# changelog

author: Olivier Fourdan <ofourdan@redhat.com> 6.2.8.0-10.el5
changelog:
  Fix memory allocation failure when using color option (616538)
    Fix hang when converting broken GIF (693989)
    Fix conversion of rotated landscape PDF (694922)


author: Olivier Fourdan <ofourdan@redhat.com> 6.2.8.0-11.el5
changelog:
  Fix assertion failed when using "identify -verbose" when there's no
    image information available (502626)


author: Olivier Fourdan <ofourdan@redhat.com> 6.2.8.0-14.el5
changelog:
  - Add fix for CVE-2012-0247 CVE-2012-0248 CVE-2012-1185 CVE-2012-1186
  - Add fix for CVE-2012-0259 CVE-2012-0260 CVE-2012-1798


author: Olivier Fourdan <ofourdan@redhat.com> 6.2.8.0-15.el5
changelog:
  - Fix for PostScript conversion was incomplete, as larger documents
    would end up being cropped without the "-g" option (797364)


author: Norm Murray <nmurray@redhat.com> - 6.2.8.0-4.el5_1.1
changelog:
  - backport functionality for CVE patches
  - Add patch for CVE-2007-1797 (#235071)
  - Add patch for CVE-2007-4988 (#310081)
  - Add patch for CVE-2007-4985 (#310091)
  - Add patch for CVE-2007-4986 (#310121)
  - Add patch for CVE-2008-1096 (#286411)
  - Add patch for CVE-2008-1097 (#285861)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-9
changelog:
  - Don't show the applet's VPN submenu if no VPN plugins are installed
  - Resolves: #464604
  - Revert fix for #494212, since it breaks multilib (see 351101)
  - Related: #494212


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-10
changelog:
  - Add support for newer Option NV mobile broadband devices (Quicksilver, iCON 505)
  - Resolves: #536897
  - Fix problems with 63-character WPA PSKs
  - Resolves: #532723
  - Improve VPN password handling
  - Resolves: #528425
  - Correctly handle carrier events for renamed ethernet interfaces
  - Resolves: #513547
  - Fix problems with wired 802.1x certificate usage
  - Resolves: #477061
  - Ensure a connection is not used after its CA certificate has been deleted
  - Resolves: CVE-2009-4144
  - Fix possible information disclosure by nm-connection-editor
  - Resolves: CVE-2009-4145


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-2
changelog:
  - Always bring the secrets dialog to the front (updated)
  - Resolves: #467728
  - Prevent stuck grabs between applet menu and the keyring password dialog (updated)
  - Resolves: #465154
  - Fix issues with creating wired 802.1x connections
  - Resolves: #474879


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-4
changelog:
  - CVE-2009-0365: GetSecrets disclosure
  - CVE-2009-0578: local users can modify the connection settings
  - Resolves: #487778


author: Dan Williams <dcbw@redhat.com> - 1:0.7.0-9.el5_4
changelog:
  - Ensure a connection is not used after its CA certificate has been deleted
  - Resolves: CVE-2009-4144
  - Fix possible information disclosure by nm-connection-editor
  - Resolves: CVE-2009-4145


author: Jan Safranek <jsafrane@redhat.com> 2.0.16-15.el5
changelog:
  - ipmitool: added -b, -B, -l and -T options to ipmitool man page
    (#846596)
  - ipmitool: fixed man page documentation for delloem setled command
    (#797050)


author: Joe Orton <jorton@redhat.com> - 1.2.7-11.1
changelog:
  - add fixes for ttl handling in reslist API (#632096)
  - build with -fno-strict-aliasing to fix strict-aliasing violations


author: Steve Grubb <sgrubb@redhat.com> 1.6.5-7
changelog:
  resolves: #438844 buffer overflow in audit_log_user_command
  - Update ausearch with fixes from auparse, 440086


author: Steve Grubb <sgrubb@redhat.com> 1.6.5-9
changelog:
  resolves: #442556 audit rules with >= get corrupted
  resolves: #438844 buffer overflow in audit_log_user_command, better fix


author: Ian Kent <ikent@redhat.com> - 5.0.1-0.rc2.175.el5
changelog:
  - bz845503 - autofs initscript problems
    - fix status() return code now gets lost due to adding lock file check.
  - Related: rhbz#845503


author: Ian Kent <ikent@redhat.com> - 5.0.1-0.rc2.176.el5
changelog:
  - bz859890 - no --timeout option usage demonstrated in auto.master FORMAT
    options man page section
    - add timeout option description to man page.
  - Resolves: rhbz#859890


author: Ian Kent <ikent@redhat.com> - 5.0.1-0.rc2.177.el5
changelog:
  - bz714766 - autofs /net maps do not refresh list of shares exported on the NFS server
    - disable hosts map HUP signal update.
  - Related: rhbz#714766


author: Karsten Hopp <karsten@redhat.com> 1.9.6-2.3
changelog:
  - increase delay in self checks
  - add delays in aclocal7 self check
    http://osdir.com/ml/sysutils.automake.bugs/2006-09/msg00012.html
  - preserve timestamps of configure files


author: Pavel Raiskup <praiskup@redhat.com> - 1.9.6-3
changelog:
  - fix for CVE-2012-3386 -- 'make distcheck' was making the directory distdir
    world-writeable (#848470)


author: Martin Bacovsky <mbacovsk@redhat.com> - 0.6.16-1.el5
changelog:
  - Resolves: #221439 CVE-2006-6870 Maliciously crafted packed can DoS avahi daemon
  - upgrade to new upstream
  - patch revision
  - better solution to #220048 (avahi-dbus and netdev group)


author: Permaine Cheung <pcheung@redhat.com> - 0:1.2.1-2jpp.7
changelog:
  - Add missing connection hostname check against X.509 certificate name
  - Resolves: CVE-2012-5784
  - Add patches to build with java 1.6


author: Roman Rakus <rrakus@redhat.com> - 3.2-33
changelog:
  - Fixed a bug that caused trap handlers to be executed recursively,
    corrupting internal data structures.
    Resolves: #964753


author: Adam Tkac <atkac redhat com> 30:9.3.4-5.P1
changelog:
  - improved patch to handle D-BUS races (#240876)
  - updated named.root zone to affect root IPv6 migration


author: Adam Tkac <atkac redhat com> 30:9.3.6-20.P1
changelog:
  - zone->curmaster before return in dns_zone_setmasterswithkeys()
  - named could fail to send a uncompressable zone


author: Petr Mensik <pemensik@redhat.com> - 30:9.3.6-25.P1.12
changelog:
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)


author: Adam Tkac <atkac redhat com> 30:9.3.6-4.P1.2
changelog:
  - NSEC validation code could cause wrong NXDOMAIN responses (#554851,
    CVE-2010-0097)
  - improve fix for CVE-2009-4022 (#538744)
    - {C,D}NAMEs could be returned to clients without proper DNSSEC validation
    - don't validate + cache out-of-bailiwick data returned with a secure answer.
      Refetch it instead.


author: Adam Tkac <atkac redhat com> 32:9.7.0-6.P2.1
changelog:
  - work correctly when new DS is introduced in the trusted DNS tree (#675467)
  - include root zone DNSKEY (#693788)


author: Stepan Kasal <skasal@redhat.com> - 3.7.2-2
changelog:
  - fix building with newer kernel-headers (#456247)
  - do not strip debug info during install (#500545)
  - Resolves: rhbz #456247 #500545


author: Stepan Kasal <skasal@redhat.com> - 3.7.2-3
changelog:
  - escape rpm macros in the rpm change log
  - remove bogus rpath from libbrlttybba.so (CVE-2008-3279, #457942)
  - add dependencies to bind the subpackages from one build together


author: Stepan Kasal <skasal@redhat.com> - 3.7.2-4
changelog:
  - use rpm macros more consistently
  - add manual page for brltty.conf
  - add more documentation
  - install the default brltty-pm.conf to docdir only
  - Resolves: #530554
  - silence the postinstall scriptlet
  - Resolves: #529163


author: Denys Vlasenko <dvlasenk@redhat.com> - 1:1.2.0-11
changelog:
  - Resolves: #689659
    "'busybox cp' does not return a correct exit code when 'No space left on device'"


author: Denys Vlasenko <dvlasenk@redhat.com> - 1:1.2.0-13
changelog:
  - Resolves: #768083 "busybox various flaws" including:
    "buffer underflow in decompression"
    "udhcpc insufficient checking of DHCP options"


author: Jakub Hrozek <jhrozek@redhat.com> - 1.6.0-3
changelog:
  - Backport the fix for usage of IPv6 nameserves from 1.7 branch
  - Use default defattr
  - Comment patches
  - Convert the CHANGES file to UTF8


author: Monty <cmontgom@redhat.com> 0.5.1.2-0
changelog:
  - Rebase from upstream to pull in versioning changes and .pc.in fix
  - Bring inline with REVH package
  - Resolves: bz#488571  -  Add celt051 package


author: Nalin Dahyabhai <nalin@redhat.com> 0.50-1
changelog:
  - really fix these this time:
   - getcert: error out when "list -c" finds no matching CA (#743488)
   - getcert: error out when "list -i" finds no matching request (#743485)


author: Nalin Dahyabhai <nalin@redhat.com> 0.50-2
changelog:
  - incorporate patch from Rob Crittenden to start supplying Referer:
    headers when we submit XML-RPC requests (#757883)


author: Chris Feist <cfeist@redhat.com> - 2.0.113-1
changelog:
  - Limitations with 2-node fence_scsi are now properly documented in the man
    page.
  - Resolves: rhbz#512998


author: Chris Feist <cfeist@redhat.com> - 2.0.114-1
changelog:
  - local variable 'verbose_filename' referenced before assignment has been fixed
  - RSA II fencing agent has been fixed.
  - Resolves: rhbz#493802 rhbz#514758


author: Jan Zeleny <jzeleny@redhat.com> - 2.3.43-12.1
changelog:
  - fixed segfault issues in modrdn (#606375)
  - added patch handling null char in TLS to compat package
    (#606375, patch backported by Jan Vcelak <jvcelak@redhat.com>)


author: Ondrej Vasik <ovasik@redhat.com> 2.6-23.1
changelog:
  - CVE-2010-0624 fix heap-based buffer overflow by expanding
    a specially-crafted archive
  - CVE-2007-4476 fix stack crashing in safer_name_suffix


author: Jakub Jelinek <jakub@redhat.com> 4.1.2-46.el5
changelog:
  - fix Fortran module reading with USE...ONLY (#483845, PR fortran/30554)
  - fix ULL multiplication on i386 (#465807, PR middle-end/37731)
  - fix Fortran FMT= with character array section (#492209, PR fortran/39865)
  - fix jump on single bit from ULL test on i386 (PR middle-end/40057)


author: Jakub Jelinek <jakub@redhat.com> 4.1.2-46.el5_4.1
changelog:
  - fix handling of multiple -fno-builtin-XXXX options on the command line
    (#526422, PR driver/28437)


author: Jakub Jelinek <jakub@redhat.com> 4.1.2-46.el5_4.2
changelog:
  - fix libjava to avoid opening *.la/dlopening *.so files from current
    working directory or subdirectories thereof (#545672, CVE-2009-3736)


author: Jakub Jelinek <jakub@redhat.com> 4.1.2-48.el5
changelog:
  - fix debuginfo for local variables in constructors or destructors
    (#513184, PR c++/27574)
  - force BLKmode return values into registers if they are from likely
    spilled classes (#516028, PR rtl-optimization/41646)
  - fix dynamic_cast (#519519)
  - fix debuginfo for ppc{,64} with -mno-sched-prolog (#528792, PR target/40473)
  - fix libjava to avoid opening *.la/dlopening *.so files from current
    working directory or subdirectories thereof (#545673, CVE-2009-3736)
  - fix DW_OP_{gt,ge,lt,le} handling, add DW_OP_swap handling


author: Jakub Jelinek <jakub@redhat.com> 4.1.2-49.el5
changelog:
  - fix ICE in set_uids_in_ptset (#605803)
  - fix ICE in make_rtl_for_nonlocal_decl (#582682, #508735, #503565,
    PR c++/33094)
  - don't build gcjwebplugin (#596097)
  - fix IPP handling in libgcj (#578382)
  - document -print-multi-os-directory (#529659, PR other/25507)
  - fix ICE in output_die with function local types (#527510, PR debug/41063)
  - speed up locale::locale() ctor if _S_global hasn't been changed
    (#635708, PR libstdc++/40088)


author: Jarod Wilson <jwilson@redhat.com> 1.2.1-3
changelog:
  - Disable freq scaling by default on AMD rev F and earlier
    cpus when running xen, due to clock instability (#435321)


author: Jarod Wilson <jarod@redhat.com> 1.2.1-5
changelog:
  - Support for speedstep-centrino module fallback if
    new-and-improved acpi-cpufreq doesn't work (#463488)


author: Dave Anderson <anderson@redhat.com> - 5.1.8-1.el5
changelog:
  - Rebase to upstream version 5.1.8.
    Resolves: rhbz#715072

  - Fix for the x86_64 "bt" command if the shutdown NMI is issued to a
    32-bit task that has executed a "sysenter" instruction and the RSP
    still contains the zero value loaded from the MSR_IA32_SYSENTER_ESP
    register.  The backtrace issued a warning message indicating 
    "WARNING: possibly bogus exception frame", and was unable to make a 
    transition from the NMI exception stack back to the process stack. 
    Resolves: rhbz#676408

  - Fix for the x86 "bt" command for several backtraces of non-crashing
    active tasks that fail with "bt: cannot resolve stack trace" errors
    due to the failure to properly transition from the shutdown NMI stack 
    back to the process stack.
    Resolves: rhbz#713050

  - Fix to more correctly determine the KVM I/O hole size and location.
    The I/O hole size to this point in time is either 1GB or 512MB, but
    its setting is hardwired into the Qemu code that was used to create 
    the dumpfile.  The dumpfile is a "savevm" file that is designed to be
    used for guest migration, and since inter-version save/load is not 
    supported, the I/O hole information does not have to be encoded into the
    dumpfile.  Without the patch, the I/O hole for dumpfiles created by 
    older Qemu version was not being set to 1GB, so if the KVM guest was 
    configured with more than 3GB of memory, the crash session would 
    typically display numerous "read error" messages during session 
    initialization.
    Resolves: rhbz#715070

  - Fix for KVM dumpfiles from guests that were provisioned with more
    than 3.5GB of RAM.  KVM virtual systems contain an I/O hole in the
    physical memory region from 0xe0000000 to 0x100000000 (3.5GB to 4GB).
    If a guest is provisioned with more than 3.5GB of RAM, then the
    memory above 3.5GB is "pushed up" to start at 0x100000000 (4GB).
    But the "ram" device headers in the KVM dumpfiles do not reflect
    that, and so without the patch, numerous error messages would be
    displayed during invocation, and in all probability, the session
    would fail.
    Resolves: rhbz#716327


author: Dave Anderson <anderson@redhat.com> - 5.1.8-2.el5
changelog:
  - Fix to handle xen dom0 dumpfiles created with "makedumpfile -d1" on very
    large systems, where the ELF vmcore may be mistakenly determined to be
    an old-style netdump vmcore.  
    Resolves: rhbz#876046


author: Tomas Hoger <thoger@redhat.com> - 15.5-15.el5_3.4
changelog:
  - Merge incdir-overflow and snprintf patches for better readability,
    snprintf is used now with PATHLEN limit without other adjustments,
    related strlen / %.*s / *_len are no longer needed and were dropped
  - Update tempsec patch, drop extraneous s(n)printf argument
    to suppress compiler warnings
  - Update fscanf-overflows patch to perform reffile argument length
    check earlier, now also includes strlen-adjust-fix patch


author: Tim Waugh <twaugh@redhat.com> 1:1.2.4-11.14:.2
changelog:
  - Applied patch to fix CVE-2007-4045 (bug #356571).
  - Applied patch to fix CVE-2007-4352, CVE-2007-5392 and
    CVE-2007-5393 (bug #356571).


author: Tim Waugh <twaugh@redhat.com> 1:1.2.4-11.14:.4
changelog:
  - Prevent double-free when a browsed class has the same name as a printer
    or vice versa (bug #433766, STR #2656).


author: Tim Waugh <twaugh@redhat.com> 1:1.2.4-11.14:.5
changelog:
  - Applied patch to prevent heap-based buffer overflow in CUPS helper
    program (bug #436153, CVE-2008-0047, STR #2729).


author: Tim Waugh <twaugh@redhat.com> 1:1.2.4-11.14:.6
changelog:
  - Applied patch to fix CVE-2008-0053 (HP-GL/2 input processing, bug #438117).
  - Applied patch to fix CVE-2008-1373 (GIF overflow, bug #438303).


author: Tim Waugh <twaugh@redhat.com> 1:1.2.4-11.18:.2
changelog:
  - Applied patch to fix CVE-2008-3639 (STR #2918, bug #464721).
  - Applied patch to fix CVE-2008-3640 (STR #2919, bug #464721).
  - Applied patch to fix CVE-2008-3641 (STR #2911, bug #464721).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-11:.3
changelog:
  - Include NULL pointer check in ObjectStream::getObject.  Part of the
    fix for CVE-2009-3608 (bug #526637).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-11:.4
changelog:
  - Applied patch to fix CVE-2009-3553 (bug #530111, STR #3200).
  - Applied patch to fix CVE-2009-2820 (bug #529833, STR #3367, STR #3401).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-18:.2
changelog:
  - Applied patch for CVE-2010-1748 (web interface memory disclosure,
    STR #3577, bug #591983).
  - Applied patch for CVE-2010-0542 (texttops unchecked memory
    allocation failure leading to NULL pointer dereference, STR #3516,
    bug #587746).
  - Applied patch for CVE-2010-0540 (CUPS administrator web interface
    CSRF, STR #3498, bug #588805).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-18:.7
changelog:
  - Reverted patch for STR #3563 as it does not fix the original problem
    and may well introduce further regressions (bug #601516).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-18:.8
changelog:
  - Applied patch to fix cupsd memory corruption vulnerability
    (CVE-2010-2941, STR #3648, bug #624438).
  - Fix latent privilege escalation vulnerability (CVE-2010-2431,
    STR #3510, bug #605397).


author: Jiri Popelka <jpopelka@redhat.com> 1:1.3.7-28
changelog:
  - Web interface didn't show completed jobs for printer (STR #3436, bug #625900)
  - Serial backend didn't allow a raw job to be canceled (STR #3649, bug #625955)
  - Fixed condition in textonly filter to create temporary file
    regardless of the number of copies specified. (bug #660518)


author: Jiri Popelka <jpopelka@redhat.com> 1:1.3.7-29
changelog:
  - The imageto* filters could crash with bad GIF files
    (CVE-2011-2896, STR #3867, STR #3914, bug #752118).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-30:.1
changelog:
  - Applied patch to fix CVE-2012-5519 (privilege escalation for users
    in SystemGroup or with equivalent polkit permission).  This prevents
    HTTP PUT requests with paths under /admin/conf/ other than that for
    cupsd.conf, and also prevents such requests altering certain
    configuration directives such as PageLog and FileDevice (bug #875898).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-8
changelog:
  - Applied patch to fix STR #2974 (bug #473905, CVE-2008-5286,
    CVE-2008-1722).
  - Applied patch to fix STR #2774 (bug #473915, CVE-2008-5184).
  - Applied patch to fix RSS subscription limiting (bug #473901,
    CVE-2008-5183).
  - Run the serial backend as root (bug #216658).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-8:.3
changelog:
  - Applied patches to fix CVE-2009-0163 (bug #490596),
    CVE-2009-0146 (bug #490612), CVE-2009-0147 (bug #490614),
    and CVE-2009-0166 (bug #490625).


author: Jan iankko Lieskovsky <jlieskov@redhat.com> 1:1.3.7-8:.4
changelog:
  - Applied additional patches by Tim Waugh for batch3892.pdf,
    batch4781.pdf, batch5486.pdf, batch19856.pdf, batch19869.pdf
    testing files from CERT (bug #491864).
  - Resolves: rhbz#492386.


author: Kamil Dudka <kdudka@redhat.com> 7.15.5-14
changelog:
  - fix stack smashing in the FTP implementation (#652557)
  - fix proxy kerberos authentication (#657396)
  - update running_handles counter properly in curl_multi_remove_handle (#688871)


author: Kamil Dudka <kdudka@redhat.com> - 7.15.5-8
changelog:
  - mention lack of IPv6, FTPS and LDAP support while using a socks proxy
    (#473128)
  - avoid tight loop if an upload connection is broken (#479967)
  - add options --ftp-account and --ftp-alternative-to-user to program help
    (#517084)
  - fix crash when reusing connection after negotiate-auth (#517199)
  - support for CRL loading from a PEM file (#532069)


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.7-12.2
changelog:
  - fix CVE-2011-3481: NULL pointer dereference via crafted 
    References header in email (#738391)
  - fix CVE-2011-3372: nntpd authentication bypass (#740822)


author: Tomas Mraz <tmraz@redhat.com> 2.1.22-5
changelog:
  - install the shared version of pluginviewer and other tools (#473197)
  - remove potentially patented srp plugin which was not built
    anyway (#368421)
  - include crypt.h for missing prototype (#433583)
  - implement reload as conditional restart in the init script (#448154)
  - set the LDAP_OPT_TIMEOUT in the ldap plugin (#475726)


author: Ray Strode <rstrode@redhat.com> - 1.0.0-4
changelog:
  Resolves: #217721
  - Don't die on SIGHUP when rereading config file, if it's no
    longer compatible with the version of the bus running


author: Dan Williams <dcbw@redhat.com> - 1.1.2-12
changelog:
  - Fix for CVE-2008-3834
  - Resolves: #466227
  - Remove dbus-libs Obsoletes on dbus; not needed
  - Resolves: #466007


author: Colin Walters <walters@redhat.com> - 0.73-10
changelog:
  - Add patch to fix CVE-2010-1172
    Drop broken-xml.patch which this one now incorporates
    Resolves: #588397
      (and #585395)


author: Colin Walters <walters@redhat.com> - 0.73-10
changelog:
  - Add patch to fix CVE-2010-1172
    Drop broken-xml.patch which this one now incorporates
    Resolves: #585395


author: Jiri Popelka <jpopelka@redhat.com> - 12:3.0.5-23.2
changelog:
  - The server's "by client-id" and "by hardware address" hash table lists
    are now sorted according to the preference to re-allocate that lease to
    returning clients.  This should eliminate pool starvation problems
    arising when "INIT" clients were given new leases rather than presently
    active ones. (RHBZ #627572)


author: Jiri Popelka <jpopelka@redhat.com> - 12:3.0.5-28
changelog:
  - Better fix for CVE-2011-0997: making domain-name check more lenient (RHBZ #690577)
  - dhclient requests interface-mtu option by default (RHBZ #694264)


author: Jiri Popelka <jpopelka@redhat.com> - 12:3.0.5-29
changelog:
  - dhclient.conf(5), dhclient(8) mention that interface-mtu option
    is also requested by default (RHBZ #694264)


author: Jiri Popelka <jpopelka@redhat.com> - 12:3.0.5-29.1
changelog:
  - A pair of defects cause the server to halt upon processing certain packets
    (CVE-2011-2748, CVE-2011-2749, #729880)


author: Jiri Popelka <jpopelka@redhat.com> - 12:3.0.5-30
changelog:
  - A pair of defects cause the server to halt upon processing certain packets
    (CVE-2011-2748, CVE-2011-2749, #729881)


author: Jiri Popelka <jpopelka@redhat.com> - 12:3.0.5-31.1
changelog:
  - An error in the handling of malformed client identifiers can
    cause a denial-of-service condition in affected servers. (CVE-2012-3571, #843124)


author: Tomas Janousek <tjanouse@redhat.com> - 1.0.7-1
changelog:
  - update to latest upstream, fixes a few bugs (#331441, #245249), plus two
    security vulnerabilities (CVE-2007-2231, CVE-2007-4211)
  - increased default login_process_size to 64 (#253363)


author: Tomas Janousek <tjanouse@redhat.com> - 1.0.7-2
changelog:
  - LDAP+auth cache user login mixup (CVE-2007-6598, #427575)
  - insecure mail_extra_groups option (CVE-2008-1199, #436927)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.7-5
changelog:
  - change permissions of deliver and dovecot.conf to prevent possible password exposure
  - Resolves: #436287


