
+    present but fails ENOPROTOOPT then we know that actually the kernel
+    does not support it and we should continue as if we did not have the
+    call at all.  (LP: #1228204)
+
+ -- Andy Whitcroft <[e-mail]>  Fri, 20 Sep 2013 16:07:36 +0100
+
+avahi (0.6.31-2ubuntu3) saucy; urgency=low
+
+  * Build-depend on and use dh_autotools-dev to fix FTBFS on new arches.
+
+ -- Adam Conrad <[e-mail]>  Fri, 13 Sep 2013 20:27:08 -0400
+
+avahi (0.6.31-2ubuntu2) saucy; urgency=low
+
+  * Use gkt_box API, using patch from SUSE. Thus fixing assignments that
+    make pointers from integers without a cast.
+  * Add two new symbols to libavahi-core7.symbols file.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Thu, 30 May 2013 17:03:51 +0100
+
+avahi (0.6.31-2ubuntu1) saucy; urgency=low
+
+  * Merge with Debian unstable.  Remaining changes:
+    - debian/control: Add versioned dependency on the dbus that satisfies our
+      upstart job dependency.
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+      that we can use them for Eucalyptus integration in the installer.
+    - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart
+    - debian/avahi-{daemon,dnsconfd}.links: Remove systemd configuration
+      symlinks.
+    - Apply a patch
+      avahi-core-reserve-space-for-record-data-when-size-estimate.patch to
+      fix http://pad.lv/1059286 .
+    - Add avahi-cups-reload.upstart job, to refresh remote queues.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Thu, 30 May 2013 15:46:06 +0100
+
 avahi (0.6.31-2) unstable; urgency=low
 
   * Use recommended maintscript versioning scheme.
@@ -572,6 +1052,46 @@ avahi (0.6.31-2) unstable; urgency=low
 
  -- Michael Biebl <[e-mail]>  Wed, 06 Mar 2013 22:58:55 +0100
 
+avahi (0.6.31-1ubuntu3) raring; urgency=low
+
+  * Reload cups to refresh remote queues, when avahi-daemon starts. (LP:
+    #1158686). Until cups learns to reconnect to avahi by itself
+    https://www.cups.org/str.php?L4300 .
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Fri, 22 Mar 2013 10:49:47 +0000
+
+avahi (0.6.31-1ubuntu2) quantal-proposed; urgency=low
+
+  * debian/patches/avahi-core-reserve-space-for-record-data-when-size-estimate.patch:
+    avahi-core: reserve space for record data when size estimate. This
+    prevents avahi-daemon from falling into an invalid loop when many CUPS/IPP
+    printer shares get registered (LP: #1059286,
+    http://lists.freedesktop.org/archives/avahi/2012-September/002188.html).
+
+ -- Till Kamppeter <[e-mail]>  Mon,  8 Oct 2012 22:23:00 +0200
+
+avahi (0.6.31-1ubuntu1) quantal; urgency=low
+
+  * Merge with Debian unstable.  Remaining changes:
+    - debian/control: Add versioned dependency on the dbus that satisfies our
+      upstart job dependency.
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+      that we can use them for Eucalyptus integration in the installer.
+    - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart
+    - debian/avahi-{daemon,dnsconfd}.links: Remove systemd configuration
+      symlinks.
+  * Dropped changes
+    - debian/avahi-autoipd.{pre,post}inst: Adjust package versions for conffile
+      migration for the version when Ubuntu did the DHCP4 migration. We're now
+      one LTS cycle since this, so there's no need to keep code paths for this
+      upgrade.
+    - Build with CFLAGS=-UGTK_DISABLE_DEPRECATED due to deprecation of
+      gtk_vbox_new. No longer necessary.
+    - Pass CFLAGS from the environment through to configure. Seems to be no
+      longer necessary with the move to compat 9.
+
+ -- Iain Lane <[e-mail]>  Tue, 22 May 2012 22:21:27 +0100
+
 avahi (0.6.31-1) unstable; urgency=low
 
   * New upstream release.
@@ -593,6 +1113,33 @@ avahi (0.6.30-6) unstable; urgency=low
 
