--- libgig/trunk/ChangeLog	2017/07/29 09:57:08	3333
+++ libgig/trunk/ChangeLog	2017/10/07 16:30:43	3351
@@ -10,6 +10,11 @@
     - print compiler warning if no RTTI available
     - Fixed potential crash in command line tools gig2stereo, korg2gig,
       korgdump and sf2extract.
+    - Fixed CVE-2017-12950, CVE-2017-12952, CVE-2017-12953
+      (original patch by Paul Brossier, slightly modified).
+    - Debian: Fixed packaging error about invalid substitution variable
+      "Source-Version".
+    - Raised Debian compatibility level to Debian 9 "Stretch".
 
   * src/gig.cpp, src/gig.h:
     - fixed bug in Script::SetGroup: the script chunk wasn't moved
@@ -46,6 +51,10 @@
       DimensionRegion::EG1Options and DimensionRegion::EG2Options as an
       extension to the gig file format, which allows to override the default
       behavior of the first two EGs' state machines.
+    - Fixed undefined behavior when loading a gig file with invalid
+      velocity curve parameters (fixes CVE-2017-12951).
+    - Fixed undefined behavior when loading a gig file with invalid wave
+      pool index number (fixes CVE-2017-12954).
 
   * src/DLS.cpp, src/DLS.h:
     - Sample: wave pool offsets are now 64 bits (to allow support for files
@@ -88,8 +97,8 @@
       representations like "yes", "no", "true", "false" as expected.
     - Exception class now has a variadic constructor which allows to add
       textual format specifiers like with printf().
-    - DataType fix: Retain backward compatiblity to older versions of native
-      C++ classes/strcts.
+    - DataType fix: Retain backward compatibility to older versions of native
+      C++ classes/structs.
 
   * src/tools/akaidump.cpp, src/tools/akaiextract.cpp:
     - improved output of non-ascii characters in usage messages