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.7-7
changelog:
  - permissions of deliver and dovecot.conf from 1.0.7-5 reverted
  - password can be stored in different file readable only for root now
  - Resolves: #436287, CVE-2008-4870


author: Eric Sandeen <sandeen@redhat.com> 1.41.9-1
changelog:
  - Update to e4fsprogs-1.41.9 (#528055)
  - Add ext4-capable, renamed libraries & headers for pygrub (#524611)


author: Thomas Woerner <twoerner@redhat.com> - 2.0.9-3
changelog:
  - fixed init script to be lsb conform
    Resolves: rhbz#536828
  - fixed download link according to package review
    Related: rhbz#543948


author: Thomas Woerner <twoerner@redhat.com> - 2.0.9-5
changelog:
  - import of the RHEL-6 ebtables package without the buildid patch
  - added -fno-strict-aliasing to the compiler flags (rhbz#596158)
  - cleaned up description (rhbz#596158)
  - fixed install of /etc/ethertypes in running system (rhbz#596778)


author: Michal Hlavinka <mhlavink@redhat.com> 75-3
changelog:
  - ask for password confirmation when creating openssl key (#500850)
  - removed executable permission from ecryptfs-dot-private (#500817)
  - ecryptfs-rewrite-file: improve of progress output (#500813)
  - don't error out when unwrapping and adding a key that already exists (#500810)
  - fix typo in ecryptfs-rewrite-file(1) (#500804)
  - add error message about full keyring (#501460)
  - gui sub-package must requires pygtk2-libglade (#500997)
  - require cryptsetup-luks for encrypted swap (#500824)
  - use blkid instead of vol_id (#500820)
  - don't rely on cryptdisks service (#500829)


author: Michal Hlavinka <mhlavink@redhat.com> - 75-5.1
changelog:
  - security fixes:
  - privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832)
  - race condition when checking source during mount (CVE-2011-1833)
  - mtab corruption via improper handling (CVE-2011-1834)
  - key poisoning via insecure temp directory handling (CVE-2011-1835)
  - arbitrary file overwrite via lock counter race (CVE-2011-1837)


author: Roland McGrath <roland@redhat.com> - 0.137-2
changelog:
  - Update to 0.137
    - libdwfl: bug fixes; new segment interfaces;
               all the libdwfl-based tools now support --core=COREFILE option
  - Resolves: RHBZ #325021, RHBZ #447416


author: Ondrej Vasik <ovasik@redhat.com> 0.11.1-6.1
changelog:
  - fix #235411 - CVE-2007-2027 - elinks tries to load .po files
    from non-absolute path
  - fix #523258 - CVE-2008-7224 - entity_cache static array buffer
    overflow


author: Jack Magne <jmagne@redhat.com>= 1.1.0-10
changelog:
  - Resolves: #523568 - cannot enroll using SSHA password scheme.
  - Resolves: #530482 - no rendering in "Smart Card Enrollment" window.


author: Eduardo Habkost <ehabkost@redhat.com> - etherboot-5.4.4-11.el5
changelog:
  - Add rtl8029 to the list of kvm roms (bz#511912)
    - Add etherboot-{rom,zrom}-rtl8029 Provides to kvm rom subpackages
    - Make -kvm subpackage conflict with older etherboot-{roms,zroms} packages
      because they have the same rtl8029 rom files
  - Resolves: bz#511912
    (ne model failed to get ip address)


author: Eduardo Habkost <ehabkost@redhat.com> - etherboot-5.4.4-12.el5
changelog:
  - Change glibc32 BuildRequires to file-based BuildRequires [bz#521901]
  - Resolves: bz#521901
    (can't build cause wrong BR)


author: Eduardo Habkost <ehabkost@redhat.com> - etherboot-5.4.4-13.el5
changelog:
  - Use 0644 permission on all rom files [bz#547773]
  - Resolvez: bz#547773
  - Use update-alternatives to provide the common /usr/share/qemu-pxe-roms dir
    [bz#546016]
  - Resolves: bz#546016


author: Matthew Barnes <mbarnes@redhat.com> - 2.8.0-39.el5
changelog:
  - CVE-2007-1002 (Shared memo categories format string vulnerability)
  - Add patch for RH bug #215873 (saving appointments in zh_TW).


author: Matthew Barnes <mbarnes@redhat.com> - 1.12.3-6.el5
changelog:
  - Add patch for RH bug #436800 (crash on malformed vcard).
  - Add patch for RH bug #431663 (support simple binds for GAL access).


author: Miroslav Lichvar <mlichvar@redhat.com> - 4.63-5
changelog:
  - Move certificate generation to init script (#510203)
  - Listen only on loopback by default (#513492)
  - Fix default config to use relay_to_domains list (#248289)
  - Fix return codes in init script (#238026)
  - Add -fno-strict-aliasing to CFLAGS


author: Joe Orton <jorton@redhat.com> - 1.95.8-9
changelog:
  - add security fix for CVE-2009-3720 (#531711)
  - add security fix for CVE-2009-3560, without regression (#556415)


author: Joe Orton <jorton@redhat.com> - 1.95.8-10
changelog:
  - add security fix for CVE-2012-1148 (#811823)
  - add security fix for CVE-2012-0876 (#811831)
  - run test suite during build


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.3.6-1.1
changelog:
  - Fix APOP vulnerability (CVE-2007-1558)
    Resolves: #241196
  - Fix broken support for KPOP
    Resolves: #224018


author: Rex Dieter <rdieter[AT]fedoraproject.org> 3.1.2-5
changelog:
  - fftw3(-devel): Provides: fftw(-devel) = %version ...
  - cleanup, +%check section (disabled by default)


author: Warren Togami <wtogami@redhat.com> 2.3.1-1.el4.3
changelog:
  - Fixes to make it work on RHEL4
    Build:
        - make it build with old SILC
        - silence gconftool-2 during upgrade from pidgin-1.5.1
        - gtk-update-icon-cache didn't exist in RHEL4 
        - defattr all sub-packages
    Runtime:
        - reap sound child processes if they did not exit within 15 seconds
        - migrate RHEL4 users to command "aplay %s" so sound continues to work
        - default RHEL4 users to command "aplay %s"
  - finch fix for x86_64 (one liner patch)
  - Require RHEL4 libxml2 >= 2.6.16-12
    This fixes Google Talk protocol. (#445758)


author: Warren Togami <wtogami@redhat.com> 2.3.1-2
changelog:
  - CVE-2008-2927 MSN integer overflow
  - Fix ICQ login
  - pidgin-2.3.1-reap-sound-children.patch
    pidgin-2.3.1-finch-x86_64.patch
    No change, but just noting that these went into upstream.


author: Warren Togami <wtogami@redhat.com> 2.5.2-2
changelog:
  - Upstream backports:
    100: sametime-redirect-null crash
    101: NetworkManager-improvement
    102: no-password-in-dialog-if-not-remembering
    103: temporarily-remember-password-during-auto-reconnect
    104: smilie-theme-change-crash
    105: url_fetch_connect_cb-double-free crash
    106: GtkIMHtmlSmileys-remove-crash
    107: remove-dialog-from-open-dialog-list


author: Warren Togami <wtogami@redhat.com> 2.5.2-6
changelog:
  - Automatically detect booleans to enable build features from dist tag
  - Unify RHEL4 and RHEL5 spec with Fedora to make both easier to maintain


author: Warren Togami <wtogami@redhat.com> 2.5.5-2
changelog:
  - Security/DoS fixes from 2.5.6
    CVE-2009-1373-8331e31a
    CVE-2009-1374-ad057b75
    2c9a1153
    CVE-2009-1375-7829ec76
    CVE-2009-1376-9dd1c4c3


author: Warren Togami <wtogami@redhat.com> 2.6.2-2
changelog:
  - Upstream backports:
      97e003ed2bc2bafbb993693c9ae9c6d667731cc1 aim-buddy-status-grab
      37aa00d044431100d37466517568640cb082680c yahoo-buddy-idle-time
      40005b889ee276fbcd0a4e886a68d8a8cce45698 yahoo-status-change-away
      cb46b045aa6e927a3814d9053c2b1c0f08d6fa62 crash-validate-jid


author: Warren Togami <wtogami@redhat.com> - 2.6.6-1
changelog:
  - 2.6.6 with security and numerous minor bug fixes
    CVE-2010-0277 CVE-2010-0420 CVE-2010-0423
  - Bug #528796: Get rid of #!/usr/bin/env python


author: Tomas Mraz - 1.2.0-1
changelog:
  - add lib subpackage to avoid multilib on the base package
  - add ability to compute hmacs on multiple files at once
  - improved debugging with FIPSCHECK_DEBUG


author: Martin Stransky <stransky@redhat.com> - 1.5.0.12-9
changelog:
  - Update to latest snapshot of Mozilla 1.8.0 branch
  - Added a patch with backported fixes from 1.8.1.12


author: Christopher Aillon <caillon@redhat.com> - 1.5.0.12-12
changelog:
  - Update to latest snapshot of Mozilla 1.8.0 branch
  - Add patches for backported fixes from 1.8.1.13


author: Martin Stransky <stransky@redhat.com> - 10.0.8-2
changelog:
  - Fixed rhbz#865284 - add the storage.nfs_filesystem
    config key to property list
  - disable OOP for wrapped plugins (nspluginwrapper)


author: Martin Stransky <stransky@redhat.com> - 17.0.8-4
changelog:
  - Added fix for mozbz#601442 - Support the extensions.getAddons.showPane 
    pref again in the Add-ons Manager UI, a part of rhbz#818636 fix.


author: Martin Stransky <stransky@redhat.com> - 17.0.8-3
changelog:
  - Fixed rhbz#818636 - Firefox allows install of addons,
    disregarding xpinstall.enabled flag set as false.


author: Martin Stransky <stransky@redhat.com> - 24.4.0-3
changelog:
  - Added a workaround for Bug 1054242 - RHEVM: Extremely high memory
    usage in Firefox 24 ESR on RHEL 6.5


author: Jan Horak <jhorak@redhat.com> - 31.3.0-9
changelog:
  - Fixed problems with dictionaries (mozbz#1097550)
  - Fixed rhbz#1164855 - firefox.desktop is missing
    x-scheme-handler MimeType entries


author: Tim Waugh <twaugh@redhat.com> 3.0.2-38.3
changelog:
  - Better margin defaults (bug #244348).
  - Ship a defaultspooler file to avoid the need for spooler
    auto-detection (bug #454684).


author: Tim Waugh <twaugh@redhat.com> 3.0.2-38.3:.1
changelog:
  - Applied patch to fix improper sanitization of command line options
    (CVE-2011-2697, bug #721001).


author: John Dennis <jdennis@redhat.com> - 1.1.3-1.3
changelog:
  - Resolves: bug #447669 freeradius cannot be queried using net-snmp
  - force all files in /etc/raddb to be 640 root:radiusd, otherwise after dropping
    privileges the radiusd daemon cannot re-read it's config files on SIGHUP.
  - add group creation for radiusd
  - Resolves: bug #249308 freeradius (prior to 1.1.4) won't work with vista clients
  - Resolves: bug #440626 bad dist macro


author: John Dennis <jdennis@redhat.com> - 1.1.3-1.4
changelog:
  - Resolves: bug #287381 rlm_ldap could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow
    for some reason the freeradius-1.1.3-ldap.patch incorrectly changed
    ldap_int_tls_config() to ldap_set_option(), this reverts the incorrect patch


author: John Dennis <jdennis@redhat.com> - 1.1.3-1.5
changelog:
  - Security: Fix Tunnel-Password zero-length attributes flaw (bug #521912)
    Resolves: RH BZ#522062
  - rebase a couple of old patches (freeradius-0.9.0-com_err.patch,
    freeradius-1.0.0-samba3.patch) so they apply with fuzz=0


author: John Dennis <jdennis@redhat.com> - 2.1.12-4
changelog:
  - resolves: bug#855315
    CVE-2012-3547 freeradius: Stack-based buffer overflow by processing
    certain expiration date fields of a certificate during x509 certificate
    validation


author: John Dennis <jdennis@redhat.com> - 2.1.12-4
changelog:
  resolves: bug#818885 possible errors in /etc/raddb/sql/postgresql/admin.sql template
    resolves: bug#781877 rlm_dbm_parser has man pages in rlm_dbm_parse.8.gz
    resolves: bug#787111 logrotate script does not reload running daemon
    resolves: bug#846471 freeradius not compiled with --with-udpfromto
    resolves: bug#846474 shadow password expiration does not work
    resolves: bug#846475 Segfault with freeradius-perl threading
    resolves: bug#846476 radtest script is not working with eap-md5 option


author: John Dennis <jdennis@redhat.com> - 2.1.12-5
changelog:
  - resolves: bug#855308
    CVE-2012-3547 freeradius: Stack-based buffer overflow by processing
    certain expiration date fields of a certificate during x509 certificate
    validation


author: Marek Kasik <mkasik@redhat.com> 2.2.1-23
changelog:
  - Add freetype-2.2.1-CVE-2010-2527.patch
      (Use precision for `%s' where appropriate to avoid buffer overflows)
  - Resolves: #614012


author: Marek Kasik <mkasik@redhat.com> 2.2.1-24
changelog:
  - Modify freetype-2.2.1-CVE-2010-2519.patch (additional fix)
      (If the type of the POST fragment is 0, the segment is completely ignored)
  - Resolves: #614012


author: Marek Kasik <mkasik@redhat.com> 2.2.1-25
changelog:
  - Add freetype-2.2.1-axis-name-overflow.patch
      (Avoid overflow when dealing with names of axes)
  - Resolves: #614012


author: Marek Kasik <mkasik@redhat.com> 2.2.1-27
changelog:
  - Add freetype-2.2.1-CVE-2010-2806.patch
      (Protect against negative string_size. Fix comparison.)
  - Add freetype-2.2.1-CVE-2010-3311.patch
      (Don't seek behind end of stream.)
  - Add freetype-2.2.1-CVE-2010-3054.patch
      (Protect against nested `seac' calls.)
  - Add freetype-2.2.1-CVE-2010-2808.patch
      (Check the total length of collected POST segments.)
  - Resolves: #638142


author: Marek Kasik <mkasik@redhat.com> 2.2.1-28.el5_5.1
changelog:
  - Add freetype-2.2.1-CVE-2010-3855.patch
      (Protect against invalid `runcnt' values.)
  - Resolves: #651759


author: Marek Kasik <mkasik@redhat.com> 2.2.1-31.el5_8.1
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Protect against invalid string offsets in pcf_get_properties()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806266


author: Marek Kasik <mkasik@redhat.com> 2.2.1-32
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Protect against invalid string offsets in pcf_get_properties()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806267


author: Josef Bacik <josef@redhat.com> - 2.7.4-8
changelog:
  - use -fno-strict-aliasing in the build flags
  - add a fuse group and make sure fusermount belongs to that group for security
    reasons


author: Jakub Jelinek <jakub@redhat.com> 4.4.0-6.el5
changelog:
  - don't disable internal dependency generator, instead chmod 644 private
    shared libraries that shouldn't be provided/required, fold
    libppl{,_c} as convenience libraries into libcloog.so.0 (#503725)


author: Jiri Moskovcak <jmoskovc@redhat.com> - 2.0.33-9.4.1
changelog:
  - security fixes
  - CVE-2006-4484 CVE-2007-0455 CVE-2007-2756 CVE-2007-3472 
  - CVE-2007-3473 CVE-2007-3475 CVE-2007-3476
  - Resolves: #432786


author: Ray Strode <rstrode@redhat.com> 2.16.0-59.1
changelog:
  - Don't try to pre-create directories that are internal
    implementation details of X.
    Resolves: #997619 CVE-2013-4169


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: gdm-change-theme.patch
  -->  The theme from TUV is not the theme we want to use
  - Added Source: gdm.ini
  -->  Config file for automated patch script
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl5\2
  -->  Modify release string to note changes


author: Chris Feist <cfeist@redhat.com> 0.1.60-1
changelog:
  - When '/' is a gfs2 file system it is now properly mounted without an error.
  - Resolves: rhbz#507893


author: Tim Waugh <twaugh@redhat.com> 8.15.2-9
changelog:
  - Apply CJKV patch from svn164:165 plus the fix from svn173:174 (bug #194592,
    bug #203712, possibly bug #167596).


author: Tim Waugh <twaugh@redhat.com> 8.15.2-9.4:.6
changelog:
  - Applied patch to fix gdevpdtb buffer overflow (bug #493445).
  - Applied patch to fix scfd buffer underrun (bug #493442).
  - Applied patch to fix CVE-2009-0792 (bug #491853).
  - Applied patch to fix CVE-2009-0196 (bug #493379).


author: Tim Waugh <twaugh@redhat.com> 8.70-6:.4
changelog:
  - Applied patch to avoid reading initialization files from CWD
    (CVE-2010-2055, bug #599564).
  - Applied patch to prevent integer underflow in TrueType bytecode
    interpreter (CVE-2009-3743, bug #627902).


author: Nils Philippsen <nphilipp@redhat.com> - 2:2.2.13-2.0.6
changelog:
  - replace gimp_error() by gimp_message()/gimp_quit() in a few plugins so they
    don't crash but gracefully exit when encountering error conditions
  - fix endianness issues in the PSP plugin to avoid it doing (seemingly) endless
    loops when loading images
  - fix endianness issues in the PCX plugin which cause it to not detect corrupt
    images


author: Nils Philippsen <nils@redhat.com> - 2:2.2.13-2.0.7.2
changelog:
  - fix various overflows (#537356, #666793, #689831, #703403, #703405, #703407,
    - unfuzz gimphelpmissing, icontheme patches


author: Nils Philippsen <nils@redhat.com> - 2:2.2.13-2.0.7.el5_8.4
changelog:
  - fix overflows in PSD plugin (CVE-2009-3909, CVE-2012-3402)
  - fix heap corruption and overflow in GIF plug-in (CVE-2011-2896)
  - fix overflow in CEL plug-in (CVE-2012-3403)


author: Carlos O'Donell <carlos@redhat.com> - 2.5-107.3
changelog:
  - Fix multibyte character processing crash in regexp (CVE-2013-0242, #951130)
    - Fix getaddrinfo stack overflow resulting in application crash (CVE-2013-1914, #951130)


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-118.1
changelog:
  - Add support for newer L3 caches on x86-64 and correctly count
    the number of hardware threads sharing a cacheline (#1011424).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-118.3
changelog:
  - Remove gconv transliteration loadable modules support (CVE-2014-5119,
    - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,


author: Andreas Schwab <schwab@redhat.com> - 2.5-58.el5_6.2
changelog:
  - Avoid too much stack use in fnmatch (#681054, CVE-2011-1071)
  - Properly quote output of locale (#625893, CVE-2011-1095)
  - Don't leave empty element in rpath when skipping the first element,
    ignore rpath elements containing non-isolated use of $ORIGIN when
    privileged (#667974, CVE-2011-0536)
  - Fix handling of newline in addmntent (#559579, CVE-2010-0296)


author: Jeff Law <law@redhat.com> - 2.5-65.el5_7.3
changelog:
  - Use correct type when casting d_tag (#767687)
  - Report write error  in addmnt even for cached streams (#767687)
  - ldd: Never run file directly (#767687).
  - Workaround misconfigured system (#767687)


author: Jeff Law <law@redhat.com> - 2.5-81.el5_8.1
changelog:
  - Add dist tag
  - Filter out <built-in> when building file lists (#784646).
  - Avoid "nargs" integer overflow which could be used to bypass FORTIFY_SOURCE (#794813)


author: Patsy Franklin <pfrankli@redhat.com> - 2.5-81.el5_8.4
changelog:
  - Fix iconv() segfault if the invalid multibyte character 0xffff is input when converting from IBM930 (#837896)


author: Jeff Law <loaw@redhat.com> - 2.5-81.el5_8.5
changelog:
  - Do not use PT_IEEE_IP ptrace calls (#839411)
  - Update ULPs (#839411)
  - Fix various transcendentals in non-default rounding modes (#839411)


author: Adam Jackson <ajax@redhat.com> 6.5.1-7.10
changelog:
  - mesa-6.5.1-nonconformant-visual.patch: Don't warn about the non-
    conformant synthetic Composite visual (#442738)


author: Matthew Barnes <mbarnes@redhat.com> - 2.14.2-6
changelog:
  - Require gecko-libs instead of firefox.
  - Add patch to make pkg-config look for mozilla-gtkmozembed even
    though we're using xulrunner.


author: Tomas Bzatek <tbzatek@redhat.com> - 2.16.2-8.el5
changelog:
  - Fix Gnome trashcan doesn't work on ext4 filesystems (#594836)
  - Fix a crash in ImageMagick after conversion is done (#472253)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.16.2-9.el5
changelog:
  - Prevent deleting items linking out of the trash (#586015)
  - Do not stat every file on an ClearCase mvfs filesystem (#822817)
  - Do not silently skip directory having no read permission during copy (#772307)
  - Allow trashing symlink to filesystem root that does not support trashing (#621394)
  - CVE-2009-2473 gnome-vfs2 embedded neon: billion laughs DoS attack (#540548)


author: Tomas Mraz <tmraz@redhat.com> - 1.4.5-17
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4242 GnuPG susceptible to Yarom/Falkner side-channel attack
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Tomas Mraz <tmraz@redhat.com> - 2.0.10-5
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Tomas Mraz <tmraz@redhat.com> 1.4.1-9
changelog:
  - fix CVE-2011-4128 - buffer overflow in gnutls_session_get_data() (#752308)
  - fix CVE-2012-1569 - missing length check when decoding DER lengths (#804920)
  - fix CVE-2012-1573 - security issue in packet parsing (#805432)


author: Tomas Mraz <tmraz@redhat.com> 1.4.1-10
changelog:
  - do not generate invalid certificate requests without challenge password
  - store subject DN instead of issuer DN in the CA list


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 1.4.1-14
changelog:
  - Renamed gnutls-1.4.1-cve-2014-0092-1.patch to cve-2014-5138.patch
  - Renamed gnutls-1.4.1-cve-2014-0092-2.patch to cve-2014-0092.patch