  -- Michael Biebl <[e-mail]>  Tue, 10 Jan 2012 00:59:49 +0100
 
+avahi (0.6.30-5ubuntu2) precise; urgency=low
+
+  * Build using dh_python2.
+
+ -- Matthias Klose <[e-mail]>  Sat, 17 Dec 2011 12:06:42 +0100
+
+avahi (0.6.30-5ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - Build with CFLAGS=-UGTK_DISABLE_DEPRECATED due to deprecation of
+      gtk_vbox_new.
+    - debian/control: Add versioned dependency on the dbus that satisfies our
+      upstart job dependency.
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+      that we can use them for Eucalyptus integration in the installer.
+    - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart
+    - debian/avahi-autoipd.{pre,post}inst: Adjust package versions for conffile
+      migration for the version when Ubuntu did the DHCP4 migration. This needs
+      to be kept until after the next LTS.
+    - debian/avahi-{daemon,dnsconfd}.links: Remove systemd configuration
+      symlinks.
+  * Pass CFLAGS from the environment through to configure.  This by default
+    will turn on optimisations and debug symbol generation, both of which
+    are currently disabled.
+
+ -- Christopher James Halse Rogers <[e-mail]>  Tue, 18 Oct 2011 14:46:25 +1100
+
 avahi (0.6.30-5) unstable; urgency=low
 
   * debian/control: Make python-avahi Architecture: any so the path to
@@ -601,12 +1148,50 @@ avahi (0.6.30-5) unstable; urgency=low
 
  -- Michael Biebl <[e-mail]>  Sat, 02 Jul 2011 10:37:15 +0200
 
+avahi (0.6.30-4ubuntu1) oneiric; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Build with CFLAGS=-UGTK_DISABLE_DEPRECATED due to deprecation of
+      gtk_vbox_new.
+    - debian/control: Add versioned dependency on the dbus that satisfies our
+      upstart job dependency.
+    - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+      that we can use them for Eucalyptus integration in the installer.
+    - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart
+    - debian/avahi-autoipd.{pre,post}inst: Adjust package versions for conffile
+      migration for the version when Ubuntu did the DHCP4 migration. This needs
+      to be kept until after the next LTS.
+    - debian/avahi-{daemon,dnsconfd}.links: Remove systemd configuration
+      symlinks.
+
+ -- Steve Langasek <[e-mail]>  Fri, 01 Jul 2011 13:29:42 +0000
+
 avahi (0.6.30-4) unstable; urgency=low
 
   * Add multiarch support. Patch courtesy of Steve Langasek. (Closes: #631836)
 
  -- Michael Biebl <[e-mail]>  Fri, 01 Jul 2011 02:28:05 +0200
 
+avahi (0.6.30-3ubuntu3) oneiric; urgency=low
+
+  * Build with CFLAGS=-UGTK_DISABLE_DEPRECATED due to deprecation of
+    gtk_vbox_new.
+
+ -- Steve Langasek <[e-mail]>  Mon, 27 Jun 2011 10:41:14 +0000
+
+avahi (0.6.30-3ubuntu2) oneiric; urgency=low
+
+  * No-change rebuild to get consistent changelog files for multiarch.
+
+ -- Steve Langasek <[e-mail]>  Mon, 27 Jun 2011 09:21:11 +0100
+
+avahi (0.6.30-3ubuntu1) oneiric; urgency=low
+
+  * Merge with Debian to get GTK 3 support. See 0.6.30-2ubuntu1 for remaining
+    Ubuntu changes.
+
+ -- Martin Pitt <[e-mail]>  Mon, 16 May 2011 21:46:44 +0200
+
 avahi (0.6.30-3) unstable; urgency=low
 
   * Enable GTK3 support. (Closes: #610772)
@@ -618,6 +1203,28 @@ avahi (0.6.30-3) unstable; urgency=low
 
  -- Michael Biebl <[e-mail]>  Fri, 29 Apr 2011 16:50:38 +0200
 
+avahi (0.6.30-2ubuntu1) oneiric; urgency=low
+
+  * Merge with Debian unstable; remaining Ubuntu changes:
+   - debian/control: Add versioned dependency on the dbus that satisfies our
+     upstart job dependency.
+   - Add udebs corresponding to libavahi-common3 and libavahi-core7, so
+     that we can use them for Eucalyptus integration in the installer.
+   - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart
+   - debian/avahi-autoipd.{pre,post}inst: Adjust package versions for conffile
+     migration for the version when Ubuntu did the DHCP4 migration. This needs
+     to be kept until after the next LTS.
+   - debian/avahi-{daemon,dnsconfd}.links: Remove systemd configuration
+     symlinks.
+   - Multiarch support:
+     + debian/compat: Move to dh compat 9.
+     + debian/control: Add Multi-Arch: tags, bump debhelper build
+       dependency to debhelper which supports Multiarch, and add
+       ${misc:Pre-Depends} fields.
+     + debian/*.install: Update path to libraries, pkg-config files, etc.
+
+ -- Martin Pitt <[e-mail]>  Thu, 28 Apr 2011 22:03:23 +0200
+
 avahi (0.6.30-2) unstable; urgency=low
 
