diff -pruN 2.4.0-1/debian/changelog 2.4.0-1ubuntu2/debian/changelog
--- 2.4.0-1/debian/changelog	2020-02-23 23:27:10.000000000 +0000
+++ 2.4.0-1ubuntu2/debian/changelog	2020-06-04 14:09:11.000000000 +0000
@@ -1,3 +1,16 @@
+sarg (2.4.0-1ubuntu2) groovy; urgency=medium
+
+  * Update runtime dependency on the transitional dummy ttf-dejavu-core
+    (which was dropped from unstable) to fonts-dejavu-core (Closes: #962200)
+
+ -- Olivier Tilloy <olivier.tilloy@canonical.com>  Thu, 04 Jun 2020 16:09:11 +0200
+
+sarg (2.4.0-1ubuntu1) groovy; urgency=medium
+
+  * Fix format truncation error when built with -O3.
+
+ -- Matthias Klose <doko@ubuntu.com>  Thu, 21 May 2020 14:15:25 +0200
+
 sarg (2.4.0-1) unstable; urgency=medium
 
   * New upstream version 2.4.0
diff -pruN 2.4.0-1/debian/control 2.4.0-1ubuntu2/debian/control
--- 2.4.0-1/debian/control	2020-02-23 23:27:10.000000000 +0000
+++ 2.4.0-1ubuntu2/debian/control	2020-06-04 14:09:11.000000000 +0000
@@ -10,7 +10,7 @@ Vcs-Git: https://salsa.debian.org/debian
 Package: sarg
 Architecture: any
 Replaces: sqmgrlog
-Depends: ${shlibs:Depends}, ${misc:Depends}, ttf-dejavu-core | fonts-freefont-ttf
+Depends: ${shlibs:Depends}, ${misc:Depends}, fonts-dejavu-core | fonts-freefont-ttf
 Suggests: squid, httpd | apache2, squidguard, libapache2-mod-php5
 Conflicts: sqmgrlog
 Description: squid analysis report generator
diff -pruN 2.4.0-1/debian/patches/fix-format-security.diff 2.4.0-1ubuntu2/debian/patches/fix-format-security.diff
--- 2.4.0-1/debian/patches/fix-format-security.diff	1970-01-01 00:00:00.000000000 +0000
+++ 2.4.0-1ubuntu2/debian/patches/fix-format-security.diff	2020-05-21 12:15:21.000000000 +0000
@@ -0,0 +1,11 @@
+--- a/util.c
++++ b/util.c
+@@ -583,7 +583,7 @@ int conv_month(const char *month)
+ 
+ const char *conv_month_name(int month)
+ {
+-	static char str[4];
++	static char str[12];
+ 
+ 	if (month<1 || month>12) {
+ 		snprintf(str,sizeof(str),"%03d",month);
diff -pruN 2.4.0-1/debian/patches/series 2.4.0-1ubuntu2/debian/patches/series
--- 2.4.0-1/debian/patches/series	2020-02-23 23:27:10.000000000 +0000
+++ 2.4.0-1ubuntu2/debian/patches/series	2020-05-21 12:13:27.000000000 +0000
@@ -1,3 +1,4 @@
 0001-config-file-references.patch
 0002-fix-build-errors.patch
 0003-Fix-FTCBFS.patch
+fix-format-security.diff
diff -pruN 2.4.0-1/debian/rules 2.4.0-1ubuntu2/debian/rules
--- 2.4.0-1/debian/rules	2020-02-23 23:27:10.000000000 +0000
+++ 2.4.0-1ubuntu2/debian/rules	2020-06-04 14:09:11.000000000 +0000
@@ -23,7 +23,7 @@ override_dh_auto_configure:
 		--infodir=\$${prefix}/share/info \
 		--bindir=/usr/bin \
 		--sysconfdir=/etc/sarg \
-		--enable-fontdir=/usr/share/fonts/truetype/ttf-dejavu \
+		--enable-fontdir=/usr/share/fonts/truetype/dejavu \
 		--enable-imagedir=/usr/share/sarg/images \
 		--enable-sargphp=/usr/share/sarg
 
diff -pruN 2.4.0-1/debian/sarg.conf 2.4.0-1ubuntu2/debian/sarg.conf
--- 2.4.0-1/debian/sarg.conf	2020-02-23 23:27:10.000000000 +0000
+++ 2.4.0-1ubuntu2/debian/sarg.conf	2020-06-04 14:09:11.000000000 +0000
@@ -17,7 +17,7 @@ access_log /var/log/squid/access.log
 #       The full path to the TTF font file to use to create the graphs. It is required
 #       if graphs is set to yes.
 #
-#graph_font /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf
+#graph_font /usr/share/fonts/truetype/dejavu/DejaVuSans.ttf
 
 # TAG:	title
 # 	Especify the title for html page.