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 1.4.1-15
changelog:
  - fix session ID length check and null pointer dereference (#1102355)
  - fix minitasn1 issues (#1102355)
  - Renamed gnutls-1.4.1-cve-2014-5138.patch to cve-2009-5138.patch


author: Tomas Mraz <tmraz@redhat.com> 1.4.1-3.5
changelog:
  - fix NUL characters in DN and SAN cert fields issue,
    make sure gnutls_x509_crt_check_hostname() fails when certificate
    has no CN or SAN CVE-2009-2730 (#516231)


author: Tomas Mraz <tmraz@redhat.com> 1.4.1-3.7
changelog:
  - implement safe renegotiation - CVE-2009-3555 (#533125)
  - do not allow MD2 in certificate signatures by default - CVE-2009-2409
    (#510197)


author: Tomas Mraz <tmraz@redhat.com> 1.4.1-7.1
changelog:
  - fix multiple possible NULL dereferences and other problems
    that can potentially lead to segfault in the client


author: Troy Dawson <dawson@fnal.gov>
changelog:
  - Made changes for SL 5, which consists of the following
  - set "LUA 1" for rhel5
  - set "PHP 1" for rhel5
  - Added Patch100 (written by Jaroslaw Polok) so PHP would build on SL5


author: - Bastien Nocera <bnocera@redhat.com> - 0.10.20-2
changelog:
  - Remove increased liboil req, otherwise we can't actually install
    the package
  Related: rhbz #450104


author: Cosimo Cecchi <cosimoc@redhat.com> - 2.10.4-27
changelog:
  - Fix integer overflow in GdkPixbuf's XBM image file format loader
    (CVE-2012-2370)
    Resolves: #846252


author: Cosimo Cecchi <ccecchi@redhat.com> - 2.10.4-29
changelog:
  - Improve patch to parse CUPS user lpoptions file to avoid crashes
    on s390 and ia64
    Resolves: #603809


author: Karel Klic <kklic@redhat.com> 1.3.5-11:.1
changelog:
  - Added fix for CVE-2010-0001: (64 bit) Integer underflow by decompressing
    LZW format files
    Resolves: rhbz#555088


author: Tim Waugh <twaugh@redhat.com> 1.6.7-4.1.el5_2.4
changelog:
  - Applied patch to make hpssd message parser more robust (bug #457052).
  - Applied patches to fix insecure alert emails (bug #455235).


author: Tim Waugh <twaugh@redhat.com> 1.6.7-5
changelog:
  - Moved libhpip library to main package (bug #457440).
  - Don't use "/usr/bin/env python" for Python scripts (bug #521857).


author: Joe Orton <jorton@redhat.com> 2.2.3-22.el5
changelog:
  - add security fixes for CVE-2008-2939 (#468841)
  - note that the mod_proxy 2.2.9 rebase fixed CVE-2008-2634


author: Joe Orton <jorton@redhat.com> - 2.2.3-31.3
changelog:
  - mod_ssl: add SSLInsecureRenegotiation (#567980)
  - add security fixes for CVE-2010-0408, CVE-2010-0434 (#570440)


author: Joe Orton <jorton@redhat.com> - 2.2.3-43.2
changelog:
  - add security fixes for CVE-2010-1452, CVE-2010-2791 (#623210)
  - mod_deflate: rebase to 2.2.15 (#625435)
  - stop multiple invocations of filter init functions (#625451)


author: Joe Orton <jorton@redhat.com> - 2.2.3-63.1
changelog:
  - add security fixes for CVE-2012-0053, CVE-2012-0031, CVE-2011-3607 (#787596)	
  - remove patch for CVE-2011-3638, obviated by fix for CVE-2011-3639


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV> 2.2.3-63.sl5.1
changelog:
  This package must not feature TUVs branding
    Spec change: The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Added patch httpd-sl_index.html.sl5.patch
    Switches to an SL branded default index
  - Added patch httpd-spec_sl_index.html.sl5.patch
  - Prevented application of patch httpd-sl_index.html.sl5.patch
    This is the patch we need, just can	 be applied in the normal place
  - Prevented application of patch httpd-spec_sl_index.html.sl5.patch


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV> 2.2.3-74.sl5
changelog:
  This package must not feature TUVs branding
    Spec change: The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Added patch httpd-spec_sl_index.html.sl5.patch
  - Added patch httpd-sl_index.html.sl5.patch
    Switches to an SL branded default index
  - Prevented application of patch httpd-sl_index.html.sl5.patch
    This is the patch we need, just can	 be applied in the normal place
  - Prevented application of patch httpd-spec_sl_index.html.sl5.patch


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-spec_sl_index.html.sl.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Ran Regex: (Release: .*).el5(.*) => \1.sl5\2
  -->  Modify release string to note changes
  - Ran Regex: vstring Red Hat => vstring Scientific Linux
  -->  This package must not feature TUVs branding
  - Ran Regex: distro Red Hat => distro Scientific Linux
  -->  This package must not feature TUVs branding
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-spec_sl_index.html.sl.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Ran Regex: vstring Red Hat => vstring Scientific Linux
  -->  This package must not feature TUVs branding
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl5\2
  -->  Modify release string to note changes
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd.ini
  -->  Config file for automated patch script
  - Ran Regex: distro Red Hat Enterprise Linux => distro Scientific Linux
  -->  This package must not feature TUVs branding


author: Doug Ledford <dledford@redhat.com> - 0.4-3
changelog:
  - Rebuild against updated libibmad and libibumad libraries
  - Only need to build require libibmad, it pulls in libibumad
  - Resolves: bz451466


author: Jay Fenlason <fenlason@redhat.com> 1.2-11.2.el5
changelog:
  - Added Requires lines for ibutils-libs to make rpmdiff happier.
  - Add patch for CVE-2008-3277
    Resolves: bz768400


author: Caolan McNamara <caolanm@redhat.com> - 3.6-5.10
changelog:
  - Resolves: rhbz#226949 telegu rendering problem in OOo
  - Resolves: rhbz#228458 gujarati dependent vowel treated as independent
  - Resolves: rhbz#214948 multiple dependant vowel signs displayed as one


author: Doug Ledford <dledford@redhat.com> - 1.5.3-1.el5
changelog:
  - Update to latest upstream version
  - Don't include the newly added devel stuff as it's likely only needed
    internally (and certainly not needed by anything we've supported before
    since we've never shipped it)
  - Related: bz518218


author: Troy Dawson <dawson@fnal.gov> - 15.28.2.8-1
changelog:
  - Initial build based on the iwlwifi-4965-ucode spec file
  - Added older firmwares as well, it now has iwlwifi-3945-2.ucode
    iwlwifi-3945-1.ucode, and iwlwifi-3945.ucode
  - Added the README's to go along with the older firmwares


author: Troy Dawson <dawson@fnal.gov> - 228.57.2.21-6
changelog:
  - Update to 228.57.2.21
  - Added older firmwares as well, it now has iwlwifi-4965-2.ucode
    iwlwifi-4965-1.ucode, and iwlwifi-4965.ucode
  - Added the README's to go along with the older firmwares


author: Ville Skyttä <scop at jpackage.org> - 0:1.5.0.08-1jpp
changelog:
  - 1.5.0_08.
  - Trigger plugin symlinking on seamonkey (#227).
  - Try adding system lib dirs to default java.library.path.
  - Don't install plugin symlinks if plugin doesn't exist.
  - Make package noarch.


author: Martin Matejovic <mmatejov@redhat.com> - 1:1.6.0-1.10.b16
changelog:
  - Update to openjdk build b16
  - Update to icedtea6-1.6
  - Added tzdata-java requirement
  - Added autoconf and automake build requirement
  - Added tzdata-java requirement
  - Added java-1.6.0-openjdk-gcc-stack-markings.patch
  - Added java-1.6.0-openjdk-memory-barriers.patch
  - Added java-1.6.0-openjdk-jar-misc.patch
  - Added java-1.6.0-openjdk-linux-separate-debuginfo.patch
  - Added java-1.6.0-openjdk-securitypatches-20100323.patch
  - Added STRIP_KEEP_SYMTAB=libjvm* to install section, fix bz530402
  - Resolves: rhbz#576124


author: Deepak Bhole <dbhole@redhat.com> - 1:1.6.0.0-1.14.b17.el5
changelog:
  - Synched with el6 branch
  - Updated to IcedTea 1.7.5
  - Resolves: bz639951
  - Also resolves 619800 and 621303


author: Deepak Bhole <dbhole@redhat.com> - 1:1.6.0.0-1.22.1.9.7
changelog:
  - Resolves bz690289
  - Import from RHEL-5_6-Z
  - Updated to IcedTea6 1.9.7
  - Removed all plugin/webstart related commented lines
  - Modified bz entry format in previous logs to get around cvs ack checking bug


author: Deepak Bhole <dbhole@redhat.com> - 1:1.6.0.0-1.22.1.9.8
changelog:
  - Resolves: rhbz#668488
  - Bumped to IcedTea6 1.9.8
  - RH706250, S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent
    disabled get still selected for read ops (win)
  - RH706106, S6618658, CVE-2011-0865: Vulnerability in deserialization
  - RH706111, S7012520, CVE-2011-0815: Heap overflow vulnerability in 
    FileDialog.show()
  - RH706139, S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D 
    code
  - RH706153, S7013969, CVE-2011-0867: NetworkInterface.toString can reveal 
    bindings
  - RH706234, S7013971, CVE-2011-0869: Vulnerability in SAAJ
  - RH706239, S7016340, CVE-2011-0870: Vulnerability in SAAJ
  - RH706241, S7016495, CVE-2011-0868: Crash in Java 2D transforming an image 
    with scale close to zero
  - RH706248, S7020198, CVE-2011-0871: ImageIcon creates Component with null acc
  - RH706245, S7020373, CVE-2011-0864: JSR rewriting can overflow memory address
    size variables


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.23.1.9.10
changelog:
  - Resolves: rhbz#744786
  - Bumped to IcedTea6 1.9.8
   Security fixes
    - S7000600, CVE-2011-3547: InputStream skip() information leak
    - S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor
    - S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow
    - S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager
    - S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine
    - S7055902, CVE-2011-3521: IIOP deserialization code execution
    - S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks
    - S7064341, CVE-2011-3389: JSSE
    - S7070134, CVE-2011-3558: Hotspot unspecified issue
    - S7077466, CVE-2011-3556: RMI DGC server remote code execution
    - S7083012, CVE-2011-3557: RMI registry privileged code execution
    - S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection
   NetX
    - PR794: javaws does not work if a Web Start app jar has a Class-Path element in the manifest


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.25.1.10.6
changelog:
  - Updated to IcedTea6 1.10.6
  - Resolves: rhbz#787142
  - Security fixes
    - S7082299: Fix in AtomicReferenceArray
    - S7088367: Fix issues in java sound
    - S7110683: Issues with some KeyboardFocusManager method
    - S7110687: Issues with TimeZone class
    - S7110700: Enhance exception throwing mechanism in ObjectStreamClass
    - S7110704: Issues with some method in corba
    - S7112642: Incorrect checking for graphics rendering object
    - S7118283: Better input parameter checking in zip file processing
    - S7126960: Add property to limit number of request headers to the HTTP Server
  - Bug fixes
    - RH580478: Desktop files should not use hardcoded path
  - Removed and deleted upstreamed  patch7 - name-rmi-fix.patch
  - Removed and deleted upstreamed Hugepages patches:
    - Source100: 7034464-hugepage.patch
    - Source101: 7037939-hugepage.patch
    - Source102: 7043564-hugepage.patch


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.26.1.10.8
changelog:
  - Updated to IcedTea6 1.10.8
  - Modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch:
    - com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.
    - packages added to patch
  - Resolves: rhbz#828749


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.27.1.10.8
changelog:
  - Modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch:
    - com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils.
    - packages added also to package.definition
  - Resolves: rhbz#828749


author: Deepak Bhole <dbhole@redhat.com> - 1:1.6.0.0-1.28.1.10.10
changelog:
  - Updated to IcedTea6 1.10.10
  - Resolves rhbz#s 856124, 865346, 865348, 865350, 865352, 865354, 865357,
    865359, 865363, 865365, 865370, 865428, 865471, 865434, 865511, 865514,
    865519, 865531, 865541, 865568


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.31.1.11.6
changelog:
  - Updated to icedtea6 1.11.6
  - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch 
  - Resolves: rhbz#906705


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.32.1.11.6
changelog:
  - added patch9 revertTwoWrongSecurityPatches2013-02-06.patch
    to remove   6664509 and 7201064 from 1.11.6 tarball
  - Resolves: rhbz#906705


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.33.1.11.6
changelog:
  - removed patch9 revertTwoWrongSecurityPatches2013-02-06.patch
  - added patch9:   7201064.patch to be reverted
  - added patch10:   8005615.patch to fix the 6664509.patch
  - Resolves: rhbz#906705


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.34.1.11.8
changelog:
  - Updated to icedtea6 1.11.8
  - Removed patch9   7201064.patch
  - Removed patch10   8005615.patch
  - Removed  not-applied patch 6664509.patch
  - Removed mauve as deadly outdated and run on QA
    -  jtreg kept, useless, but valid
  - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch 
  - Resolves: rhbz#911522


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.59.1.11.11
changelog:
  - Updated to icedtea6 1.11.11 - fixed xalan/xerxes privledges
  - removed patch 9 -  removingOfAarch64.patch.patch - fixed upstream
  - removed patch10  patchToFixMalformed8007667.patch - upstreamed
  - Resolves: rhbz#950383


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.39.1.11.11
changelog:
  - added and applied (temporally) one more patch to xalan/xerces privileges
   - patch9 jaxp-backport-factoryfinder.patch
  - will be upstreamed
  - Resolves: rhbz#950383


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950383


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.41.1.11.11.90
changelog:
  - updated to icedtea6-1.11.11.90.tar.gz
  - removed upstreamed patch9 jaxp-backport-factoryfinder.patch
  - removed upstreamed patch10 fixToFontSecurityFix.patch.
  - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#973126


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950384


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.41.1.11.11.90
changelog:
  - updated to icedtea6-1.11.11.90.tar.gz
  - removed upstreamed patch9 jaxp-backport-factoryfinder.patch
  - removed upstreamed patch10 fixToFontSecurityFix.patch.
  - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#973128


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.42.1.11.14
changelog:
  - updated to icedtea6-1.11.14.tar.gz
  - added and applied 1.11.14-fixes.patch, patch10 to fix build issues
  - Resolves: rhbz#1017615


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-3.1.13.0
changelog:
  - updated to icedtea 1.13.1
   - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/
  - updated to jdk6, b30,  21_jan_2014
   - https://openjdk6.java.net/OpenJDK6-B30-Changes.html
  - adapted patch7 1.13_fixes.patch
  - pre 2011 changelog moved to (till now  wrong) pre-2009-spec-changelog (rh1043611)
  - added --disable-system-lcms to configure options to pass build
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#1050187


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-5.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - Resolves: rhbz#1085007


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - Resolves: rhbz#1115865


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-5.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - renmoved upstreamed patch9, 1051245.patch
  - Resolves: rhbz#1085008


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - Resolves: rhbz#1115866


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148898


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Also includes PR2180, so patch dropped from RPM.
  - Resolves: rhbz#1180289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235149


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.2
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.38-1.13.10.0
changelog:
  - Add patch to replace -fno-strict-overflow with -fwrapv on older RHEL 5.11 GCC.
  - Resolves: rhbz#1295772


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.39-1.13.11.0
changelog:
  - Explictly required libXcomposite-devel for PR2868 as nothing else pulls it in
  - Resolves: rhbz#1325429


author: Troy Dawson <dawson@fnal.gov> - 0:1.6.0.16-1.sl5.jpp
changelog:
  - Updated to jdk version 1.6.0-16
  - Added /usr/lib/jvm/java-1.6.0-sun-1.6.0.16/jre/lib/security/blacklist to spec file


author: Troy Dawson <dawson@fnal.gov> - 0:1.6.0.17-3.sl5.jpp
changelog:
  - Added plugin script into post instead of just trigger
    this is so that updates of x86_64 will get the plugin


author: Troy Dawson <dawson@fnal.gov> - 0:1.6.0.19-`.sl5.jpp
changelog:
  - Updated to jdk version 1.6.0-19
  - Added /usr/lib/jvm/java-1.6.0-sun-1.6.0.19/jre/lib/security/trusted.libraries to spec file


author: Troy Dawson <dawson@fnal.gov> - 0:1.6.0.19-1.sl5.jpp
changelog:
  - Updated to jdk version 1.6.0-19
  - Added /usr/lib/jvm/java-1.6.0-sun-1.6.0.20/jre/lib/security/trusted.libraries to spec file


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Explictly required libXcomposite-devel for PR2867 as nothing else pulls it in
  - Resolves: rhbz#1320655


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.0
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1325424


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.0
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (S8161262 (8147466_wrapv) and PR2939 (fontpath)) applied upstream.
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350038


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.1
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Remove unneeded AArch64 environment variable setting.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.0
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate RH1022017 against 2.6.9.
  - Resolves: rhbz#1410612


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.9-2.3.8.1.el5
changelog:
  - Added some of the latest Fedora spec bugfixes
  - Bumped release
  - zlib in BuildReq restricted for  1.2.3-7 or higher
   - see https://bugzilla.redhat.com/show_bug.cgi?id=904231
  - Removed a -icedtea tag from the version
    - package have less and less connections to icedtea7
  - Added gcc-c++ build dependence. Sometimes caused troubles during rpm -bb
  - Added (Build)Requires for fontconfig and xorg-x11-fonts-Type1
    - see https://bugzilla.redhat.com/show_bug.cgi?id=721033 for details
  - logging.properties marked as config(noreplace)
    - see https://bugzilla.redhat.com/show_bug.cgi?id=679180 for details
  - nss.cfg was marked as config(noreplace)
  - slaves sync with el6
  - Resolves: rhbz#950376


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.19-2.3.9.0.el5
changelog:
  - updated to IcedTea  2.3.9 with latest security patches
  - buildver sync to b19
  - rewritten java-1.7.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#950376


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.19-2.3.9.1.el5
changelog:
  - updated to updated IcedTea  2.3.9 with fix to one of security fixes
    -  fixed font glyph offset
  - Resolves: rhbz#950376


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.10.2.el5
changelog:
  - added patch1000 MBeanFix.patch to fix regressions caused by security patches
  - Resolves: rhbz#973117


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.10.4.el5
changelog:
  - updated to newer IcedTea7-forest 2.3.10 with 8010118 fix
  - removed upstreamed patch1000 MBeanFix.patch
  - Resolves: rhbz#973117


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.4.1.4.el5
changelog:
  - updated to icedtea 2.4.1
  - improoved handling of patch111 - nss-config-2.patch
  - backported uniquesuffix from 6.5
  - Resolves: rhbz#978421


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.45-2.4.3.0.el5
changelog:
  - fixed and updated tapset
  - removed bootstrap
  - source 11 redeclared to 1111
  - added source12: TestCryptoLevel.java
  - removed upstreamed patch103 java-1.7.0-openjdk-arm-fixes.patch
  - removed unnecessary patch112 java-1.7.0-openjdk-doNotUseDisabledEcc.patch
  - added patch120: java-1.7.0-openjdk-freetype-check-fix.patch
  - fixed nss 
  - cleaned sources
  - Resolves: rhbz#1017623


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.4.1.el5
changelog:
  - updated to security icedtea 2.4.4
   - icedtea_version set to 2.4.4
   - updatever bumped to       51
   - release reset to 1
  - build requires: java-devel >= 1:1.6.0 changed java7-devel 
  - Resolves: rhbz#1050192


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.55-2.4.7.0.el5
changelog:
  - bumped to future icedtea-forest 2.4.7
  - updatever set to 55, buildver se to 13, release reset to 0
  - removed BuildRequires on pulseaudio >= 0.9.1, devel is enough
  - removed Requires: rhino, BuildRequires is enough
  - updated patch400, java-1.7.0-openjdk-remove-gstabs.patch
  - added JRE_RELEASE_VERSION and ALT_PARALLEL_COMPILE_JOBS
  - ppc64 repalced by power64 macro
  - patch111 applied as dry-run (6.5 forward port)
  - Resolves: rhbz#1085000


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115872


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115873


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.71-2.5.3.1
changelog:
  - Bump to 2.5.3 with security updates.
  - Remove obsolete patches which are now included upstream.
  - Disable LCMS via environment variables rather than maintaining a patch.
  - Resolves: rhbz#1148890


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.0
changelog:
  - Bump to 2.5.4 using OpenJDK 7u75 b13.
  - Fix elliptic curve list as part of fsg.sh
  - Resolves: rhbz#1180294


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.85-2.6.1.3
changelog:
  - Check return value of gio_init in gsettings_init and return false if necessary.
  - Re-enable the use of system GConf.
  - Only ifdef g_type_init&g_free if USE_SYSTEM_GIO and USE_SYSTEM_GCONF are undefined.
  - Resolves: rhbz#1242587


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.3.el5.1
changelog:
  - Changed permissions of sa-jdi.jar to correct 644
  - Correctly removed noarch tag form javadoc, rhel5 donot support noarch subpackages
  - Resolves: rhbz#803732


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.11-2.4.0.el6.1
changelog:
  - Rewritten patch105: java-1.7.0-openjdk-disable-system-lcms.patch
  - Added jxmd and idlj to alternatives
  - make executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
  - Unapplied patch302 and deleted systemtap.patch
  - buildver increased to 11
  - icedtea_version set to 2.4.0
  - Added and applied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
  - Added /lib/security/US_export_policy.jar and lib/security/local_policy.jar
  - Resolves: rhbz#895031


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.4.el6.1
changelog:
  - Rewerted to IcedTea 2.3
    - Rewerted patch105: java-1.7.0-openjdk-disable-system-lcms.patch
    - Removed jcmd and idlj to alternatives
    - make NOT executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
    - Reapplied patch302 and deleted systemtap.patch
    - buildver set to 9
    - icedtea_version set to 2.3.4
    - Unapplied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
    - removed /lib/security/US_export_policy.jar and lib/security/local_policy.jar
    - java-1.7.0-openjdk-java-access-bridge-security.patch's path moved from 
      java.security-linux back to java.security
  - Resolves: rhbz#895031


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.7.0.el5_9
changelog:
  - Removed patch1000 sec-2013-02-01-8005615.patch
  - Removed patch1001 sec-2013-02-01-8005615-sync_with_jdk7u.patch
  - Removed patch1010 sec-2013-02-01-7201064.patch
  - Removed testing
   - mauve was outdated and
   - jtreg was icedtea relict
  - Updated  to icedtea 2.3.7
  - Resolves: rhbz#911527


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.7.1.el5_9
changelog:
  - Updated main source tarball
  - Removed wrong relinking of cacerts (see rhbz 904165)
  - Resolves: rhbz#911527


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Remove unneeded build dependencies on jakarta-commons-logging and prelink/execstack
  - Resolves: rhbz#1295764