   * Remove Qt3 integration library. With KDE3 gone, there is no more package
@@ -665,6 +1272,53 @@ avahi (0.6.28-5) unstable; urgency=low
 
  -- Michael Biebl <[e-mail]>  Mon, 07 Mar 2011 10:35:51 +0100
 
+avahi (0.6.30-0ubuntu2) natty; urgency=low
+
+  * Reapply multiarch patches, on the wrong branch again Make python-avahi
+  * Architecture: any, since the substituted path to the arch-specific .db
+    file will be arch-specific. LP: #743438.
+
+ -- Steve Langasek <[e-mail]>  Wed, 06 Apr 2011 16:13:36 -0700
+
+avahi (0.6.30-0ubuntu1) natty; urgency=low
+
+  * New upstream version, fixes `iface > 0' assertion errors (lp: #743031)
+  * debian/patches/02_avahi-discover.patch:
+    - the patch is in the new version
+
+ -- Sebastien Bacher <[e-mail]>  Tue, 05 Apr 2011 16:12:15 +0200
+
+avahi (0.6.29-0ubuntu2) natty; urgency=low
+
+  * FFe LP: #733501: build for multiarch.
+
+ -- Steve Langasek <[e-mail]>  Thu, 24 Mar 2011 21:27:33 -0700
+
+avahi (0.6.29-0ubuntu1) natty; urgency=low
+
+  * New upstream release
+  * debian/patches/02_avahi-discover.patch:
+    - Fix avahi-discover
+  * debian/patches/03_read_null_udp_packets.patch:
+    - Applied upstream
+
+ -- Robert Ancell <[e-mail]>  Wed, 09 Mar 2011 12:29:14 +1100
+
+avahi (0.6.28-4ubuntu1) natty; urgency=low
+
+  * Resynchronise with Debian. Remaining Ubuntu changes:
+   - debian/control:
+     + Add versioned dependency on the dbus that satisfies our upstart job
+       dependency.
+     + Add udebs corresponding to libavahi-common3 and libavahi-core6, so
+       that we can use them for Eucalyptus integration in the installer.
+   - Add debian/avahi-daemon.upstart, debian/avahi-dnsconfd.upstart
+   - debian/avahi-autoipd.{pre,post}inst: Adjust package versions for conffile
+     migration for the version when Ubuntu did the DHCP4 migration. This needs
+     to be kept until after the next LTS.
+
+ -- Martin Pitt <[e-mail]>  Thu, 24 Feb 2011 18:57:28 +0100
+
 avahi (0.6.28-4) unstable; urgency=high
 
   * Bump debhelper compatibility level to 8 and update build dependency
@@ -1583,7 +2237,6 @@ avahi (0.6.13-3) unstable; urgency=low
 
  -- Sjoerd Simons <[e-mail]>  Sun,  3 Sep 2006 19:27:13 +0200
 
-
 avahi (0.6.13-2) unstable; urgency=low
 
   * debian/patches/02_static-hosts.patch:
@@ -1950,3 +2603,4 @@ avahi (0.1-1) breezy; urgency=low
   * Thanks to Trent Lloyd for reviewing the packages.
 