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Resolves: rhbz#1320655


author: Deepak Bhole <dbhole@redhat.com> - 0.9.94-0.9
changelog:
  - Fixed release
  - Removed maven build support
  - Removed javadoc sub-package as it needed maven
  - Removed demo subpackage -- it was never built
  - Fixed defattr
  - Removed pre-built jar in prep section


author: Than Ngo <than@redhat.com> 6:3.5.4-19
changelog:
  - Resolves: #251414, knotification cannot be enabled after re-enabling arts from kcontrol
  - Resolves: #251968, kdesktop_lock issue
  - Resolves: #236931, kdm does not cleanup PAM state


author: Than Ngo <than@redhat.com> - 6:3.5.4-20
changelog:
  - Resolves: #469723, Cannot mount floppy disk
  - Resolves: #472295, KDE Desktop icons do not refresh correctly


author: Than Ngo <than@redhat.com> - 3.5.4-10
changelog:
  - Resolves: #490729, CVE-2009-0146 CVE-2009-0147 CVE-2009-0166
    revised patch that adds a fix for badpage10910.pdf


author: Than Ngo <than@redhat.com> - 3.5.4-11
changelog:
  - Resolves: #490729, CVE-2009-0146 CVE-2009-0147 CVE-2009-0166
    revised patch that adds a fix for some potential problems,
    latest upstream patch


author: Than Ngo <than@redhat.com> - 3.5.4-13
changelog:
  - Resolves: #506302
     CVE-2009-0945, KSVG NULL-pointer dereference in the SVGList interface implementation
     CVE-2009-1709, KSVG Pointer use-after-free error in the SVG animation element


author: Than Ngo <than@redhat.com> - 3.5.4-17.1
changelog:
  - Resolves: #639841
      CVE-2010-3702, uninitialized Gfx::parser pointer dereference
      CVE-2010-3704, array indexing error in FoFiType1::parse()


author: Than Ngo <than@redhat.com> - 3.5.4-20
changelog:
  - Resolves: #505621,
      CVE-2009-1687, integer overflow in KJS JavaScript garbage collector
      CVE-2009-1698, KHTML CSS parser - incorrect handling CSS "style" attribute content (DoS, ACE)


author: Don Zickus <dzickus@redhat.com> [2.6.18-127.el5]
changelog:
  - Revert: [i386]: check for dmi_data in powernow_k8 driver (Prarit Bhargava ) [476184]
  - [xen] re-enable using xenpv in boot path for FV guests (Don Dutile ) [473899]
  - [xen] pv_hvm: guest hang on FV save/restore (Don Dutile ) [475778]
  - [openib] fix ipoib oops in unicast_arp_send (Doug Ledford ) [476005]
  - [scsi] fnic: remove link down count processing (mchristi@redhat.com ) [474935]
  - Revert: [x86] disable hpet on machine_crash_shutdown (Neil Horman ) [475652]
  - [scsi] ibmvscsi: EH fails due to insufficient resources (AMEET M. PARANJAPE ) [475618]
  - [x86_64] proc: export GART region through /proc/iomem (Neil Horman ) [475507]
  - [acpi] add xw8600 and xw6600 to GPE0 block blacklist (Prarit Bhargava ) [475418]
  - [net] cxgb3: fixup embedded firmware problems take 2 (Andy Gospodarek ) [469774]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.1.el5]
changelog:
  - [security] introduce missing kfree (Jiri Pirko ) [480597 480598] {CVE-2009-0031}
  - [sched] fix clock_gettime monotonicity (Peter Zijlstra ) [481122 477763]
  - [nfs] create rpc clients with proper auth flavor (Jeff Layton ) [481119 465456]
  - [net] sctp: overflow with bad stream ID in FWD-TSN chunk (Eugene Teo ) [478804 478805] {CVE-2009-0065}
  - [md] fix oops with device-mapper mirror target (Heinz Mauelshagen ) [481120 472558]
  - [openib] restore traffic in connected mode on HCA (AMEET M. PARANJAPE ) [479812 477000]
  - [net] add preemption point in qdisc_run (Jiri Pirko ) [477746 471398] {CVE-2008-5713}
  - [x86_64] copy_user_c assembler can leave garbage in rsi (Larry Woodman ) [481117 456682]
  - [misc] setpgid returns ESRCH in some situations (Oleg Nesterov ) [480576 472433]
  - [s390] zfcp: fix hexdump data in s390dbf traces (Hans-Joachim Picht ) [480996 470618]
  - [fs] hfsplus: fix buffer overflow with a corrupted image (Anton Arapov ) [469637 469638] {CVE-2008-4933}
  - [fs] hfsplus: check read_mapping_page return value (Anton Arapov ) [469644 469645] {CVE-2008-4934}
  - [fs] hfs: fix namelength memory corruption (Anton Arapov ) [470772 470773] {CVE-2008-5025}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.8.el5]
changelog:
  - [misc] exit_notify: kill the wrong capable check [494270 494271] {CVE-2009-1337}
  - [misc] fork: CLONE_PARENT && parent_exec_id interaction (Don Howard ) [479963 479964] {CVE-2009-0028}
  - [scsi] qla2xxx: reduce DID_BUS_BUSY failover errors (Marcus Barrow ) [495635 244967]
  - [nfs] v4: client crash on file lookup with long names (Sachin S. Prabhu ) [494078 493942] {CVE-2009-1336}
  - [net] ixgbe: stop double counting frames and bytes (Andy Gospodarek ) [489459 487213]
  - [xen] x86: update the earlier APERF/MPERF patch (Chris Lalancette ) [495929 493557]
  - [xen] x86: fix dom0 panic when using dom0_max_vcpus (Chris Lalancette ) [495931 485119]
  - [net] fix oops when using openswan (Neil Horman ) [496044 484590]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.13.el5]
changelog:
  - [misc] add some long-missing capabilities to CAP_FS_MASK (Eric Paris ) [499075 497271 499076 497272] {CVE-2009-1072}
  - [agp] zero pages before sending to userspace (Jiri Olsa ) [497025 497026] {CVE-2009-1192}
  - [fs] keep eventpoll from locking up the box (Josef Bacik ) [497322 487585]
  - [misc] waitpid reports stopped process more than once (Vitaly Mayatskikh ) [486945 481199]
  - [ata] libata: ahci enclosure management bios workaround (David Milburn ) [500120 488471]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.14.el5]
changelog:
  - [nfs] v4: client handling of MAY_EXEC in nfs_permission (Peter Staubach ) [500301 500302] {CVE-2009-1630}
  - [fs] proc: avoid info leaks to non-privileged processes (Amerigo Wang ) [499546 499541]
  - [net] tg3: Fix firmware event timeouts (Jiri Pirko ) [502837 481715]
  - [scsi] libiscsi: fix nop response/reply and session cleanup race (Jiri Pirko ) [502916 497411]
  - [fs] cifs: fix pointer and checks in cifs_follow_symlink (Jeff Layton ) [496576 496577] {CVE-2009-1633}
  - [fs] cifs: fix error handling in parse_DFS_referrals (Jeff Layton ) [496576 496577] {CVE-2009-1633}
  - [fs] cifs: buffer overruns when converting strings (Jeff Layton ) [496576 496577] {CVE-2009-1633}
  - [fs] cifs: unicode alignment and buffer sizing problems (Jeff Layton ) [494279 494280] {CVE-2009-1439}
  - [x86] xen: fix local denial of service (Chris Lalancette ) [500950 500951] {CVE-2009-1758}
  - [misc] compile: add -fwrapv to gcc CFLAGS (Don Zickus ) [501751 491266]
  - [misc] random: make get_random_int more random (Amerigo Wang ) [499783 499776]
  - [gfs2] fix uninterruptible quotad sleeping (Steven Whitehouse ) [501742 492943]
  - [mm] cow vs gup race fix (Andrea Arcangeli ) [486921 471613]
  - [mm] fork vs gup race fix (Andrea Arcangeli ) [486921 471613]
  - [nfs] fix hangs during heavy write workloads (Peter Staubach ) [486926 469848]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.4.el5]
changelog:
  - [x86_64] mce: do not clear an unrecoverable error status (Aristeu Rozanski ) [490433 489692]
  - [wireless] iwlwifi: booting with RF-kill switch enabled (John W. Linville ) [489846 482990]
  - [x86_64] fix gettimeoday TSC overflow issue (Prarit Bhargava ) [489847 467942]
  - [misc] signal: modify locking to handle large loads (AMEET M. PARANJAPE ) [489457 487376]
  - [x86] TSC keeps running in C3+ (Luming Yu ) [489310 474091]
  - [net] fix icmp_send and icmpv6_send host re-lookup code (Jiri Pirko ) [489253 439670] {CVE-2009-0778}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.3.1.el5]
changelog:
  - [pci] quirk: disable MSI on VIA VT3364 chipsets (Dean Nelson ) [507529 501374]
  - [char] tty: prevent an O_NDELAY writer from blocking (Mauro Carvalho Chehab ) [510239 506806]
  - [misc] hrtimer: fix a soft lockup (Amerigo Wang ) [418061 418071] {CVE-2007-5966}
  - [misc] hrtimer: check relative timeouts for overflow (AMEET M. PARANJAPE ) [510018 492230]


author: Don Howard <dhoward@redhat.com> [2.6.18-128.4.1.el5]
changelog:
  - [fs] ecryptfs: check tag 11 packet literal data buffer size (Eric Sandeen ) [512862 512863] {CVE-2009-2406}
  - [fs] ecryptfs: check tag 3 packet encrypted key size (Eric Sandeen ) [512886 512887] {CVE-2009-2407}
  - [misc] personality handling: fix PER_CLEAR_ON_SETID (Vitaly Mayatskikh ) [511173 508842] {CVE-2009-1895}
  - [xen] HV: remove high latency spin_lock (Chris Lalancette ) [512311 459410]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.7.1.el5]
changelog:
  - [net] prevent null pointer dereference in udp_sendmsg (Vitaly Mayatskikh) [518047 518043] {CVE-2009-2698}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-164.8.1.el5]
changelog:
  - [xen] iommu-amd: extend loop ctr for polling completion wait (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] iommu: add passthrough and no-intremap parameters (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] iommu: enable amd iommu debug at run-time (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] support interrupt remapping on M-C (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] iommu: move iommu_setup() to setup ioapic correctly (Bhavna Sarathy ) [539687 518474 526766]
  - [net] bnx2x: add support for bcm8727 phy (Stanislaw Gruszka ) [540381 515716]
  - [x86] cpu: upstream cache fixes needed for amd m-c (Bhavna Sarathy ) [540469 526315]
  - [x86_64] set proc id and core id before calling fixup_dcm (Bhavna Sarathy) [540469 526315]
  - [x86] mce_amd: fix up threshold_bank4 creation (Bhavna Sarathy ) [540469 526315]
  - Revert: [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.10.1.el5]
changelog:
  - [net] e1000, r9169: fix rx length check errors (Cong Wang ) [550914 550915]
  - [net] e1000e: fix rx length check errors (Amerigo Wang ) [551222 551223]
  - [net] ipv6: fix ipv6_hop_jumbo remote system crash (Amerigo Wang ) [548642 548643] {CVE-2007-4567}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.11.1.el5]
changelog:
  - [firewire] ohci: handle receive packets with zero data (Jay Fenlason) [547241 547242] {CVE-2009-4138}
  - [x86] sanity check for AMD northbridges (Andrew Jones) [549905 547518]
  - [x86_64] disable vsyscall in kvm guests (Glauber Costa) [550968 542612]
  - [fs] ext3: replace lock_super with explicit resize lock (Eric Sandeen) [549908 525100]
  - [fs] respect flag in do_coredump (Danny Feng) [544188 544189] {CVE-2009-4036}
  - [gfs2] make O_APPEND behave as expected (Steven Whitehouse) [547521 544342]
  - [fs] hfs: fix a potential buffer overflow (Amerigo Wang) [540740 540741] {CVE-2009-4020}
  - [fuse] prevent fuse_put_request on invalid pointer (Danny Feng) [538736 538737] {CVE-2009-4021}
  - [mm] call vfs_check_frozen after unlocking the spinlock (Amerigo Wang) [548370 541956]
  - [infiniband] init neigh->dgid.raw on bonding events (Doug Ledford) [543448 538067]
  - [scsi] gdth: prevent negative offsets in ioctl (Amerigo Wang) [539420 539421] {CVE-2009-3080}
  - [fs] gfs2: fix glock ref count issues (Steven Whitehouse) [544978 539240]
  - [net] call cond_resched in rt_run_flush (Amerigo Wang) [547530 517588]
  - [scsi] megaraid: fix sas permissions in sysfs (Casey Dahlin) [537312 537313] {CVE-2009-3889 CVE-2009-3939}
  - [ia64] kdump: restore registers in the stack on init (Takao Indoh ) [542582 515753]
  - [x86] kvm: don't ask HV for tsc khz if not using kvmclock (Glauber Costa ) [537027 531268]
  - [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481]
  - [x86_64] fix 32-bit process register leak (Amerigo Wang ) [526797 526798]
  - [cpufreq] add option to avoid smi while calibrating (Matthew Garrett ) [537343 513649]
  - [kvm] use upstream kvm_get_tsc_khz (Glauber Costa ) [540896 531025]
  - [net] fix unbalance rtnl locking in rt_secret_reschedule (Neil Horman ) [549907 510067]
  - [net] r8169: imporved rx length check errors (Neil Horman ) [552913 552438]
  - [scsi] lpfc: fix FC ports offlined during target controller faults (Rob Evers ) [549906 516541]
  - [net] emergency route cache flushing fixes (Thomas Graf ) [545662 545663] {CVE-2009-4272}
  - [fs] fasync: split 'fasync_helper()' into separate add/remove functions (Danny Feng ) [548656 548657] {CVE-2009-4141}
  - [scsi] qla2xxx: NPIV vport management pseudofiles are world writable (Tom Coughlan ) [537317 537318] {CVE-2009-3556}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.13.1.el5]
changelog:
  - [net] e1000e: fix broken wol (Andy Gospodarek) [559335 557974]
  - [net] gro: fix illegal merging of trailer trash (Herbert Xu) [561417 537876]
  - [xen] hook sched rebalance logic to opt_hardvirt (Christopher Lalancette ) [562777 529271]
  - [xen] crank the correct stat in the scheduler (Christopher Lalancette ) [562777 529271]
  - [xen] whitespace fixups in xen scheduler (Christopher Lalancette ) [562777 529271]
  - [scsi] cciss: ignore stale commands after reboot (Tomas Henzl ) [562772 525440]
  - [scsi] cciss: version change (Tomas Henzl ) [562772 525440]
  - [scsi] cciss: switch to using hlist (Tomas Henzl ) [562772 525440]
  - [net] bonding: allow bond in mode balance-alb to work (Jiri Pirko ) [560588 487763]
  - [net] e1000e: fix WoL on 82577/82578 (Jiri Pirko ) [543449 517593]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.14.1.el5]
changelog:
  - [fs] ext4: Avoid null pointer dereference when decoding EROFS w/o a journal (Jiri Pirko) [547256 547257] {CVE-2009-4308}
  - [net] sctp: backport cleanups for ootb handling (Neil Horman) [555666 555667] {CVE-2010-0008}
  - [mm] fix sys_move_pages infoleak (Eugene Teo) [562589 562590] {CVE-2010-0415}
  - [x86_64] wire up compat sched_rr_get_interval (Danny Feng) [557684 557092]
  - [net] netfilter: enforce CAP_NET_ADMIN in ebtables (Danny Feng) [555242 555243] {CVE-2010-0007}
  - [misc] fix kernel info leak with print-fatal-signals=1 (Danny Feng) [554583 554584] {CVE-2010-0003}
  - [net] ipv6: fix OOPS in ip6_dst_lookup_tail (Thomas Graf) [559238 552354]
  - [kvm] pvclock on i386 suffers from double registering (Glauber Costa) [561454 557095]
  - [pci] VF can't be enabled in dom0 (Don Dutile) [560665 547980]
  - [kvm] kvmclock won't restore properly after resume (Glauber Costa) [560640 539521]
  - [mm] prevent performance hit for 32-bit apps on x86_64 (Larry Woodman) [562746 544448]
  - [fs] fix possible inode corruption on unlock (Eric Sandeen) [564281 545612]
  - [gfs2] careful unlinking inodes (Steven Whitehouse ) [564288 519049]
  - [gfs2] gfs2_delete_inode failing on RO filesystem (Abhijith Das ) [564290 501359]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.15.1.el5]
changelog:
  - [net] sctp: backport cleanups for ootb handling V2 (Neil Horman) [555666 555667] {CVE-2010-0008}
  - Reverting: [net] sctp: backport cleanups for ootb handling (Neil Horman) [555666 555667] {CVE-2010-0008}


author: Don Zickus <dzickus@redhat.com> [2.6.18-164.el5]
changelog:
  - [misc] information leak in sigaltstack (Vitaly Mayatskikh ) [515396]
  - [misc] execve: must clear current->clear_child_tid (Oleg Nesterov ) [515429]
  - [net] igb: set lan id prior to configuring phy (Stefan Assmann ) [508870]
  - [net] udp: socket NULL ptr dereference (Vitaly Mayatskikh ) [518043] {CVE-2009-2698}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.1.1.el5]
changelog:
  - [net] sky2: revert some phy power refactoring changes (Neil Horman ) [517976 509891]
  - [net] atalk/irda: memory leak to user in getname (Danny Feng ) [519309 519310] {CVE-2009-3001 CVE-2009-3002}
  - [x86_64] fix gettimeoday TSC overflow issue - 1 (Prarit Bhargava ) [489847 467942]
  - [md] prevent crash when accessing suspend_* sysfs attr (Danny Feng ) [518135 518136] {CVE-2009-2849}
  - [nfs] nlm_lookup_host: don't return invalidated nlm_host (Sachin S. Prabhu ) [517967 507549]
  - [net] bonding: tlb/alb: set active slave when enslaving (Jiri Pirko ) [517971 499884]
  - [nfs] r/w I/O perf degraded by FLUSH_STABLE page flush (Peter Staubach ) [521244 498433]
  - [SELinux] allow preemption b/w transition perm checks (Eric Paris ) [520919 516216]
  - [scsi] scsi_transport_fc: fc_user_scan correction (David Milburn ) [521239 515176]
  - [net] tg3: refrain from touching MPS (John Feeney ) [521241 516123]
  - [net] qlge: fix hangs and read performance (Marcus Barrow ) [519783 517893]
  - [scsi] qla2xxx: allow use of MSI when MSI-X disabled (Marcus Barrow ) [519782 517922]
  - [net] mlx4_en fix for vlan traffic (Doug Ledford ) [520906 514141]
  - [net] mlx4_core: fails to load on large systems (Doug Ledford ) [520908 514147]
  - [x86] disable kvmclock by default (Glauber Costa ) [520685 476075]
  - [x86] disable kvmclock when shuting the machine down (Glauber Costa ) [520685 476075]
  - [x86] re-register clock area in prepare_boot_cpu (Glauber Costa ) [520685 476075]
  - [x86] kvmclock smp support (Glauber Costa ) [520685 476075]
  - [x86] use kvm wallclock (Glauber Costa ) [520685 476075]
  - [x86_64] kvm clocksource's implementation (Glauber Costa ) [520685 476075]
  - [x86] kvm: import kvmclock.c (Glauber Costa ) [520685 476075]
  - [x86] kvm: import pvclock.c and headers (Glauber Costa ) [520685 476075]
  - [x86] export additional cpu flags in /proc/cpuinfo (Prarit Bhargava ) [520686 517928]
  - [x86] detect APIC clock calibration problems (Prarit Bhargava ) [521238 503957]
  - [x86] pnpacpi: fix serial ports on IBM Point-of-Sale HW (Kevin Monroe ) [520905 506799]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.2.1.el5]
changelog:
  - [x86_64] kvm: bound last_kvm to prevent backwards time (Glauber Costa ) [524527 524076]
  - [x86] kvm: fix vsyscall going backwards (Glauber Costa ) [524527 524076]
  - [misc] fix RNG to not use first generated random block (Neil Horman ) [523289 522860]
  - [x86] kvm: mark kvmclock_init as cpuinit (Glauber Costa ) [524151 523450]
  - [x86_64] kvm: allow kvmclock to be overwritten (Glauber Costa ) [524150 523447]
  - [x86] kvmclock: fix bogus wallclock value (Glauber Costa ) [524152 519771]
  - [scsi] scsi_dh_rdace: add more sun hardware (mchristi@redhat.com ) [523237 518496]
  - [misc] cprng: fix cont test to be fips compliant (Neil Horman ) [523290 523259]
  - [net] bridge: fix LRO crash with tun (Andy Gospodarek ) [522636 483646]
  - Revert: [x86_64] fix gettimeoday TSC overflow issue - 1 (Don Zickus ) [489847 467942]
  - Revert: [net] atalk/irda: memory leak to user in getname (Danny Feng ) [519309 519310] {CVE-2009-3001 CVE-2009-3002}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.4.1.el5]
changelog:
  - [net] bonding: set primary param via sysfs (Jiri Pirko ) [517971 499884]
  - [scsi] fusion: re-enable mpt_msi_enable option (Tomas Henzl ) [526963 520820]
  - [net] ipt_recent: sanity check hit count (Amerigo Wang ) [527434 523982]
  - [net] ipv4: ip_append_data handle NULL routing table (Jiri Pirko ) [527436 520297]
  - [nfs] fix cache invalidation problems in nfs_readdir (Jeff Layton ) [526960 511170]
  - [net] tc: fix unitialized kernel memory leak (Jiri Pirko ) [520994 520863]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.5.1.el5]
changelog:
  - [fs] eCryptfs: prevent lower dentry from going negative (Eric Sandeen ) [527834 527835] {CVE-2009-2908}
  - [nfs] v4: reclaimer thread stuck in an infinite loop (Sachin S. Prabhu ) [529162 526888]
  - [net] r8169: avoid losing MSI interrupts (Ivan Vecera ) [529366 514589]
  - [scsi] st.c: memory use after free after MTSETBLK ioctl (David Jeffery ) [528133 520192]
  - [net] r8169: balance pci_map/unmap pair, use hw padding (Ivan Vecera ) [529143 515857] {CVE-2009-3613}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.6.1.el5]
changelog:
  - [fs] fix pipe null pointer dereference (Jeff Moyer) [530938 530939] {CVE-2009-3547}
  - [security] require root for mmap_min_addr (Eric Paris ) [518142 518143] {CVE-2009-2695}
  - [net] lvs: adjust sync protocol handling for ipvsadm -2 (Neil Horman ) [528645 524129]
  - [xen] allow booting with broken serial hardware (Chris Lalancette ) [524153 518338]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-164.7.1.el5]
changelog:
  - [xen] fix numa on magny-cours systems (Bhavna Sarathy ) [539684 526051]
  - [xen] fix crash with memory imbalance (Bhavna Sarathy ) [539690 526785]
  - [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481]
  - [acpi] prevent duplicate dirs in /proc/acpi/processor (Matthew Garrett ) [539692 537395]
  - [x86] fix boot crash with < 8-core AMD Magny-cours system (Bhavna Sarathy) [539682 522215]
  - [x86] support amd magny-cours power-aware scheduler fix (Bhavna Sarathy ) [539680 513685]
  - [x86] disable NMI watchdog on CPU remove (Prarit Bhargava ) [539691 532514]
  - [acpi] bm_check and bm_control update (Luming Yu ) [539677 509422]
  - [x86_64] amd: iommu system management erratum 63 fix (Bhavna Sarathy ) [539689 531469]
  - [net] bnx2i/cnic: update driver version for RHEL5.5 (Mike Christie ) [537014 516233]
  - [x86] fix L1 cache by adding missing break (Bhavna Sarathy ) [539688 526770]
  - [x86] amd: fix hot plug cpu issue on 32-bit magny-cours (Bhavna Sarathy ) [539688 526770]
  - [acpi] disable ARB_DISABLE on platforms where not needed (Luming Yu ) [539677 509422]
  - [fs] private dentry list to avoid dcache_lock contention (Lachlan McIlroy ) [537019 526612]
  - [scsi] qla2xxx: enable msi-x correctly on qlogic 2xxx series (Marcus Barrow ) [537020 531593]
  - [apic] fix server c1e spurious lapic timer events (Bhavna Sarathy ) [539681 519422]
  - [net] netlink: fix typo in initialization (Jiri Pirko ) [528872 527906]
  - [x86] set cpu_llc_id on AMD CPUs (Bhavna Sarathy ) [539678 513684]
  - [x86] fix up threshold_bank4 support on AMD Magny-cours (Bhavna Sarathy ) [539678 513684]
  - [x86] fix up L3 cache information for AMD Magny-cours (Bhavna Sarathy ) [539678 513684]
  - [x86] amd: fix CPU llc_shared_map information (Bhavna Sarathy ) [539678 513684]
  - [nfs] v4: fix setting lock on open file with no state (Jeff Layton ) [533114 533115] {CVE-2009-3726}
  - [misc] futex priority based wakeup (Jon Thomas ) [533858 531552]
  - [dlm] use GFP_NOFS on all lockspaces (David Teigland ) [533859 530537]
  - [drm] r128: check for init on all ioctls that require it (Danny Feng ) [529602 529603] {CVE-2009-3620}
  - [scsi] mpt: errata 28 fix on LSI53C1030 (Tomas Henzl ) [529308 518689]
  - [x86] add ability to access Nehalem uncore config space (John Villalovos ) [539675 504330]
  - [net] AF_UNIX: deadlock on connecting to shutdown socket (Jiri Pirko ) [529630 529631] {CVE-2009-3621}
  - [fs] inotify: remove debug code (Danny Feng ) [533822 499019]
  - [fs] inotify: fix race (Danny Feng ) [533822 499019]
  - [audit] dereferencing krule as if it were an audit_watch (Alexander Viro ) [533861 526819]
  - [mm] fix spinlock performance issue on large systems (John Villalovos ) [539685 526078]
  - [x86] finish sysdata conversion (Danny Feng ) [537346 519633]
  - [pci] pciehp: fix PCIe hotplug slot detection (Michal Schmidt ) [530383 521731]
  - [x86] oprofile: support arch perfmon (John Villalovos ) [539683 523479]
  - [x86] oprofile: fix K8/core2 on multiple cpus (John Villalovos ) [539683 523479]
  - [x86] oprofile: utilize perf counter reservation (John Villalovos ) [539683 523479]
  - [pci] avoid disabling acpi to use non-core PCI devices (Mauro Carvalho Chehab ) [539675 504330]
  - [misc] support Intel multi-APIC-cluster systems (Prarit Bhargava ) [539676 507333]
  - [x86] suspend-resume: work on large logical CPU systems (John Villalovos ) [539674 499271]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.9.1.el5]
changelog:
  - [xen] ia64: unset be from the task psr (Andrew Jones) [587475 587477] {CVE-2010-2070}
  - [fs] ext4: MOVE_EXT can't overwrite append-only files (Eric Sandeen) [601007 601008] {CVE-2010-2066}
  - [pci] acpiphp: fix missing acpiphp_glue_exit (Prarit Bhargava) [607486 515556]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.10.1.el5]
changelog:
  - [fs] xfs: don't let swapext operate on write-only files (Jiri Pirko) [605160 605161] {CVE-2010-2226}
  - [fs] nfs: fix bug in nfsd4 read_buf (Jiri Olsa) [612034 612035] {CVE-2010-2521}
  - [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612170 612171] {CVE-2010-2524}
  - [security] keys: new key flag for add_key from userspace (Jeff Layton) [612170 612171] {CVE-2010-2524}
  - [message] mptsas: fix disk add failing due to timeout (Rob Evers) [612539 542892]
  - [block] cfq-iosched: fix bad locking in changed_ioprio (Jeff Moyer) [607483 582435]
  - [block] cfq-iosched: kill cfq_exit_lock (Jeff Moyer) [607483 582435]
  - [fs] cifs: fix kernel BUG with remote OS/2 server (Jeff Layton) [608587 608588] {CVE-2010-2248}
  - [net] bluetooth: fix possible bad memory access via sysfs (Mauro Carvalho Chehab) [576020 576021] {CVE-2010-1084}
  - [net] tcp: fix rcv mss estimate for lro (Stanislaw Gruszka) [613900 593801]
  - [net] cnic: fix panic when nl msg rcvd when device down (Stanislaw Gruszka) [615260 595862]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.11.2.el5]
changelog:
  - [mm] pass correct mm when growing stack (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix up some user-visible effects of stack guard page (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix page table unmap for stack guard page properly (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix missing unmap for stack guard page failure case (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] keep a guard page below a grow-down stack segment (Jiri Pirko) [607857 607858] {CVE-2010-2240}


author: Don Howard <dhoward@redhat.com> [2.6.18-194.11.4.el5]
changelog:
  - [misc] make compat_alloc_user_space() incorporate the access_ok() (Don Howard) [634463 634464] {CVE-2010-3081}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.17.1.el5]
changelog:
  - Syncing following patch from branched build:
  - [misc] make compat_alloc_user_space() incorporate the access_ok() (Don Howard) [634463 634464] {CVE-2010-3081}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.1.1.el5]
changelog:
  - [xen] arpl on MMIO area crashes the guest (Paolo Bonzini) [572979 572982] {CVE-2010-0730}
  - [mm] fix boot on s390x after bootmem overlap patch (Amerigo Wang) [580838 550974]
  - [net] bnx2: avoid restarting cnic in some contexts (Andy Gospodarek) [581148 554706]
  - [iscsi] fix slow failover times (Mike Christie) [580840 570681]
  - [misc] kernel: fix elf load DoS on x86_64 (Danny Feng) [560552 560553] {CVE-2010-0307}
  - [netlink] connector: delete buggy notification code (Jiri Olsa) [561684 561685] {CVE-2010-0410}
  - [sound] hda_intel: avoid divide by zero in azx devices (Jaroslav Kysela) [567171 567172] {CVE-2010-1085}
  - [dvb] fix endless loop when decoding ULE at dvb-core (Mauro Carvalho Chehab) [569241 569242] {CVE-2010-1086}
  - [scsi] fnic: fix tx queue handling (Mike Christie) [580829 576709]
  - [fusion] mptsas: fix event_data alignment (Tomas Henzl) [580832 570000]
  - [edac] fix internal error message in amd64_edac driver (Bhavna Sarathy) [580836 569938]
  - [x86_64] fix floating point state corruption after signal (Oleg Nesterov) [580841 560891]
  - [mm] don't let reserved memory overlap bootmem_map (Amerigo Wang) [580838 550974]
  - [s390] kernel: correct TLB flush of page table entries (Hendrik Brueckner) [580839 545527]
  - [xen] iommu: clear IO-APIC pins on boot and shutdown (Paolo Bonzini) [580199 548201]
  - [xen] vtd: fix ioapic pin array (Don Dugger) [581150 563546]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.30.1.el5]
changelog:
  - [scsi] lpfc: set heartbeat timer off by default (Rob Evers) [658079 655119]
  - [misc] posix-cpu-timers: workaround for mt exec problems (Oleg Nesterov) [656265 656266] {CVE-2010-4248}
  - [fs] setup_arg_pages: diagnose excessive argument size (Oleg Nesterov) [645226 645227] {CVE-2010-3858}
  - [net] inet_diag: make sure we run audited bytecode (Jiri Pirko) [651266 651267] {CVE-2010-3880}
  - [net] limit sendto/recvfrom/iovec total length to INT_MAX (Jiri Pirko) [645871 645872] {CVE-2010-3859}
  - [bluetooth] hci_ldisc: fix missing NULL check (Jarod Wilson) [655664 655666] {CVE-2010-4242}
  - [virt] xen: add bounds req-process loop in blkback/blktap (Laszlo Ersek) [656208 654546] {CVE-2010-4247}
  - [virt] xen: don't leak dev refs on bad xenbus transitions (Laszlo Ersek) [636412 635999] {CVE-2010-3699}
  - [scsi] lpfc: fix crashes on NULL pnode dereference (Rob Evers) [658864 649489]
  - [scsi] qla2xxx: check null fcport in _queuecommands (Chad Dupuis) [657029 644863]
  - [fs] gfs2: fix race in unlinked inode deallocation (Robert S Peterson) [651811 643165]
  - [scsi] lpfc: fix a BUG_ON in lpfc_abort_handler (Rob Evers) [658378 639028]
  - [scsi] re-enable transistions from OFFLINE to RUNNING (Mike Christie) [658934 641193]
  - [scsi] scsi_dh_alua: handle transitioning state correctly (Mike Snitzer) [657028 619361]
  - [misc] add round_jiffies_up and related routines (Michal Schmidt) [658520 556476]
  - [fs] fix dcache accounting bug (Josef Bacik) [658857 596548]
  - [usb] uhci: fix oops in uhci_scan_schedule (Pete Zaitcev) [657319 516851]
  - [scsi] lpfc: fix panic in lpfc_scsi_cmd_iocb_cmpl (Rob Evers) [658379 603806]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.31.1.el5]
changelog:
  - [fs] nfs: set lock_context field in nfs_writepage_sync (Jeff Layton) [663381 660580]
  - [fs] nfs: remove problematic calls to nfs_clear_request (Jeff Layton) [663353 656492]
  - [fs] nfs: handle alloc failures in nfs_create_request (Jeff Layton) [663353 656492]
  - [fs] nfs: clean up nfs_create_request (Jeff Layton) [663353 656492]
  - [virt] xen: fix netback hotplug regression in xenbus fix (Laszlo Ersek) [636412 635999] {CVE-2010-3699}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.6.1.el5]
changelog:
  - [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595580 595399] {CVE-2010-1641}
  - [mm] clear page errors when issuing a fresh read of page (Rik van Riel) [599739 590763]
  - [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585099 585100] {CVE-2010-1437}
  - [net] sctp: file must be valid before setting timeout (Jiri Pirko) [598355 578261]
  - [net] tg3: fix panic in tg3_interrupt (John Feeney) [600498 569106]
  - [net] e1000/e1000e: implement simple interrupt moderation (Andy Gospodarek) [599332 586416]
  - [net] cnic: Fix crash during bnx2x MTU change (Stanislaw Gruszka) [596385 582367]
  - [net] bxn2x: add dynamic lro disable support (Stanislaw Gruszka) [596385 582367]
  - [net] implement dev_disable_lro api for RHEL5 (Stanislaw Gruszka) [596385 582367]
  - [x86_64] fix time drift due to faulty lost tick tracking (Ulrich Obergfell) [601090 579711]
  - [net] neigh: fix state transitions via Netlink request (Jiri Pirko) [600215 485903]
  - [mm] fix hugepage corruption using vm.drop_caches (Larry Woodman) [599737 579469]
  - [nfs] don't unhash dentry in nfs_lookup_revalidate (Jeff Layton) [596384 582321]
  - [fs] remove unneccessary f_ep_lock from fasync_helper (Lachlan McIlroy) [599730 567479]
  - [xen] set hypervisor present CPUID bit (Paolo Bonzini) [599734 573771]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.7.1.el5]
changelog:
  - [virt] don't compute pvclock adjustments if we trust tsc (Glauber Costa) [601080 570824]
  - [virt] add a global synchronization point for pvclock (Glauber Costa) [601080 570824]
  - [virt] enable pvclock flags in vcpu_time_info structure (Glauber Costa) [601080 570824]
  - [misc] add atomic64_cmpxcgh to x86_64 include files (Glauber Costa) [601080 570824]
  - [x86] grab atomic64 types from upstream (Glauber Costa) [601080 570824]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-237.el5]
changelog:
  - [block] fully zeroize request struct in rq_init (Rob Evers) [662154]
  - [scsi] qla4xxx: update to 5.02.04.02.05.06-d0 (Chad Dupuis) [656999]
  - [scsi] qla4xxx: make get_sys_info function return void (Chad Dupuis) [656999]
  - [scsi] qla4xxx: don't default device to FAILED state (Chad Dupuis) [656999]
  - [scsi] qla4xxx: mask bits in F/W Options during init (Chad Dupuis) [656999]
  - [scsi] qla4xxx: update to 5.02.04.01.05.06-d0 (Chad Dupuis) [661768]
  - [scsi] qla4xxx: disable irq instead of req pci_slot_reset (Chad Dupuis) [661768]
  - [scsi] qla4xxx: no device add until scsi_add_host success (Chad Dupuis) [661768]
  - [fs] nfs: set lock_context field in nfs_writepage_sync (Jeff Layton) [660580]
  - [scsi] bfa: fix crash reading driver sysfs statistics (Rob Evers) [659880] {CVE-2010-4343}
  - [misc] cpufeature: avoid corrupting cpuid vendor id (Matthew Garrett) [568751]
  - [char] drm: don't set signal blocker on master process (Dave Airlie) [570604]
  - [fs] nfs: remove problematic calls to nfs_clear_request (Jeff Layton) [656492]
  - [fs] nfs: handle alloc failures in nfs_create_request (Jeff Layton) [656492]
  - [fs] nfs: clean up nfs_create_request (Jeff Layton) [656492]
  - [net] forcedeth: fix race condition in latest backport (Ivan Vecera) [658434]
  - [net] cxgb3: fix read of uninitialized stack memory (Jay Fenlason) [633155] {CVE-2010-3296}
  - [net] tg3: increase jumbo flag threshold (John Feeney) [660506]
  - [net] s2io: fix netdev initialization failure (Bob Picco) [654948]
  - [net] igb: only use vlan_gro_receive if vlans registered (Stefan Assmann) [660190] {CVE-2010-4263}
  - [net] ipv6: try all routers with unknown reachable state (Thomas Graf) [661393]
  - [misc] kernel: fix address limit override in OOPS path (Dave Anderson) [659571] {CVE-2010-4258}


author: Jarod Wilson <jarod@redhat.com> [2.6.18-238.el5]
changelog:
  - [net] bnx2: remove extra call to pci_map_page (John Feeney) [663509]
  - [fs] nfs: set lock_context field in nfs_readpage_sync (Jeff Layton) [663853]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-238.1.1.el5]
changelog:
  - [scsi] megaraid: give FW more time to recover from reset (Tomas Henzl) [667141 665427]
  - [fs] gfs2: fix statfs error after gfs2_grow (Robert S Peterson) [666792 660661]
  - [mm] prevent file lock corruption using popen(3) (Larry Woodman) [667050 664931]
  - [net] sctp: fix panic from bad socket lock on icmp error (Neil Horman) [665476 665477] {CVE-2010-4526}


author: Phillip Lougher <plougher@redhat.com> [2.6.18-238.10.1.el5]
changelog:
  - [fs] gfs2: creating large files suddenly slow to a crawl (Robert S Peterson) [690239 683155]
  - [virt] hypervisor: Overflow fix for clocks > 4GHz (Zachary Amsden) [690134 673242]
  - [usb] fix usbfs isochronous data transfer regression (Don Zickus) [696136 688926]
  - [fs] partitions: Fix corrupted OSF partition table parsing (Danny Feng) [688022 688023] {CVE-2011-1163}
  - [misc] pm: add comment explaining is_registered kabi work-around (Don Zickus) [689699 637930]
  - [media] sn9c102: fix world-wirtable sysfs files (Don Howard) [679304 679305]
  - [scsi] scsi_dh_rdac: Add two new IBM devices to rdac_dev_list (Rob Evers) [692370 691460]
  - [fs] block: fix submit_bh discarding barrier flag on sync write (Lukas Czerner) [690795 667673]
  - [net] netfilter/ipt_CLUSTERIP: fix buffer overflow (Jiri Pirko) [689339 689340]
  - [net] netfilter: ip6_tables: fix infoleak to userspace (Jiri Pirko) [689348 689349] {CVE-2011-1172}
  - [net] netfilter/ip_tables: fix infoleak to userspace (Jiri Pirko) [689331 689332] {CVE-2011-1171}
  - [net] netfilter/arp_tables: fix infoleak to userspace (Jiri Pirko) [689322 689323] {CVE-2011-1170}
  - [base] Fix potential deadlock in driver core (Don Zickus) [689699 637930]
  - [net] forcedeth/r8169: call netif_carrier_off at end of probe (Ivan Vecera) [689808 689805 664705 664707]
  - [net] ixgbe: fix for 82599 erratum on Header Splitting (Andy Gospodarek) [693751 680531]
  - [net] ixgbe: limit VF access to network traffic (Andy Gospodarek) [693751 680531]
  - [fs] lockd: make lockd_down wait for lockd to come down (Jeff Layton) [688156 653286]
  - [fs] proc: protect mm start_/end_code in /proc/pid/stat (Eugene Teo) [684570 684571] {CVE-2011-0726}
  - [net] dccp: fix oops in dccp_rcv_state_process (Eugene Teo) [682955 682956] {CVE-2011-1093}
  - [net] bluetooth: fix bnep buffer overflow (Don Howard) [681318 681319] {CVE-2011-1079}
  - [fs] nfs: break nfsd v4 lease on unlink, link, and rename (J. Bruce Fields) [693755 610093]
  - [fs] nfs: break lease on nfsd v4 setattr (J. Bruce Fields) [693755 610093]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-238.12.1.el5]
changelog:
  - [x86_64] Ignore spurious IPIs left over from crash kernel (Myron Stowe) [699610 692921]
  - [i386] Ignore spurious IPIs left over from crash kernel (Myron Stowe) [699610 692921]
  - [xen] fix MAX_EVTCHNS definition (Laszlo Ersek) [701242 701240]
  - [net] ixgbe: fix for link failure on SFP+ DA cables (Don Howard) [696181 653236]
  - [net] netxen: limit skb frags for non tso packet (Phillip Lougher) [699609 672368]
  - [block] cciss: fix lost command problem (Phillip Lougher) [696503 696153]
  - [fs] gfs2: fix filesystem hang caused by incorrect lock order (Robert S Peterson) [688855 656032]
  - [fs] gfs2: restructure reclaim of unlinked dinodes (Phillip Lougher) [688855 656032]
  - [fs] gfs2: unlock on gfs2_trans_begin error (Robert S Peterson) [688855 656032]
  - [scsi] mpt2sas: prevent heap overflows and unchecked access (Tomas Henzl) [694526 694527] {CVE-2011-1495 CVE-2011-1494}
  - [net] bridge/netfilter: fix ebtables information leak (Don Howard) [681325 681326] {CVE-2011-1080}
  - [net] bluetooth: fix sco information leak to userspace (Don Howard) [681310 681311] {CVE-2011-1078}
  - [fs] fix corrupted GUID partition table kernel oops (Jerome Marchand) [695979 695980] {CVE-2011-1577}
  - [xen] x86/domain: fix error checks in arch_set_info_guest (Laszlo Ersek) [688581 688582] {CVE-2011-1166}
  - [net] bridge: fix initial packet flood if !STP (Jiri Pirko) [701222 695369]
  - [fs] nfsd: fix auth_domain reference leak on nlm operations (J. Bruce Fields) [697448 589512]
  - [scsi] qla2xxx: no reset/fw-dump on CT/ELS pt req timeout (Chad Dupuis) [689700 660386]
  - [mm] set barrier and send tlb flush to all affected cpus (Prarit Bhargava) [696908 675793]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-238.17.1.el5]
changelog:
  - [net] bluetooth: l2cap and rfcomm: fix info leak to userspace (Thomas Graf) [703020 703021] {CVE-2011-2492}
  - [net] inet_diag: fix inet_diag_bc_audit data validation (Thomas Graf) [714538 714539] {CVE-2011-2213}
  - [misc] signal: fix kill signal spoofing issue (Oleg Nesterov) [690030 690031] {CVE-2011-1182}
  - [fs] proc: fix signedness issue in next_pidmap (Oleg Nesterov) [697826 697827] {CVE-2011-1593}
  - [char] agp: fix OOM and buffer overflow (Jerome Marchand) [699009 699010] {CVE-2011-1746}
  - [char] agp: fix arbitrary kernel memory writes (Jerome Marchand) [699005 699006] {CVE-2011-2022 CVE-2011-1745}
  - [infiniband] core: Handle large number of entries in poll CQ (Jay Fenlason) [668370 668371] {CVE-2011-1044 CVE-2010-4649}
  - [infiniband] core: fix panic in ib_cm:cm_work_handler (Jay Fenlason) [679995 679996] {CVE-2011-0695}
  - [fs] validate size of EFI GUID partition entries (Anton Arapov) [703027 703028] {CVE-2011-1776}