  -- Ross Burton <[e-mail]>  Tue, 23 Aug 2005 09:29:46 +0100
+
diff --git a/debian/control b/debian/control
index 6eea719..427b2e2 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: avahi
 Section: net
 Priority: optional
-Maintainer: Utopia Maintenance Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Utopia Maintenance Team <[e-mail]>
 Uploaders: Sjoerd Simons <[e-mail]>,
            Sebastian Dröge <[e-mail]>,
            Loic Minier <[e-mail]>,
diff --git a/debian/patches/CVE-2023-38470-2.patch b/debian/patches/CVE-2023-38470-2.patch
new file mode 100644
index 0000000..c3596e3
--- /dev/null
+++ b/debian/patches/CVE-2023-38470-2.patch
@@ -0,0 +1,48 @@
+From 20dec84b2480821704258bc908e7b2bd2e883b24 Mon Sep 17 00:00:00 2001
+From: Evgeny Vereshchagin <[e-mail]>
+Date: Tue, 19 Sep 2023 03:21:25 +0000
+Subject: [PATCH] [common] bail out when escaped labels can't fit into ret
+
+Fixes:
+```
+==93410==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f9e76f14c16 at pc 0x00000047208d bp 0x7ffee90a6a00 sp 0x7ffee90a61c8
+READ of size 1110 at 0x7f9e76f14c16 thread T0
+    #0 0x47208c in __interceptor_strlen (out/fuzz-domain+0x47208c) (BuildId: 731b20c1eef22c2104e75a6496a399b10cfc7cba)
+    #1 0x534eb0 in avahi_strdup avahi/avahi-common/malloc.c:167:12
+    #2 0x53862c in avahi_normalize_name_strdup avahi/avahi-common/domain.c:226:12
+```
+and
+```
+fuzz-domain: fuzz/fuzz-domain.c:38: int LLVMFuzzerTestOneInput(const uint8_t *, size_t): Assertion `avahi_domain_equal(s, t)' failed.
+==101571== ERROR: libFuzzer: deadly signal
+    #0 0x501175 in __sanitizer_print_stack_trace (/home/vagrant/avahi/out/fuzz-domain+0x501175) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8)
+    #1 0x45ad2c in fuzzer::PrintStackTrace() (/home/vagrant/avahi/out/fuzz-domain+0x45ad2c) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8)
+    #2 0x43fc07 in fuzzer::Fuzzer::CrashCallback() (/home/vagrant/avahi/out/fuzz-domain+0x43fc07) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8)
+    #3 0x7f1581d7ebaf  (/lib64/libc.so.6+0x3dbaf) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
+    #4 0x7f1581dcf883 in __pthread_kill_implementation (/lib64/libc.so.6+0x8e883) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
+    #5 0x7f1581d7eafd in gsignal (/lib64/libc.so.6+0x3dafd) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
+    #6 0x7f1581d6787e in abort (/lib64/libc.so.6+0x2687e) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
+    #7 0x7f1581d6779a in __assert_fail_base.cold (/lib64/libc.so.6+0x2679a) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
+    #8 0x7f1581d77186 in __assert_fail (/lib64/libc.so.6+0x36186) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
+    #9 0x5344a4 in LLVMFuzzerTestOneInput /home/vagrant/avahi/fuzz/fuzz-domain.c:38:9
+```
+
+It's a follow-up to 94cb6489114636940ac683515417990b55b5d66c
+---
+ avahi-common/domain.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+Index: avahi-0.8/avahi-common/domain.c
+===================================================================
+--- avahi-0.8.orig/avahi-common/domain.c
++++ avahi-0.8/avahi-common/domain.c
+@@ -210,7 +210,8 @@ char *avahi_normalize_name(const char *s
+         } else
+             empty = 0;
+ 
+-        avahi_escape_label(label, strlen(label), &r, &size);
++        if (!(avahi_escape_label(label, strlen(label), &r, &size)))
++            return NULL;
+     }
+ 
+     return ret_s;
diff --git a/debian/patches/CVE-2023-38471-2.patch b/debian/patches/CVE-2023-38471-2.patch
new file mode 100644
index 0000000..fc487e7
--- /dev/null
+++ b/debian/patches/CVE-2023-38471-2.patch
@@ -0,0 +1,47 @@
+From b675f70739f404342f7f78635d6e2dcd85a13460 Mon Sep 17 00:00:00 2001
+From: Evgeny Vereshchagin <[e-mail]>
+Date: Tue, 24 Oct 2023 22:04:51 +0000
+Subject: [PATCH] core: return errors from avahi_server_set_host_name properly
+
+It's a follow-up to 894f085f402e023a98cbb6f5a3d117bd88d93b09
+---
+ avahi-core/server.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+Index: avahi-0.8/avahi-core/server.c
+===================================================================
+--- avahi-0.8.orig/avahi-core/server.c
++++ avahi-0.8/avahi-core/server.c
+@@ -1309,10 +1309,13 @@ int avahi_server_set_host_name(AvahiServ
+     else
+         hn = avahi_normalize_name_strdup(host_name);