author: Phillip Lougher <plougher@redhat.com> [2.6.18-238.18.1.el5]
changelog:
  - [xen] disregard trailing bytes in an invalid page (Paolo Bonzini) [719066 717742]
  - [xen] prep __get_instruction_length_from_list for partial buffers (Paolo Bonzini) [719066 717742]
  - [xen] remove unused argument to __get_instruction_length (Phillip Lougher) [719066 717742]
  - [xen] let __get_instruction_length always read into own buffer (Paolo Bonzini) [719066 717742]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-238.19.1.el5]
changelog:
  - Revert: [xen] hvm: svm support cleanups (Andrew Jones) [703715 702657] {CVE-2011-1780}
  - Revert: [xen] hvm: secure svm_cr_access (Andrew Jones) [703715 702657] {CVE-2011-1780}
  - Revert: [xen] let __get_instruction_length always read into own buffer (Paolo Bonzini) [719066 717742]
  - Revert: [xen] remove unused argument to __get_instruction_length (Phillip Lougher) [719066 717742]
  - Revert: [xen] prep __get_instruction_length_from_list for partial buffers (Paolo Bonzini) [719066 717742]
  - Revert: [xen] disregard trailing bytes in an invalid page (Paolo Bonzini) [719066 717742]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-238.3.1.el5]
changelog:
  - [net] tcp: fix shrinking windows with window scaling (Jiri Pirko) [669300 627496]
  - [virt] xen: no enable extended PCI cfg space via IOports (Don Dutile) [671340 661478]
  - [net] e1000: Avoid unhandled IRQ (Dean Nelson) [670807 651512]
  - [net] e1000: fix screaming IRQ (Dean Nelson) [670807 651512]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-238.4.1.el5]
changelog:
  - [net] be2net: fix missing trans_start update (Ivan Vecera) [674273 671595]
  - [net] fix unix socket local dos (Neil Horman) [656759 656760] {CVE-2010-4249}
  - [net] core: clear allocs for privileged ethtool actions (Jiri Pirko) [672432 672433] {CVE-2010-4655}
  - [net] limit socket backlog add operation to prevent DoS (Jiri Pirko) [657308 657309] {CVE-2010-4251}
  - [block] fix accounting bug on cross partition merges (Jerome Marchand) [672253 646816]
  - [char] virtio: Wake console outvq on host notifications (Amit Shah) [673983 673459]
  - [char] virtio: make console port names a KOBJ_ADD event (Amit Shah) [673984 669909]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-238.7.1.el5]
changelog:
  - [fs] partitions: Validate map_count in Mac part tables (Danny Feng) [679283 679284] {CVE-2011-1010}
  - [x86] fix AMD family 0x15 guest boot issue on 64-bit host (Frank Arnold) [679747 667234]
  - [sound] alsa: cache mixer values on usb-audio devices (Don Zickus) [680043 678074]
  - [media] dvb: fix av7110 negative array offset (Mauro Carvalho Chehab) [672401 672402] {CVE-2011-0521}
  - [message] mptfusion: add required mptctl_release call (Tomas Henzl) [677173 660871]
  - [fs] nfs: pure nfs client performance using odirect (Jeff Layton) [677172 643441]
  - [mm] fix install_special_mapping skips security_file_mmap (Frantisek Hrbata) [662196 662197] {CVE-2010-4346}
  - [scsi] device_handler: fix alua_rtpg port group id check (Mike Snitzer) [681795 669961]
  - [net] cnic: fix big endian bug with device page tables (Steve Best) [674774 669527]
  - [net] gro: reset dev pointer on reuse (Andy Gospodarek) [674588 600350]
  - [misc] add ignore_loglevel kernel parameter (Amerigo Wang) [675665 662102]
  - [misc] add bootmem_debug kernel parameter (Amerigo Wang) [675665 662102]
  - [fs] gfs2: remove iopen glocks from cache on delete fail (Benjamin Marzinski) [675909 666080]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-238.8.1.el5]
changelog:
  - [message] mptfusion: fix msgContext in mptctl_hp_hostinfo (Tomas Henzl) [684128 646513]
  - [fs] nfs: fix use of slab alloc'd pages in skb frag list (Neil Horman) [682642 682643] {CVE-2011-1090}
  - [s390] remove task_show_regs (Danny Feng) [677852 677853] {CVE-2011-0710}
  - [misc] vdso: export wall_to_monotonic (Prarit Bhargava) [688312 675727]
  - [x86_64] Use u32, not long, to set reset vector back to 0 (Don Zickus) [682673 675258]
  - [misc] vmware: increase apic_calibration_diff to 10000 (Prarit Bhargava) [680350 665197]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-238.9.1.el5]
changelog:
  - [md] dm-mpath: fix NULL deref when path parameter missing (Mike Snitzer) [683443 673058]
  - [md] dm-mpath: wait for pg_init completion on suspend (Mike Snitzer) [683443 673058]
  - [md] dm-mpath: hold io until all pg_inits completed (Mike Snitzer) [683443 673058]
  - [md] dm-mpath: skip activate_path for failed paths (Mike Snitzer) [683443 673058]
  - [md] dm-mpath: pass struct pgpath to pg init done (Mike Snitzer) [683443 673058]
  - [md] dm-mpath: prevent io from work queue while suspended (Mike Snitzer) [683443 673058]
  - [md] dm-mpath: add mutex to sync adding and flushing work (Mike Snitzer) [683443 673058]
  - [md] dm-mpath: flush workqueues before suspend completes (Mike Snitzer) [683443 673058]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.10.1.el5]
changelog:
  - [net] be2net: enable NETIF_F_LLTX and add own locking of Tx path (Ivan Vecera) [750912 731806]
  - [net] be2net: fix multicast filter programming (Ivan Vecera) [750912 731806]
  - [net] be2net: fix cmd-rx-filter not notifying MCC (Ivan Vecera) [750912 731806]
  - [net] be2net: use RX_FILTER cmd to program multicast addresses (Ivan Vecera) [750912 731806]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.11.1.el5]
changelog:
  - [fs] gfs2: speed up large file delete/unlink (Robert S Peterson) [743806 738440]
  - [fs] cifs: fix wrong buffer length returned by SendReceive (Sachin Prabhu) [750842 720363]
  - [virt] kvm: fix lost tick accounting for 32 bit kvm-clock (Rik van Riel) [747875 731599]
  - [virt] xen/netback: disable features not supported by netfront (Paolo Bonzini) [746600 746225]
  - [fs] nfs: don't redirty inodes with no outstanding commits (Jeff Layton) [750477 739665]
  - [net] tg3: call netif_carrier_off to initialize operstate value (John Feeney) [744700 635982]
  - [xen] make test_assign_device domctl dependent on intremap hw (Laszlo Ersek) [745726 740203]
  - [xen] Propagate target dom within XEN_DOMCTL_test_assign_device (Laszlo Ersek) [745726 740203]
  - [net] sctp: encode PROTOCOL VIOLATION error cause correctly (Thomas Graf) [750457 636828]
  - [fs] cifs: always do is_path_accessible check in cifs_mount (Jeff Layton) [738299 738300] {CVE-2011-3363}
  - [fs] cifs: add fallback in is_path_accessible for old servers (Jeff Layton) [738299 738300] {CVE-2011-3363}
  - [char] tpm: Zero buffer after copying to userspace (Jiri Benc) [732630 732631] {CVE-2011-1162}
  - [fs] hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops (Phillip Lougher) [712775 712776] {CVE-2011-2203}
  - [net] sctp: Set correct error cause value for missing parameters (Thomas Graf) [750451 629938]
  - [misc] kernel: plug taskstats io infoleak (Jerome Marchand) [716845 716846] {CVE-2011-2494}
  - [usb] Make device reset stop retrying after disconnect (Don Zickus) [750841 709699]
  - [net] ipv6: properly use ICMP6MSGOUT_INC_STATS in ndisc_send_skb (Jiri Pirko) [743611 698728]
  - [scsi] Reduce error recovery time by reducing use of TURs (Mike Christie) [741273 694625]
  - [mm] s390: fix first time swap use results in heavy swapping (Hendrik Brueckner) [747876 722482]
  - [virt] xen: fix GFP mask handling in dma_alloc_coherent (Laszlo Ersek) [742282 730247]
  - [s390] kernel: fix system hang if hangcheck timer expires (Hendrik Brueckner) [747872 730313]
  - [usb] fix interface sysfs file-creation bug (Don Zickus) [750848 637930]
  - [usb] don't touch sysfs stuff when altsetting is unchanged (Don Zickus) [750848 637930]
  - [base] Fix potential deadlock in driver core (Don Zickus) [750848 637930]
  - [security] keys: Fix NULL deref in user-defined key type (David Howells) [751300 751301]
  - [xen] passthrough: block VT-d MSI trap injection (Paolo Bonzini) [716301 716302] {CVE-2011-1898}


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.15.1.el5]
changelog:
  - [net] e1000e: Avoid wrong check on TX hang (Dean Nelson) [766485 746272]
  - [fs] xfs: Fix memory corruption in xfs_readlink (Carlos Maiolino) [749159 749160] {CVE-2011-4077}
  - [pci] intel-iommu: Default to non-coherent for unattached domains (Don Dutile) [766803 753924]
  - [fs] nfs: remove BUG() from encode_share_access() (Jeff Layton) [755442 754901] {CVE-2011-4324}
  - [misc] irq: Check for spurious IRQ only on disabled IRQs (Prarit Bhargava) [759387 756412]
  - [fs] hfs: add sanity check for file name length (Eric Sandeen) [755432 755433] {CVE-2011-4330}
  - [fs] proc: Fix select on /proc files without ->poll (David Howells) [755483 751214]
  - [fs] nfs: Ensure we mark inode as dirty if early exit from commit (Jeff Layton) [755482 714020]
  - [x86] apic: ack all pending irqs when crashed/on kexec (hiro muneda) [750460 742079]
  - [virt] kvm: fix regression w/ 32 bit KVM clock (Rik van Riel) [747875 753789 751742 731599]
  - [virt] kvm: fix lost tick accounting for 32 bit kvm-clock (Rik van Riel) [747875 731599]
  - [fs] jbd/jbd2: validate sb->s_first in journal_get_superblock (Eryu Guan) [753343 706810] {CVE-2011-4132}
  - [net] igb: enable link power down (Stefan Assmann) [752735 742514]
  - [fs] proc: fix oops on invalid /proc/<pid>/maps access (Johannes Weiner) [747851 747699] {CVE-2011-3637}
  - [block] cciss: bump driver version (Tomas Henzl) [758024 714129]
  - [block] cciss: need to delay after a PCI Power Management reset (Tomas Henzl) [758024 714129]
  - [block] cciss: auto engage scsi susbsystem (Tomas Henzl) [758024 714129]
  - [block] cciss: store pdev in hba struct (Tomas Henzl) [758024 714129]
  - [block] cciss: use consistent variable names (Tomas Henzl) [758024 714129]
  - [block] cciss: add a commandline switch for simple mode (Tomas Henzl) [758024 714129]
  - [fs] proc: close race with exec in mem_read() (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [mm] implement access_remote_vm (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [mm] factor out main logic of access_process_vm (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [mm] use mm_struct to resolve gate vma's in __get_user_pages (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [mm] make in_gate_area take mm_struct instead of a task_struct (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [mm] make get_gate_vma take mm_struct instead of task_struct (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [x86_64] mark assoc mm when running task in 32 bit compat mode (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [misc] sched: add ctx tag to mm running task in ia32 compat mode (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [fs] proc: require the target to be tracable (or yourself) (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [fs] proc: close race in /proc/*/environ (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [fs] proc: report errors in /proc/*/*map* sanely (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [fs] proc: shift down_read(mmap_sem) to the caller (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [fs] detect exec transition phase with new mm but old creds (Johannes Weiner) [692041 692042] {CVE-2011-1020}
  - [net] igb: fix i350 SR-IOV failture (Stefan Assmann) [741877 714313]
  - [dm] do not forward ioctls from logical volumes to the underlying device (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - [fs] nfs: Fix an O_DIRECT Oops (Jeff Layton) [755457 754620] {CVE-2011-4325}
  - [net] sctp: Fix another race during accept/peeloff (Thomas Graf) [757146 714870] {CVE-2011-4348}
  - [scsi] isci: fix 32-bit operation when CONFIG_HIGHMEM64G=n (Phillip Lougher) [750458 713904]
  - [net] tg3: Only allow phy ioctls while netif_running (Phillip Lougher) [746343 683393]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.17.1.el5]
changelog:
  - Revert:  [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - Revert:  [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - Revert:  [dm] do not forward ioctls from logical volumes to the underlying device (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - Revert:  [scsi] fix 32-on-64 block device ioctls (Paolo Bonzini) [752385 752386] {CVE-2011-4127}


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.18.1.el5]
changelog:
  - [misc] Move exit_robust_list to mm_release, null lists on cleanup (Laszlo Ersek) [771774 750283] {CVE-2012-0028}
  - [block] disable SG_IO ioctls on virtio-blk devices (Paolo Bonzini) [773322 771592]
  - [scsi] fix 32-on-64 block device ioctls (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - [dm] do not forward ioctls from logical volumes to the underlying device (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752385 752386] {CVE-2011-4127}
  - [fs] ext4: fix BUG_ON() in ext4_ext_insert_extent() (Lukas Czerner) [747943 747946] {CVE-2011-3638}
  - [scsi] don't fail scans when host is in recovery (Rob Evers) [772162 657345]
  - [fs] jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen) [783477 783284] {CVE-2011-4086}
  - [net] igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Jiri Pirko) [772868 772869] {CVE-2012-0207}


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.1.1.el5]
changelog:
  - [net] sctp: fix memory reclaim and panic in sctp_sock_rfree (Thomas Graf) [714869 714867]
  - [x86_64] Revert ACPI APIC mode test (Prarit Bhargava) [728163 721361]
  - [net] sctp: reset packet information after packet transmit (Thomas Graf) [727592 725573]
  - [fs] block: initialise bd_super in bdget (Lachlan McIlroy) [726628 707425]
  - [fs] nfs: Remove bogus call to nfs4_drop_state_owner (Jeff Layton) [726625 724923]
  - [net] be2net: clear interrupt bit in be_probe (Ivan Vecera) [723552 713703]
  - [net] be2net: remove certain cmd failure logging (Ivan Vecera) [726619 716821]
  - [wireless] nl80211: check for valid SSID size in scan operation (Stanislaw Gruszka) [718154 718155] {CVE-2011-2517}
  - [fs] xfs: handle NULL mount struct in error reports (Eric Sandeen) [727835 720551]
  - [fs] proc: restrict access to /proc/PID/io (Oleg Nesterov) [716827 716828] {CVE-2011-2495}
  - [fs] lockd: don't use file's credentials on RPCSEC_GSS mounts (Max Matveev) [722855 701574]
  - [fs] xfs: add a missing mutex_unlock to a dio error path (Jeff Moyer) [727590 718232]
  - [net] sunrpc: Don't hang forever on NLM unlock requests (Jeff Layton) [709546 709547] {CVE-2011-2491}
  - [xen] x86_emulate: Fix SAHF emulation (Igor Mammedov) [718883 718884]
  - [xen] Fix x86_emulate handling of imul with immediate operands (Igor Mammedov) [712885 700565]
  - [fs] Fix wrongly vfree'ing a kmalloc'ed area (Larry Woodman) [721300 719495]
  - [fs] dlm: bump default hash table and maximum allocatable sizes (Bryn M. Reeves) [719930 715603]
  - [net] tipc: Overhaul of socket locking logic (Max Matveev) [719746 704192]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.5.1.el5]
changelog:
  - [fs] proc: fix compile warning in pdeaux addition (Jarod Wilson) [732775 675781]
  - [fs] proc: Fix procfs race vs rmmod or hot-remove (David Howells) [732775 675781]
  - [net] Compute protocol seq numbers and fragment IDs using MD5 (Jiri Pirko) [732662 732663] {CVE-2011-3188}
  - [crypto] Move md5_transform to lib/md5.c (Jiri Pirko) [732662 732663] {CVE-2011-3188}
  - [fs] nfs: Fix client not honoring nosharecache mount option (David Jeffery) [734772 730097]
  - [mm] avoid wrapping vm_pgoff in mremap and stack expansion (Jerome Marchand) [716543 716544] {CVE-2011-2496}
  - [mm] Fix incorrect off-by-one centisec dirty values (Larry Woodman) [733665 691087]
  - [net] bnx2x: fix bringup of BCM57710 (Michal Schmidt) [737475 680411]
  - [virt] xen/netfront: no disable s/g when renegotiating features (Paolo Bonzini) [738392 733416]
  - [fs] aio: fix aio+dio completion path regression w/3rd-party bits (Jeff Moyer) [734157 727504]
  - [virt] xen: Allow arbitrary mtu size until frontend connected (Paolo Bonzini) [738389 697021]
  - [misc] hypervisor: fix race in interrupt hook code (Prarit Bhargava) [730689 692966]
  - [net] cnic, bnx2: Check iSCSI support early in bnx2_init_one (Neil Horman) [734761 710272]
  - [net] igb: fix WOL on 2nd port on i350 (Stefan Assmann) [730682 718988]
  - [misc] irq: fix interrupt handling for kdump under high load (Stefan Assmann) [728521 720212]


author: Don Howard <dhoward@redhat.com> [2.6.18-274.6.1.el5]
changelog:
  - [net] bridge: fix use after free in __br_deliver (Amerigo Wang) [730949 703045] {CVE-2011-2942}
  - [misc] remove	div_long_long_rem (Prarit Bhargava) [732879 732614] {CVE-2011-3209}
  - [net] be2net: fix crash receiving non-member VLAN packets (Ivan Vecera) [736430 730239] {CVE-2011-3347}
  - [net] be2net: Use NTWK_RX_FILTER command for promiscous mode (Ivan Vecera) [736430 730239] {CVE-2011-3347}
  - [net] be2net: non-member vlan pkts not received in promisc mode (Ivan Vecera) [736430 730239] {CVE-2011-3347}
  - [net] be2net: remove bogus unlikely on vlan check (Ivan Vecera) [736430 730239] {CVE-2011-3347}
  - [x86] nmi: make NMI_NONE default watchdog in x86_64 hvm guests (Laszlo Ersek) [739823 707966]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-274.7.1.el5]
changelog:
  - Revert: [xen] passthrough: block VT-d MSI trap injection (Paolo Bonzini) [716301 716302] {CVE-2011-1898}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.9.1.el5]
changelog:
  - [fs] jbd: clear b_modified before moving the jh to a different transaction (Josef Bacik) [827205 563247]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.10.1.el5]
changelog:
  - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970] {CVE-2012-2934}
  - [scsi] qla2xxx: Use ha->pdev->revision in 4Gbps MSI-X check. (Chad Dupuis) [816373 800653]
  - [fs] sunrpc: do array overrun check in svc_recv before page alloc (J. Bruce Fields) [820358 814626]
  - [fs] knfsd: fix an NFSD bug with full size non-page-aligned reads (J. Bruce Fields) [820358 814626]
  - [fs] sunrpc: fix oops due to overrunning server's page array (J. Bruce Fields) [820358 814626]
  - [fs] epoll: clear the tfile_check_list on -ELOOP (Jason Baron) [829670 817131]
  - [x86_64] sched: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [824654 818787]
  - [net] sunrpc: Don't use list_for_each_entry_safe in rpc_wake_up (Steve Dickson) [817571 809937]
  - [s390] qeth: add missing wake_up call (Hendrik Brueckner) [829059 790900]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.11.1.el5]
changelog:
  - [net] ixgbe: remove flow director stats (Andy Gospodarek) [832169 830226]
  - [net] ixgbe: fix default return value for ixgbe_cache_ring_fdir (Andy Gospodarek) [832169 830226]
  - [net] ixgbe: reverting setup redirection table for multiple packet buffers (Andy Gospodarek) [832169 830226]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.13.1.el5]
changelog:
  - [net] e1000e: Cleanup logic in e1000_check_for_serdes_link_82571 (Dean Nelson) [841370 771366]
  - [net] e1000e: Correct link check logic for 82571 serdes (Dean Nelson) [841370 771366]
  - [mm] NULL pointer dereference in __vm_enough_memory (Jerome Marchand) [840077 836244]
  - [fs] dlm: fix slow rsb search in dir recovery (David Teigland) [838140 753244]
  - [fs] autofs: propogate LOOKUP_DIRECTORY flag only for last comp (Ian Kent) [830264 814418]
  - [fs] ext4: properly dirty split extent nodes (Eric Sandeen) [840946 839770]
  - [scsi] don't offline devices with a reservation conflict (David Jeffery) [839196 835660]
  - [fs] ext4: Fix overflow caused by missing cast in ext4_fallocate (Lukas Czerner) [837226 830351]
  - [net] dl2k: Clean up rio_ioctl (Weiping Pan) [818822 818823] {CVE-2012-2313}
  - [x86] sched: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [835450 834562]
  - [net] tg3: Fix TSO handling (John Feeney) [833182 795672]
  - [input] evdev: use after free from open/disconnect race (David Jeffery) [832448 822166]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.15.1.el5]
changelog:
  - [net] sfc: Fix max no of TSO segments and min TX queue size (Michal Schmidt) [845554 845555] {CVE-2012-3412}
  - [kernel] xacct_add_tsk: fix pure theoretical ->mm use-after-free (Nikola Pajkovsky) [849723 849725] {CVE-2012-3510}
  - [fs] hfsplus: Buffer overflow in the HFS plus filesystem (Jacob Tanenbaum) [820255 820256] {CVE-2012-2319}
  - [net] netfilter: add dscp netfilter match (Thomas Graf) [847327 842029]
  - [net] rds: set correct msg_namelen (Weiping Pan) [822727 822728] {CVE-2012-3430}
  - [misc] ERESTARTNOINTR seen from fork call in userspace (Oleg Nesterov) [847359 693822]
  - [fs] quota: manage reserved space when quota is not active (Eric Sandeen) [847326 818087]
  - [fs] quota: Fix warning if delayed write before quota is enabled (Eric Sandeen) [847326 818087]
  - [fs] ext3: pass custom EOF to generic_file_llseek_size() (Eric Sandeen) [847943 784191]
  - [fs] ext4: use core vfs llseek code for dir seeks (Eric Sandeen) [847943 784191]
  - [fs] vfs: allow custom EOF in generic_file_llseek code (Eric Sandeen) [847943 784191]
  - [fs] ext4: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - [fs] ext4: improve llseek error handling for large seek offsets (Eric Sandeen) [847943 784191]
  - [fs] ext3: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - [s390/ppc64] add is_compat_task() for s390 and ppc64 (Eric Sandeen) [847943 784191]
  - [fs] vfs: add generic_file_llseek_size (Eric Sandeen) [847943 784191]
  - [fs] nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes) (Eric Sandeen) [847943 784191]
  - [fs] nfsd: rename 'int access' to 'int may_flags' in nfsd_open() (Eric Sandeen) [847943 784191]
  - [fs] add new FMODE flags: FMODE_32bithash and FMODE_64bithash (Eric Sandeen) [847943 784191]
  - [fs] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() (Eric Sandeen) [847943 784191]
  - [xen] x86: whitelist Enhanced SpeedStep for dom0 (Laszlo Ersek) [846125 809103]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.16.1.el5]
changelog:
  - Revert: [fs] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() (Eric Sandeen) [847943 784191]
  - Revert: [fs] add new FMODE flags: FMODE_32bithash and FMODE_64bithash (Eric Sandeen) [847943 784191]
  - Revert: [fs] nfsd: rename 'int access' to 'int may_flags' in nfsd_open() (Eric Sandeen) [847943 784191]
  - Revert: [fs] nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes) (Eric Sandeen) [847943 784191]
  - Revert: [fs] vfs: add generic_file_llseek_size (Eric Sandeen) [847943 784191]
  - Revert: [s390/ppc64] add is_compat_task() for s390 and ppc64 (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext3: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext4: improve llseek error handling for large seek offsets (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext4: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - Revert: [fs] vfs: allow custom EOF in generic_file_llseek code (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext4: use core vfs llseek code for dir seeks (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext3: pass custom EOF to generic_file_llseek_size() (Eric Sandeen) [847943 784191]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.19.1.el5]
changelog:
  - [net] be2net: Remove code that stops further access to BE NIC based on UE bits (Alexander Gordeev) [867896 862811]
  - [net] netpoll: fix an incorrect check for NULL pointer (Alexander Gordeev) [856079 848098]
  - [net] mlx4: Add support for EEH error recovery (Alexander Gordeev) [847404 798048]
  - [fs] ext4: fix undefined bit shift result in ext4_fill_flex_info (Eric Sandeen) [809688 809689] {CVE-2012-2100}
  - [fs] ext4: fix undefined behavior in ext4_fill_flex_info (Eric Sandeen) [809688 809689] {CVE-2012-2100}
  - [fs] fix crash if block {device|size} read & changed at sametime (Mikulas Patocka) [864823 756506]
  - [x86] mm: randomize SHLIB_BASE (Dave Anderson) [804953 804954] {CVE-2012-1568}
  - [net] ipv6: Fix fib6_dump_table walker leak (Jiri Benc) [861387 819830]
  - [fs] cifs: update cifs_dfs_d_automount caller path (Sachin Prabhu) [858774 857448]
  - [xen] x86: change the default behaviour of CVE-2012-2934 fix (Petr Matousek) [859946 858724]
  - [net] ipvs: allow transmit of GRO aggregated skbs (Jesper Brouer) [857966 854067]
  - [scsi] isci: fixup linkspeed definitions (David Milburn) [854986 833000]
  - [fs] nfs: nfs_d_automount update caller path after do_add_mount (Carlos Maiolino) [857552 834379]
  - [fs] vfs: Fix vfsmount overput on simultaneous automount (Carlos Maiolino) [857552 834379]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.23.1.el5]
changelog:
  - [net] bnx2x: Add remote-fault link detection (Alexander Gordeev) [870120 796905]
  - [net] bnx2x: Cosmetic changes (Alexander Gordeev) [870120 796905]
  - [net] rds-ping cause kernel panic (Alexander Gordeev) [822755 822756] {CVE-2012-2372}
  - [xen] add guest address range checks to XENMEM_exchange handlers (Igor Mammedov) [878033 878034] {CVE-2012-5513}
  - [xen] x86/physmap: Prevent incorrect updates of m2p mappings (Igor Mammedov) [870148 870149] {CVE-2012-4537}
  - [xen] VCPU/timer: Dos vulnerability prev overflow in calculations (Igor Mammedov) [870150 870151] {CVE-2012-4535}
  - [scsi] sg: fix races during device removal (Ewan Milne) [868950 861004]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.3.1.el5]
changelog:
  - [net] be2net: cancel be_worker during EEH recovery (Ivan Vecera) [805462 773735]
  - [net] be2net: add vlan/rx-mode/flow-control config to be_setup (Ivan Vecera) [805462 773735]
  - [x86] disable TSC synchronization when using kvmclock (Marcelo Tosatti) [805460 799170]
  - [fs] vfs: fix LOOKUP_DIRECTORY not propagated to managed_dentry (Ian Kent) [801726 798809]
  - [fs] vfs: fix d_instantiate_unique (Ian Kent) [801726 798809]
  - [fs] nfs: allow high priority COMMITs to bypass inode commit lock (Jeff Layton) [799941 773777]
  - [fs] nfs: don't skip COMMITs if system under is mem pressure (Jeff Layton) [799941 773777]
  - [scsi] qla2xxx: Read the HCCR register to flush any PCIe writes (Chad Dupuis) [798748 772192]
  - [scsi] qla2xxx: Complete mbox cmd timeout before next reset cycle (Chad Dupuis) [798748 772192]
  - [s390] qdio: wrong buffers-used counter for ERROR buffers (Hendrik Brueckner) [801724 790840]
  - [net] bridge: Reset IPCB when entering IP stack (Herbert Xu) [804721 749813]
  - [fs] procfs: add hidepid= and gid= mount options (Jerome Marchand) [770649 770650]
  - [fs] procfs: parse mount options (Jerome Marchand) [770649 770650]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.6.1.el5]
changelog:
  - [scsi] fc class: fix scanning when devs are offline (Mike Christie) [816684 799530]
  - [md] dm-multipath: delay retry of bypassed pg (Mike Christie) [816684 799530]
  - [net] bonding: properly unset current_arp_slave on slave link up (Veaceslav Falico) [811927 800575]
  - [net] bonding: remove {master,vlan}_ip and query devices instead (Andy Gospodarek) [810321 772216]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.8.1.el5]
changelog:
  - [net] sock: validate data_len before allocating skb in sock_alloc_send_pskb() (Jason Wang) [816290 816106] {CVE-2012-2136}
  - [net] tg3: Fix VLAN tagging assignments (John Feeney) [817691 797011]
  - [net] ixgbe: do not stop stripping VLAN tags in promiscuous mode (Andy Gospodarek) [809791 804800]
  - [s390] zcrypt: Fix parameter checking for ZSECSENDCPRB ioctl (Hendrik Brueckner) [810123 808489]
  - [x86] unwind information fix for the vsyscall DSO (Prarit Bhargava) [807930 805799]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.8.2.el5]
changelog:
  - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-347.el5]
changelog:
  - [xen] add guest address range checks to XENMEM_exchange handlers (Igor Mammedov) [878034] {CVE-2012-5513}
  - [xen] x86/physmap: Prevent incorrect updates of m2p mappings (Igor Mammedov) [870149] {CVE-2012-4537}
  - [xen] VCPU/timer: Dos vulnerability prev overflow in calculations (Igor Mammedov) [870151] {CVE-2012-4535}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.1.1.el5]
changelog:
  - [pci] intel-iommu: reduce max num of domains supported (Don Dutile) [886876 885125]
  - [fs] gfs2: Fix leak of cached directory hash table (Steven Whitehouse) [886124 831330]
  - [x86] mm: randomize SHLIB_BASE (Petr Matousek) [804953 804954] {CVE-2012-1568}
  - [net] be2net: create RSS rings even in multi-channel configs (Ivan Vecera) [884702 878209]
  - [net] tg3: Avoid dma read error (John Feeney) [885692 877474]
  - [misc] Fix unsupported hardware message (Prarit Bhargava) [885063 876587]
  - [net] ipv6: discard overlapping fragment (Jiri Pirko) [874837 874838] {CVE-2012-4444}
  - [usb] Fix serial port reference counting on hotplug remove (Don Zickus) [885700 845447]
  - [net] bridge: export its presence and fix bonding igmp reporting (Veaceslav Falico) [884742 843473]
  - [fs] nfs: move wait for server->active from put_super to kill_sb (Jeff Layton) [884708 839839]
  - [scsi] libfc: fix indefinite rport restart (Neil Horman) [884740 595184]
  - [scsi] libfc: Retry a rejected PRLI request (Neil Horman) [884740 595184]
  - [scsi] libfc: Fix remote port restart problem (Neil Horman) [884740 595184]
  - [xen] memop: limit guest specified extent order (Laszlo Ersek) [878449 878450] {CVE-2012-5515}
  - [xen] get bottom of EBDA from the multiboot data structure (Paolo Bonzini) [885062 881885]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.10.1.el5]
changelog:
  - [net] Bluetooth: fix possible info leak in bt_sock_recvmsg() (Radomir Vrbovsky) [955600 955601] {CVE-2013-3224}
  - [net] Bluetooth: HCI & L2CAP information leaks (Jacob Tanenbaum) [922415 922416] {CVE-2012-6544}
  - [misc] signal: use __ARCH_HAS_SA_RESTORER instead of SA_RESTORER (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [misc] signal: always clear sa_restorer on execve (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [misc] signal: Def __ARCH_HAS_SA_RESTORER for sa_restorer clear (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [net] cxgb4: zero out another firmware request struct (Jay Fenlason) [971872 872531]
  - [net] cxgb4: clear out most firmware request structures (Jay Fenlason) [971872 872531]
  - [kernel] Make futex_wait() use an hrtimer for timeout (Prarit Bhargava) [958021 864648]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.11.1.el5]
changelog:
  - Revert: [kernel] kmod: make request_module() killable (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] kmod: avoid deadlock from recursive kmod call (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] wait_for_helper: remove unneeded do_sigaction() (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] Fix ____call_usermodehelper errs being silently ignored (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] wait_for_helper: SIGCHLD from u/s cause use-after-free (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] kmod: avoid deadlock from recursive request_module call (Frantisek Hrbata) [957152 949568]
  - Revert: [x86-64] non lazy sleazy fpu implementation (Prarit Bhargava) [948187 731531]
  - Revert: [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - Revert: [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - Revert: [ia64] fix KABI breakage on ia64 (Prarit Bhargava) [966878 960783]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.12.1.el5]
changelog:
  - Revert: [fs] afs: export a couple of core functions for AFS write support (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: drop ec_type from the ext4_ext_cache structure (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: handle NULL p_ext in ext4_ext_next_allocated_block() (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: make FIEMAP and delayed allocation play well together (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: Fix possibly very long loop in fiemap (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: prevent race while walking extent tree for fiemap (Lukas Czerner) [960014 692071]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.14.1.el5]
changelog:
  - [net] Fix panic for vlan over gre via tun (Thomas Graf) [983452 981337]
  - [x86] mm: introduce proper mem barriers smp_invalidate_interrupt (Rafael Aquini) [983628 865095]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.15.1.el5]
changelog:
  - [fs] nfs: flush cached dir information slightly more readily (Scott Mayhew) [976441 853145]
  - [fs] nfs: Fix resolution prob with cache_change_attribute (Scott Mayhew) [976441 853145]
  - [fs] nfs: define function to update nfsi->cache_change_attribute (Scott Mayhew) [976441 853145]
  - [net] af_key: fix info leaks in notify messages (Jiri Benc) [980999 981000] {CVE-2013-2234}
  - [net] af_key: initialize satype in key_notify_policy_flush() (Jiri Benc) [981222 981224] {CVE-2013-2237}
  - [net] ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Jiri Pirko) [981556 981557] {CVE-2013-2232}
  - [net] fix invalid free in ip_cmsg_send() callers (Petr Matousek) [980141 980142] {CVE-2013-2224}
  - [x86_64] Early segment setup for VT (Paolo Bonzini) [979920 978305]
  - [block] cpqarray: info leak in ida_locked_ioctl() (Tomas Henzl) [971245 971246] {CVE-2013-2147}
  - [block] cdrom: use kzalloc() for failing hardware (Frantisek Hrbata) [973103 973104] {CVE-2013-2164}
  - [mm] Break out when there is nothing more to write for the fs. (Larry Woodman) [972583 965359]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.16.1.el5]
changelog:
  - [x86_64] Fix kdump failure due to 'x86_64: Early segment setup' (Paolo Bonzini) [988251 987244]
  - [xen] skip tracing if it was disabled instead of dying (Igor Mammedov) [987976 967053]
  - [ia64] fix KABI breakage on ia64 (Prarit Bhargava) [966878 960783]
  - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.17.1.el5]
changelog:
  - [net] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [999819 995961]
  - [net] be2net: Mark checksum fail for IP fragmented packets (Ivan Vecera) [983864 956322]
  - [net] be2net: Avoid double insertion of vlan tags (Ivan Vecera) [983864 956322]
  - [net] be2net: disable TX in be_close() (Ivan Vecera) [983864 956322]
  - [net] be2net: fix EQ from getting full while cleaning RX CQ (Ivan Vecera) [983864 956322]
  - [net] be2net: avoid napi_disable() when not enabled (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix receive Multicast Packets w/ Promiscuous mode (Ivan Vecera) [983864 956322]
  - [net] be2net: Fixed memory leak (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix PVID tag offload for packets w/ inline VLAN tag (Ivan Vecera) [983864 956322]
  - [net] be2net: fix a Tx stall bug caused by a specific ipv6 packet (Ivan Vecera) [983864 956322]
  - [net] be2net: Remove an incorrect pvid check in Tx (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix issues in error recovery with wrong queue state (Ivan Vecera) [983864 956322]
  - [net] netpoll: revert 6bdb7fe3104 and fix be_poll() instead (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix to parse RSS hash Receive completions correctly (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix cleanup path when EQ creation fails (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix Endian (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix to trim skb for padded vlan packets (Ivan Vecera) [983864 956322]
  - [net] be2net: Explicitly clear reserved field in Tx Descriptor (Ivan Vecera) [983864 956322]
  - [net] be2net: remove unnecessary usage of unlikely() (Ivan Vecera) [983864 956322]
  - [net] be2net: do not modify PCI MaxReadReq size (Ivan Vecera) [983864 956322]
  - [net] be2net: cleanup be_vid_config() (Ivan Vecera) [983864 956322]
  - [net] be2net: don't call vid_config() when there no vlan config (Ivan Vecera) [983864 956322]
  - [net] be2net: Ignore status of some ioctls during driver load (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix wrong status getting returned for MCC commands (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix VLAN/multicast packet reception (Ivan Vecera) [983864 956322]
  - [net] be2net: fix wrong frag_idx reported by RX CQ (Ivan Vecera) [983864 956322]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.18.1.el5]
changelog:
  - [net] be2net: enable polling prior enabling interrupts globally (Ivan Vecera) [1005239 987539]
  - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970874 970875] {CVE-2013-2141}
  - [net] ipv6: do udp_push_pending_frames AF_INET sock pending data (Jiri Benc) [987647 987648] {CVE-2013-4162}
  - [mm] use-after-free in madvise_remove() (Jacob Tanenbaum) [849735 849736] {CVE-2012-3511}
  - [fs] autofs: remove autofs dentry mount check (Ian Kent) [1001488 928098]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.2.1.el5]
changelog:
  - [misc] tainted flags, fix buffer size (Prarit Bhargava) [905829 901547]
  - [net] be2net: fix unconditionally returning IRQ_HANDLED in INTx (Ivan Vecera) [884704 878316]
  - [net] be2net: fix INTx ISR for interrupt behaviour on BE2 (Ivan Vecera) [884704 878316]
  - [net] be2net: fix a possible events_get() race on BE2 (Ivan Vecera) [884704 878316]
  - [firmware] Expand kernel boot-time storage for DMI table structs (Lenny Szubowicz) [902683 862865]
  - [fs] udf: Fortify loading of sparing table (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}
  - [fs] udf: Improve table length check to avoid possible overflow (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}
  - [fs] udf: Avoid run away loop when partition table is corrupted (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.3.1.el5]
changelog:
  - [utrace] ensure arch_ptrace() can never race with SIGKILL (Oleg Nesterov) [912071 912072] {CVE-2013-0871}
  - [x86] msr: Add capabilities check (Nikola Pajkovsky) [908696 908697] {CVE-2013-0268}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.4.1.el5]
changelog:
  - [virt] xen-netback: backports (Andrew Jones) [910884 910885] {CVE-2013-0216}
  - [virt] xen-netback: netif_schedulable should take a netif (Andrew Jones) [910884 910885] {CVE-2013-0216}
  - [virt] pciback: rate limit error mess from pciback_enable_msi() (Igor Mammedov) [910876 910877] {CVE-2013-0231}
  - [net] be2net: remove BUG_ON() in be_mcc_compl_is_new() (Ivan Vecera) [923910 907524]
  - [net] ipv4: Update MTU to all related cache entries (Amerigo Wang) [923353 905190]
  - [net] annotate rt_hash_code() users (Amerigo Wang) [923353 905190]
  - [net] xfrm_user: fix info leak in copy_to_user_state() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_policy() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_tmpl() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] atm: fix info leak in getsockopt(SO_ATMPVC) (Thomas Graf) [922384 922385] {CVE-2012-6546}
  - [net] atm: fix info leak via getsockname() (Thomas Graf) [922384 922385] {CVE-2012-6546}
  - [net] tun: fix ioctl() based info leaks (Thomas Graf) [922348 922349] {CVE-2012-6547}
  - [net] llc, zero sockaddr_llc struct (Thomas Graf) [922327 922329] {CVE-2012-6542}
  - [net] llc: fix info leak via getsockname() (Thomas Graf) [922327 922329] {CVE-2012-6542}
  - [net] xfrm_user: return error pointer instead of NULL (Thomas Graf) [919386 919387] {CVE-2013-1826}
  - [net] ixgbevf: allocate room for mailbox MSI-X interrupt's name (Laszlo Ersek) [924134 862862]
  - [fs] knfsd: allow nfsd READDIR to return 64bit cookies (Niels de Vos) [924087 918952]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.6.1.el5]
changelog:
  - [char] ipmi: use a tasklet for handling received messages (Tony Camuso) [953435 947732]
  - [char] ipmi: do run_to_completion properly in deliver_recv_msg (Tony Camuso) [953435 947732]
  - [fs] nfs4: fix locking around cl_state_owners list (Dave Wysochanski) [954296 948317]
  - [fs] nfs: Fix bugs on short read (Sachin Prabhu) [952098 924011]
  - [xen] AMD IOMMU: spot missing IO-APIC entries in IVRS table (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: Make per-device interrupt remap table default (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: Disable IOMMU if SATA Combined mode is on (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: On creating entry clean up in remapping tables (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] ACPI: acpi_table_parse() should return handler's err code (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] introduce xzalloc() & Co (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.1.1.el5]
changelog:
  - [crypto] ansi_cprng fix off by one err in non-block size request (Neil Horman) [1007692 1007693] {CVE-2013-4345}
  - [fs] gfs2: yield() in shrinker to allow glock_workqueues to run (Abhijith Das) [1014714 928518]
  - [net] ipv6: ipv6_create_tempaddr cleanup (Petr Holasek) [999361 999362] {CVE-2013-0343}
  - [net] ipv6: remove max_addresses check from ipv6_create_tempaddr (Petr Holasek) [999361 999362] {CVE-2013-0343}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.1.2.el5]
changelog:
  - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368}
  - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.9.1.el5]
changelog:
  - [nfs] sunrpc: don't use a credential with extra groups (Mateusz Guzik) [1095062 976201]
  - [scsi] lpfc: Remove NDLP reference put in lpfc_cmpl_els_logo_acc (Rob Evers) [1096061 1075228]
  - [infiniband] rds: dereference of a NULL device (Jacob Tanenbaum) [1079216 1079217] {CVE-2013-7339}
  - [kernel] futex: check relative timeouts for overflow (Denys Vlasenko) [1091832 1084168]
  - [virt] kvm: correctly detect KVM when hv emulation is enalbed (Jason Wang) [1094152 985767]
  - [security] Fix spurious warnings in security_ops_task_setrlimit (Mateusz Guzik) [1092869 916235]
  - [block] floppy: don't write kernel-only members to FDRAWCMD output (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737}
  - [block] floppy: ignore kernel-only members in FDRAWCMD input (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.11.1.el5]
changelog:
  - [fs] dcache: fix cleanup on warning in d_splice_alias (Denys Vlasenko) [1109720 1080606]
  - [net] neigh: Make neigh_add_timer symmetrical to neigh_del_timer (Marcelo Ricardo Leitner) [1111195 1109888]
  - [net] neigh: set NUD_INCOMPLETE when probing router reachability (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: router reachability probing (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: probe routes asynchronous in rt6_probe (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ndisc: Update neigh->updated with write lock (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: remove the unnecessary statement in find_match() (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: fix route selection if CONFIG_IPV6_ROUTER_PREF unset (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: Fix def route failover when CONFIG_IPV6_ROUTER_PREF=n (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: Prefer reachable nexthop only if the caller requests (Marcelo Ricardo Leitner) [1106354 1090806]
  - [fs] ext4/jbd2: don't wait forever stale tid caused by wraparound (Eric Sandeen) [1097528 980268]
  - [fs] ext4: Initialize fsync transaction ids in ext4_new_inode() (Eric Sandeen) [1097528 980268]
  - [fs] jbd2: don't wake kjournald unnecessarily (Eric Sandeen) [1097528 980268]
  - [fs] jbd2: fix fsync() tid wraparound bug (Eric Sandeen) [1097528 980268]
  - [infiniband] rds: do not deref NULL dev in rds_iw_laddr_check() (Jacob Tanenbaum) [1093311 1093312] {CVE-2014-2678}
  - [fs] nfs4: Add recovery for individual stateids - partial backport. (Dave Wysochanski) [1113468 867570]
  - [fs] nfs4: Don't start state recovery in nfs4_close_done - clean backport. (Dave Wysochanski) [1113468 867570]
  - [xen] page-alloc: scrub anonymous domain heap pages upon freeing (Vitaly Kuznetsov) [1103648 1103649] {CVE-2014-4021}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.12.1.el5]
changelog:
  - [audit] auditsc: audit_krule mask accesses need bounds checking (Denys Vlasenko) [1102702 1102703] {CVE-2014-3917}
  - [mm] writeback: Fix hang when low on memory due to NFS traffic (Larry Woodman) [1125246 1080194]
  - [net] tg3: Fix Read DMA workaround for 5719 A0 (Ivan Vecera) [1121017 924590]
  - [fs] jbd: don't wake kjournald unnecessarily (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd: don't wait (forever) for stale tid caused by wraparound (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4: fix waiting and sending of barrier in ext4_sync_file() (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd2: Add function jbd2_trans_will_send_data_barrier() (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd2: fix sending of data flush on journal commit (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4, jbd2: Add barriers for file systems with ext journals (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd: fix fsync() tid wraparound bug (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4: fix fdatasync() for files with only i_size changes (Eric Sandeen) [1117665 1102768]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.2.1.el5]
changelog:
  - [scsi] mpt2sas: bump version (Tomas Henzl) [1018458 956330]
  - [scsi] mpt2sas: fix the incorrect scsi_dma_map error checking (Tomas Henzl) [1018458 956330]
  - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368}
  - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.3.1.el5]
changelog:
  - [net] be2net: don't use GRO for packets w/ re-inserted VLAN tags (Ivan Vecera) [1023348 1008691]
  - [net] tg3: call pci_enable_wake() to set power state (John Feeney) [1014973 996331]
  - [misc] backport fixes for percpu-rw-semaphore (Mikulas Patocka) [1014715 867997]
  - [xen] information leak via I/O instruction emulation (Igor Mammedov) [1009602 1009603] {CVE-2013-4355}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.4.1.el5]
changelog:
  - [char] ipmi: fix message handling during panics (Tony Camuso) [1049731 995293]
  - [net] igb: Use 32bit mask calculating the flow control watermarks (Stefan Assmann) [1041694 1036115]
  - [fs] NTLM auth and sign - Use appropriate server challenge (Sachin Prabhu) [1029865 1018286]
  - [xen] gnttab: correct locking order reversal (Radim Krcmar) [1026245 1026246] {CVE-2013-4494}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.6.1.el5]
changelog:
  - [net] be2net: don't use skb_get_queue_mapping() (Ivan Vecera) [1066302 1063955]
  - [ipc] change refcount to atomic_t (Phillip Lougher) [1024866 1024868] {CVE-2013-4483}
  - [s390] qeth: buffer overflow in snmp ioctl (Jacob Tanenbaum) [1034402 1034404] {CVE-2013-6381}
  - [scsi] AACRAID Driver compat IOCTL missing capability check (Jacob Tanenbaum) [1033531 1033532] {CVE-2013-6383}
  - [xen] x86/AMD: work around erratum 793 (Radim Krcmar) [1035834 1035836] {CVE-2013-6885}
  - [xen] do not expose hypercalls to rings 1 and 2 of HVM guests (Andrew Jones) [1029112 1029113] {CVE-2013-4554}
  - [redhat] kabi: Adding symbol print_hex_dump (Jiri Olsa) [1054055 662558]
  - [scsi] Add 'eh_deadline' to limit SCSI EH runtime (Ewan Milne) [1050097 956132]
  - [scsi] remove check for 'resetting' (Ewan Milne) [1050097 956132]
  - [scsi] dc395: Move 'last_reset' into internal host structure (Ewan Milne) [1050097 956132]
  - [scsi] tmscsim: Move 'last_reset' into host structure (Ewan Milne) [1050097 956132]
  - [scsi] advansys: Remove 'last_reset' references (Ewan Milne) [1050097 956132]
  - [scsi] dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset (Ewan Milne) [1050097 956132]
  - [scsi] dpt_i2o: Remove DPTI_STATE_IOCTL (Ewan Milne) [1050097 956132]
  - [net] ipv6: fix leaking uninit port number of offender sockaddr (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] fix addr_len/msg->msg_namelen assign in recv_error funcs (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] prevent leakage of uninitialized memory to user in recv (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] be2net: prevent Tx stall on SH-R when packet size < 32 (Ivan Vecera) [1051535 1007995]
  - [net] be2net: Trim padded packets for Lancer (Ivan Vecera) [1051535 1007995]
  - [net] be2net: Pad skb to meet min Tx pkt size in lancer (Ivan Vecera) [1051535 1007995]
  - [net] be2net: refactor HW workarounds in be_xmit() (Ivan Vecera) [1051535 1007995]
  - [fs] exec/ptrace: fix get_dumpable() incorrect tests (Petr Oros) [1039483 1039484] {CVE-2013-2929}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.7.1.el5]
changelog:
  - [s390x] af_iucv: Kernel panic during connect (IUCV transport) (Hendrik Brueckner) [1077045 1026388]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.8.1.el5]
changelog:
  - [virt] HID: memory corruption flaw drivers/usb/input/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888}
  - [virt] HID: memory corruption flaw in drivers/hv/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888}
  - [scsi] lpfc: Fix task management commands having a fixed timeout (Ewan Milne) [1073123 1061120]
  - [net] tcp: drop SYN+FIN messages (Jiri Pirko) [1066057 1066058] {CVE-2012-6638}
  - [fs] GFS2: Check if glock held in gfs2_readpage (Robert S Peterson) [1073953 1063434]
  - [net] sunrpc: fix deadlock in task wakeup code (Jeff Layton) [1073731 998126]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-369.el5]
changelog:
  - [fs] nlm: Ensure we resend pending blocking locks after a reclaim (Steve Dickson) [918592]
  - [kernel] kmod: kthread_run causes oom killer deadlock (Frantisek Hrbata) [983506]
  - [fs] nfs4: ratelimit some messages, add name to bad seq-id mess (Dave Wysochanski) [953121]
  - [fs] nfsd: fix EXDEV checking in rename (J. Bruce Fields) [515599]
  - [misc] tty: Fix abusers of current-sighand->tty (Aaron Tomlin) [858981]
  - [net] ipv6: don't call addrconf_dst_alloc again when enable lo (Jiri Benc) [981417]
  - [redhat] kabi: Adding symbol fc_fabric_login (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_recv (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_reset (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_recv (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_destroy (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_els_send (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_destroy (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_fabric_logoff (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_set_mfs (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_elsct_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_link_up (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_recv_flogi (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_change_queue_depth (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_link_down (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_change_queue_type (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_free (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_alloc (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_config (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_disc_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol strict_strtoul (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_rport_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_get_host_port_state (Jiri Olsa) [864256]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-370.el5]
changelog:
  - [net] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [995961]
  - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970875] {CVE-2013-2141}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-400.el5]
changelog:
  - [net] bridge: disable snooping if there is no querier (Frantisek Hrbata) [902454]
  - [s390] kernel: sysinfo: convert /proc/sysinfo to seqfile (Alexander Gordeev) [1131283]
  - [net] netlink: verify permisions of socket creator (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: store effective caps at socket() time (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Rename netlink_capable netlink_allowed (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Fix permission check in netlink_connect() (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix possible spoofing from non-root processes (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Make NETLINK_USERSOCK work again (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix for too early rmmod (Jiri Benc) [1094266] {CVE-2014-0181}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-402.el5]
changelog:
  - [block] virtio: Reset device after blk_cleanup_queue() (Stefan Hajnoczi) [1006536]
  - [block] virtio: Call del_gendisk() before disable guest kick (Stefan Hajnoczi) [1006536]
  - [block] virtio: Drop unused request tracking list (Stefan Hajnoczi) [1006536]
  - [fs] cifs: setfacl removes part of ACL when setting POSIX ACLs (Sachin Prabhu) [1105625]
  - [fs] splice: perform generic write checks (Eric Sandeen) [1155908] {CVE-2014-7822}
  - [fs] ext4: verify block bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: fix type declaration of ext4_validate_block_bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: error out if verifying the block bitmap fails (Lukas Czerner) [1034403]
  - [x86] traps: stop using IST for #SS (Petr Matousek) [1172809] {CVE-2014-9322}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-403.el5]
changelog:
  - [s390] zcrypt: Toleration of new crypto hardware (Hendrik Brueckner) [1182522]
  - [fs] cifs: Use pid from cifsFileInfo in wrt pages/set_file_size (Sachin Prabhu) [1169304]
  - [xen] x86: confine internally handled MMIO to solitary regions (Denys Vlasenko) [1164256] {CVE-2014-8867}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-404.el5]
changelog:
  - [infiniband] core: Prevent integer overflow in ib_umem_get (Doug Ledford) [1179353] {CVE-2014-8159}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-405.el5]
changelog:
  - [net] tcp: zero retrans_stamp if all retrans were acked (Marcelo Leitner) [1205521]
  - [net] tcp: fix retrans_stamp advancing in error cases (Marcelo Leitner) [1205521]
  - [net] tcp: Fix inconsistency source (Marcelo Leitner) [1205521]
  - [ipc] sem: fix the potential use-after-free in freeary() (Oleg Nesterov) [1124574]
  - [scsi] lpfc: Fix crash in device reset handler (Rob Evers) [1070964]
  - [mm] fix broken max_reclaims_in_progress memory reclaim throttle (Lachlan McIlroy) [1164105]
  - [x86_64] fpu: save_i387() must clr TS_USEDFPU along with stts() (Oleg Nesterov) [1193505]
  - [block] virtio: Call revalidate_disk() upon online disk resize (Stefan Hajnoczi) [1200855]
  - [block] virtio: fix config handler race (Stefan Hajnoczi) [1200855]
  - [block] virtio: allow re-reading config space at runtime (Stefan Hajnoczi) [1200855]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-406.el5]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Mateusz Guzik) [1203787] {CVE-2015-1805}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-407.el5]
changelog:
  - [utrace] check ->utrace != NULL in utrace_unsafe_exec() (Oleg Nesterov) [1226967]
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1238991]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-408.el5]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] ipv6/udp: Use correct var to determine non-blocking cond (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] SNMP: Restore Udp6InErrors incrementation (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-409.el5]
changelog:
  - [fs] ext4: limit group search loop for non-extent files (Lukas Czerner) [1301100]
  - [fb] vm: convert fb_mmap to vm_iomap_memory() helper (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [s390] add dummy io_remap_pfn_range() to asm-s390/pgtable.h (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [mm] vm: add vm_iomap_memory() helper function (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [sched] prevent division by zero x->cpu_power (Denys Vlasenko) [1209728]
  - [xen] x86: fully ignore segment override for register-only ops (Mateusz Guzik) [1200373] {CVE-2015-2151}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-415.el5]
changelog:
  - [fs] gfs2: Initialize atime of I_NEW inodes (Andreas Grunbacher) [1374861]
  - [fs] gfs2: Update file times after grabbing glock (Andreas Grunbacher) [1374861]
  - Revert: [fs] gfs2: Only refresh newer in-memory timestamps (Andreas Grunbacher) [1374861]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-417.el5]
changelog:
  - [virt] hv: do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1391167]
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390044] {CVE-2016-7117}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-419.el5]
changelog:
  - [net] dccp: Use AF-independent rebuild_header routine (Hannes Frederic Sowa) [1424751]
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424633] {CVE-2017-6074}
  - [redhat] kernel.spec.template: disable autoloading for dccp proto (Hannes Frederic Sowa) [1425177]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.11.el5]
changelog:
  - [ia64] enable CMCI on hot-plugged processors (Fabio Olive Leite ) [430632]
  - [audit] break execve records into smaller parts (Eric Paris ) [429691]
  - [s390] data corruption on DASD while toggling CHPIDs (Hans-Joachim Picht ) [402911]
  - [xen] ia64: hv hangs on Corrected Platform Errors (Tetsu Yamamoto ) [428290]
  - [xen] ia64: running java-vm causes dom0 to hang (Tetsu Yamamoto ) [424191]