+ 
++    if (!hn)
++        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
++
+     h = hn;
+     if (!avahi_unescape_label((const char **)&hn, label, sizeof(label))) {
+         avahi_free(h);
+-        return AVAHI_ERR_INVALID_HOST_NAME;
++        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
+     }
+ 
+     avahi_free(h);
+@@ -1320,7 +1323,7 @@ int avahi_server_set_host_name(AvahiServ
+     h = label_escaped;
+     len = sizeof(label_escaped);
+     if (!avahi_escape_label(label, strlen(label), &h, &len))
+-        return AVAHI_ERR_INVALID_HOST_NAME;
++        return avahi_server_set_errno(s, AVAHI_ERR_INVALID_HOST_NAME);
+ 
+     if (avahi_domain_equal(s->host_name, label_escaped) && s->state != AVAHI_SERVER_COLLISION)
+         return avahi_server_set_errno(s, AVAHI_ERR_NO_CHANGE);
+@@ -1330,7 +1333,7 @@ int avahi_server_set_host_name(AvahiServ
+     avahi_free(s->host_name);
+     s->host_name = avahi_strdup(label_escaped);
+     if (!s->host_name)
+-        return AVAHI_ERR_NO_MEMORY;
++        return avahi_server_set_errno(s, AVAHI_ERR_NO_MEMORY);
+ 
+     update_fqdn(s);
+ 
diff --git a/debian/patches/avahi-client-fix-resource-leak.patch b/debian/patches/avahi-client-fix-resource-leak.patch
new file mode 100644
index 0000000..1b438fb
--- /dev/null
+++ b/debian/patches/avahi-client-fix-resource-leak.patch
@@ -0,0 +1,24 @@
+From 374245ec1418e7e1e57120fcaf0a12ec695f5f6d Mon Sep 17 00:00:00 2001
+From: Michal Sekletar <[e-mail]>
+Date: Wed, 24 Oct 2018 15:22:19 +0000
+Subject: [PATCH] avahi-client: fix resource leak
+
+Origin: upstream, https://github.com/lathiat/avahi/commit/374245ec1418e7e1e57120fcaf0a12ec695f5f6d
+
+---
+ avahi-client/browser.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/avahi-client/browser.c b/avahi-client/browser.c
+index c978d942..fa4a9a80 100644
+--- a/avahi-client/browser.c
++++ b/avahi-client/browser.c
+@@ -72,6 +72,8 @@ static void parse_domain_file(AvahiDomainBrowser *b) {
+         if (avahi_normalize_name(buf, domain, sizeof(domain)))
+             b->static_browse_domains = avahi_string_list_add(b->static_browse_domains, domain);
+     }
++
++    fclose(f);
+ }
+ 
+ static void domain_browser_ref(AvahiDomainBrowser *db) {
diff --git a/debian/patches/avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch b/debian/patches/avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch
new file mode 100644
index 0000000..f815ea3
--- /dev/null
+++ b/debian/patches/avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch
@@ -0,0 +1,26 @@
+From 4b48927e8e2c721d103018b4ce39a164b6c2898f Mon Sep 17 00:00:00 2001
+From: Michal Sekletar <[e-mail]>
+Date: Wed, 24 Oct 2018 15:38:48 +0000
+Subject: [PATCH] chroot: fix bogus assignments in assertions
+
+Origin: upstream, https://github.com/lathiat/avahi/commit/4b48927e8e2c721d103018b4ce39a164b6c2898f
+
+---
+ avahi-daemon/chroot.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/avahi-daemon/chroot.c b/avahi-daemon/chroot.c
+index ccd56be0..871b3b34 100644
+--- a/avahi-daemon/chroot.c
++++ b/avahi-daemon/chroot.c
+@@ -188,8 +188,8 @@ static int recv_fd(int fd) {
+             return -1;
+         }
+ 
+-        assert(h->cmsg_len = CMSG_LEN(sizeof(int)));
+-        assert(h->cmsg_level = SOL_SOCKET);
++        assert(h->cmsg_len == CMSG_LEN(sizeof(int)));
++        assert(h->cmsg_level == SOL_SOCKET);
+         assert(h->cmsg_type == SCM_RIGHTS);
+ 
+         return *((int*)CMSG_DATA(h));
diff --git a/debian/patches/series b/debian/patches/series
index 5e99b56..e4585ac 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -22,3 +22,7 @@ tests-pass-overly-long-TXT-resource-records.patch
 Ensure-each-label-is-at-least-one-byte-long.patch
 core-extract-host-name-using-avahi_unescape_label.patch
 common-derive-alternative-host-name-from-its-unescaped-ve.patch
+avahi-daemon-chroot-fix-bogus-assignments-in-assertions.patch
+avahi-client-fix-resource-leak.patch
+CVE-2023-38470-2.patch
+CVE-2023-38471-2.patch
diff --git a/debian/rules b/debian/rules
index d109a89..223074e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -5,7 +5,7 @@ export PYTHON=/usr/bin/python3
 %:
 	dh $@
 
-export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all optimize=-lto
 include /usr/share/dpkg/default.mk
 
 ifneq (linux,$(DEB_HOST_ARCH_OS))