author: Don Howard <dhoward@redhat.com> [2.6.18-53.1.13]
changelog:
  - revert to 2.6.18-53.1.6.el5
  - [x86_64] kernel vmsplice_to_pipe flaw (Alexander Viro ) [432252] {CVE-2008-0600}


author: Don Howard <dhoward@redhat.com> [2.6.18-53.1.13.el5]
changelog:
  - revert to 2.6.18-53.1.6.el5
  - [x86_64] check permissions in vmsplice_to_pipe (Alexander Viro ) [432252] {CVE-2008-0600}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.14.el5]
changelog:
  - merge from 2.6.18-53.1.13 to 2.6.18-53.1.12
  - [nfs] potential file corruption issue when writing (Jeff Layton ) [432078]
  - [ppc] chrp: fix possible strncmp NULL pointer usage (Vitaly Mayatskikh ) [396821]
  - [isdn] i4l: fix memory overruns (Vitaly Mayatskikh ) [425171]
  - [isdn] fix possible isdn_net buffer overflows (Aristeu Rozanski ) [392151] {CVE-2007-6063}
  - [mm] hugepages: leak due to pagetable page sharing (Larry Woodman ) [431522]
  - [net] NULL dereference in iwl driver (Vitaly Mayatskikh ) [401421] {CVE-2007-5938}
  - [misc] Denial of service with wedged processes (Jerome Marchand ) [221403]
  - [xen] ia64: hvm guest memory range checking (Jarod Wilson ) [408701]


author: Don Howard <dhoward@redhat.com> [2.6.18-53.1.17.el5]
changelog:
  - [fs] fix race condition in dnotify (Alexander Viro ) [439758] {CVE-2008-1375}
  - [pci] hotplug: PCI Express problems with bad DLLPs (Kei Tokunaga ) [440438]
  - [nfs] stop sillyrenames and unmounts from racing (Steve Dickson ) [440447]
  - [x86] clear df flag for signal handlers (Jason Baron ) [437316] {CVE-2008-1367}
  - [xen] ia64: ftp stress test fixes between HVM/Dom0 (Tetsu Yamamoto ) [427400] {CVE-2008-1619}
  - [xen] ia64: fix ssm_i emulation barrier and vdso pv (Tetsu Yamamoto ) [427400] {CVE-2008-1619}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.19.el5]
changelog:
  - [xen] check num of segments in block backend driver (Bill Burns ) [378281]
  - [x86_64] update IO-APIC dest field to 8-bit for xAPIC (Dave Anderson ) [442922]
  - Update: [fs] fix race condition in dnotify (Alexander Viro ) [439758] {CVE-2008-1375}
  - Update: [xen] ia64: ftp stress test fixes between HVM/Dom0 (Tetsu Yamamoto ) [427400] {CVE-2008-1619}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.21.el5]
changelog:
  - [misc] infinite loop in highres timers (Michal Schmidt ) [440001]
  - [video] PWC driver DoS (Pete Zaitcev ) [308521]
  - [x86_64] fix unprivileged crash on %cs corruption (Jarod Wilson ) [439787]
  - [net] ESP: ensure IV is in linear part of the skb (Thomas Graf ) [427247]
  - [cpufreq] booting with maxcpus=1 panics (Doug Chapman ) [429516]
  - [net] sunrpc: lockd recovery is broken (Steve Dickson ) [445360]
  - [cpufreq] don't take sem in cpufreq_quick_get (Doug Chapman ) [400821]
  - [cpufreq] remove hotplug cpu cruft (Doug Chapman ) [400821]
  - [cpufreq] governor: use new rwsem locking in work cb (Doug Chapman ) [400821]
  - [cpufreq] ondemand governor restructure the work cb (Doug Chapman ) [400821]
  - [cpufreq] rewrite lock to eliminate hotplug issues (Doug Chapman ) [400821]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.4.el5]
changelog:
  - Revert: [fs] sysfs: fix race condition around sd->s_dentry (Eric Sandeen ) [245777] {CVE-2007-3104}
  - Revert: [fs] sysfs: fix condition check in sysfs_drop_dentry() (Eric Sandeen ) [245777] {CVE-2007-3104}
  - Revert: [fs] sysfs: store inode nrs in s_ino (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [net] tg3: Fix performance regression on 5705 (Andy Gospodarek ) [381021]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.5.el5]
changelog:
  - [ia64] ptrace: access to user register backing (Roland McGrath ) [259801]
  - [fs] cifs: buffer overflow due to corrupt response (Jeff Layton ) [372991]
  - [net] s2io: correct VLAN frame reception (Andy Gospodarek ) [426289]
  - [net] s2io: allow VLAN creation on interfaces (Andy Gospodarek ) [426289]
  - [misc] tux: get rid of O_ATOMICLOOKUP (Michal Schmidt ) [426494]
  - [x86_64] fix race conditions in setup_APIC_timer (Geoff Gustafson ) [424181]
  - [fs] core dump file ownership (Don Howard ) [396991]
  - [nfs] let rpciod finish sillyrename then umount (Steve Dickson ) [414041]
  - [nfs] fix a race in silly rename (Steve Dickson ) [414041]
  - [nfs] clean up the silly rename code (Steve Dickson ) [414041]
  - [nfs] infrastructure changes for silly renames (Steve Dickson ) [414041]
  - [nfs] introduce nfs_removeargs and nfs_removeres (Steve Dickson ) [414041]
  - [ia64] remove stack hard limit (Aron Griffis ) [412091]
  - [fs] sysfs: fix race condition around sd->s_dentry (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [fs] sysfs: fix condition check in sysfs_drop_dentry() (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [fs] sysfs: store inode nrs in s_ino (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [xen] ia64: vulnerability of copy_to_user in PAL emu (Jarod Wilson ) [425938]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.8.el5]
changelog:
  - [net] randomize udp port allocation (Eugene Teo ) [454571 454572]
  - [tty] add NULL pointer checks (Aristeu Rozanski ) [453425 453154] {CVE-2008-2812}
  - [net] sctp: make sure sctp_addr does not overflow (David S. Miller ) [452482 452483] {CVE-2008-2826}
  - [sys] sys_setrlimit: prevent setting RLIMIT_CPU to 0 (Neil Horman ) [437121 437122] {CVE-2008-1294}
  - [net] sit: exploitable remote memory leak (Jiri Pirko ) [446038 446039] {CVE-2008-2136}
  - [misc] ttyS1 lost interrupt, stops transmitting v2 (Brian Maly ) [455256 451157]
  - [misc] ttyS1 loses interrupt and stops transmitting (Simon McGrath ) [443071 440121]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.9.el5]
changelog:
  - [misc] signaling msgrvc() should not pass back error (Jiri Pirko ) [455278 452533]
  - [ia64] properly unregister legacy interrupts (Prarit Bhargava ) [450337 445886]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.11.el5]
changelog:
  - [mm] xpmem: inhibit page swapping under heavy mem use (George Beshers ) [456946 456574]
  - [xen] HV: memory corruption with large number of cpus (Chris Lalancette ) [455768 449945]
  - [fs] missing check before setting mount propagation (Eugene Teo ) [454392 454393]
  - [openib] small ipoib packet can cause an oops (Doug Ledford ) [447913 445731]
  - [misc] fix race in switch_uid and user signal accounting (Vince Worthington ) [456235 441762 440830]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.12.el5]
changelog:
  - [mm] tmpfs: restore missing clear_highpage (Eugene Teo ) [426082 426083]{CVE-2007-6417}
  - [fs] vfs: fix lookup on deleted directory (Eugene Teo ) [457865 457866]{CVE-2008-3275}
  - [net] ixgbe: remove device ID for unsupported device (Andy Gospodarek ) [457484 454910]
  - [ppc] Event Queue overflow on eHCA adapters (Brad Peters ) [458779 446713]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.13.el5]
changelog:
  - [md] fix crashes in iterate_rdev (Doug Ledford ) [460128 455471]
  - [sound] snd_seq_oss_synth_make_info info leak (Eugene Teo ) [458000 458001] {CVE-2008-3272}
  - [ipmi] control BMC device ordering (peterm@redhat.com ) [459071 430157]
  - [ia64] fix to check module_free parameter (Masami Hiramatsu ) [460639 457961]
  -  [misc] NULL pointer dereference in kobject_get_path (Jiri Pirko ) [459776 455460]
  - [xen] ia64: SMP-unsafe with XENMEM_add_to_physmap on HVM (Tetsu Yamamoto ) [459780 457137]
  - [net] bridge: eliminate delay on carrier up (Herbert Xu ) [458783 453526]
  - [fs] dio: lock refcount operations (Jeff Moyer ) [459082 455750]
  - [misc]  serial: fix break handling for i82571 over LAN (Aristeu Rozanski ) [460509 440018]
  - [fs] dio: use kzalloc to zero out struct dio (Jeff Moyer ) [461091 439918]
  - [fs] lockd: nlmsvc_lookup_host called with f_sema held (Jeff Layton ) [459083 453094]
  - [net] bnx2x: chip reset and port type fixes (Andy Gospodarek ) [441259 442026]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.15.el5]
changelog:
  - [pci] fix problems with msi interrupt management (Neil Horman ) [461894 428696]
  - [x86_64] revert time syscall changes (Prarit Bhargava ) [466427 461184]
  - [xen] allow guests to hide the TSC from applications (Chris Lalancette ) [378471 378481] {CVE-2007-5907}
  - [scsi] qla2xxx: additional residual-count correction (Marcus Barrow ) [465741 462117]
  - [char] add range_is_allowed check to mmap_mem (Eugene Teo ) [460858 460857]
  - [fs] binfmt_misc: avoid potential kernel stack overflow (Vitaly Mayatskikh ) [459464 459463]
  - [misc] cpufreq: fix format string bug (Vitaly Mayatskikh ) [459461 459460]
  - [dlm] user.c input validation fixes (David Teigland ) [458759 458760]
  - [nfs] pages of a memory mapped file get corrupted (Peter Staubach ) [450335 435291]
  - [x86_64] gettimeofday fixes for HPET, PMTimer, TSC (Prarit Bhargava ) [462860 250708]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.16.el5]
changelog:
  - [i386] vDSO: use install_special_mapping (Peter Zijlstra ) [460275 460276] {CVE-2008-3527}
  - [scsi] aacraid: remove some quirk AAC_QUIRK_SCSI_32 bits (Tomas Henzl ) [466885 453472]
  - [fs] remove SUID when splicing into an inode (Eric Sandeen ) [464451 464452] {CVE-2008-3833}
  - [fs] open() allows setgid bit when user is not in group (Eugene Teo ) [463867 463687] {CVE-2008-4210}
  - [xen] ia64: fix INIT injection (Tetsu Yamamoto ) [467105 464445]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.20.el5]
changelog:
  - [input] atkbd: cancel delayed work before freeing struct (Jiri Pirko ) [461232 461233]
  - [drm] i915 driver arbitrary ioremap (Eugene Teo ) [464508 464509] {CVE-2008-3831}
  - [fs] don't allow splice to files opened with O_APPEND (Eugene Teo ) [466709 466710] {CVE-2008-4554}
  - [xen] x86: allow the kernel to boot on pre-64 bit hw (Chris Lalancette ) [470040 468083]
  - [net] ipv4: fix byte value boundary check (Jiri Pirko ) [469649 468148]
  - [ia64] fix ptrace hangs when following threads (Denys Vlasenko ) [469150 461456]
  - [net] sctp: INIT-ACK indicates no AUTH peer support oops (Eugene Teo ) [466081 466082] {CVE-2008-4576}
  - [input] atkbd: delay executing of LED switching request (Jiri Pirko ) [461232 461233]
  - [xen] ia64: make viosapic SMP-safe by adding lock/unlock (Tetsu Yamamoto ) [467727 466552]
  - [xen] allow guests to hide the TSC from applications (Chris Lalancette ) [378471 378481] {CVE-2007-5907}
  - [nfs] v4: don't reuse expired nfs4_state_owner structs (Jeff Layton ) [469650 441884]
  - [nfs] v4: credential ref leak in nfs4_get_state_owner (Jeff Layton ) [469650 441884]
  - [nfs] v4: Poll aggressively when handling NFS4ERR_DELAY (Jeff Layton ) [469650 441884]
  - [xen] ia64: speed up hypercall for guest domain creation (Tetsu Yamamoto ) [459080 456171]
  - [xen] use unlocked_ioctl in evtchn, gntdev and privcmd (Tetsu Yamamoto ) [459080 456171]
  - [xen] page scrub: serialise softirq with a new lock (Tetsu Yamamoto ) [459080 456171]
  - [xen] serialize scrubbing pages (Tetsu Yamamoto ) [459080 456171]
  - [nfs] pages of a memory mapped file get corrupted (Peter Staubach ) [450335 435291]
  - [x86_64] xen: fix syscall return when tracing (Chris Lalancette ) [470853 453394]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.22.el5]
changelog:
  - [misc] hugepages: ia64 stack overflow and corrupt memory (Larry Woodman ) [474347 472802]
  - [misc] allow hugepage allocation to use most of memory (Larry Woodman ) [474760 438889]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-92.1.5.el5]
changelog:
  - [x86_64] copy_user doesn't zero tail bytes on page fault (Vitaly Mayatskikh) [451275 451276] {CVE-2008-2729}


author: Urs Beyerle <urs.beyerle@psi.ch> - 0.9.3-10.sl5
changelog:
  - madwifi-2.6.18-autoconf.patch no longer needed
  - add modules matching ath_rate_*.*o
  - update to 0.9.3


author: Stephan Wiesand <stephan wiesand desy de> 1.4.10-74.SLx
changelog:
  - upstream release 1.4.10
  - removed patches 1062..65
  - updated CellServDB from grand.central.org; remove wallace from RAL entry


author: Stephan Wiesand <stephan wiesand desy de> 1.4.11-75.SLx
changelog:
  - upstream release 1.4.11
  - updated CellServDB from grand.central.org
  - install release notes and changelog into /usr/share/doc/openafs-<version>
  - explicitly build src/auth/setkey (for -debug package)
  - do not install the new compile_et manpage, it clashes with e2fsprogs-devel
  - do not install the new rmtsysd manpage, this doesn't exist for linux yet
  - copyauth is no longer built; delete the manpage as well
  - package new manpages for restorevol, vsys
  - added post-1.4.11 fixes from stable-1_4_x git branch:
    1066: export-ktc-curpag-everywhere-20090713
    1067: fix-getvolume-for-nonroot-dynroot-fids-20090722


author: Stephan Wiesand <stephan wiesand desy de> 1.4.11-76.SLx
changelog:
  - added more post-1.4.11 fixes from stable-1_4_x git branch:
    1068: fix-linux24-builds-20090718
    1069: kernel-init-vrequest-structure-20090914


author: Stephan Wiesand <stephan wiesand desy de> 1.4.12-79.SLx
changelog:
  - 1.4.12 release, no additional patches
  - updated CellServDB from grand.central.org (phy.bris.ac.uk is ok)


author: Stephan Wiesand <stephan wiesand desy de> 1.4.14-80.SLx
changelog:
  - 1.4.14 release, no additional patches
  - updated CellServDB from grand.central.org (last changed 2010-12-13)


author: Stephan Wiesand <stephan.wiesand@desy.de> 1.4.7-68.SLx
changelog:
  - replace 1056 by 1057: linux-hlist-unhashed-opencoding-20080520
  - more post-1.4.7 patches (either trivial, or serious and simple):
    1058: butc-xbsa-lwp-protoize-damage-20080501
    1059: uuid-corrected-duplicate-check-20080501
    1060: viced-large-more-threads-20080506
    1061: vos-sync-flag-voltype-properly-20080521


author: Stephan Wiesand <stephan wiesand desy de> 1.4.14-80.1.SLx
changelog:
  - patch 1073: dont-afs_flushvcbs-under-xvcache-lock-20100623
  - this hopefully fixes the client hangups on parallel directory acces


author: Stephan Wiesand <stephan wiesand desy de> 1.4.14-82.SLx
changelog:
  - patch 1075 to fix buffer overflows (backport from 1.6.2 release)
  - backed out patch 1074 to make this is a security-only release


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-83.SLx
changelog:
  - 1.4.15 security release addressing openafs-sa-2013-0003 and -0004
  - see SECURITY.txt for important info on how to actually secure your site
  - just updating to this build is *not* sufficient


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-86.SLx
changelog:
  - apply relevant security fixes from openafs-1.6.13 (patches 1082..1086)
  - (the 6th patch in that release is specific to Solaris)


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-87.SLx
changelog:
  - implement the vlserver fix from openafs-1.6.14:
  - back out patch 1086 (which disabled querying the vldb by regex)
  - new patches 1087, 1088 to limit this to admins and fix buffer overflows


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-88.SLx
changelog:
  - added OPENAFS-SA-2015-007.1.4.patch, fix for CVE-2015-7762 from 1.6.15
  - note tat CVE-2015-7763 does not apply to openafs-1.4


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-89.SLx
changelog:
  - patch 1090 to fix CVE-2015-8312 (from release 1.6.16)
  - patches 1091..1095 to fix OPENAFS-SA-2016-001 & 2 (from release 1.6.17)


author: Stephan Wiesand <stephan.wiesand@desy.de> 1.4.5-56.SLx
changelog:
  - first patches from cvs
    1051: krb5-klog-20071101
    1052: cbd-use-callback-size-for-callbacks-20071105
    1053: linux-nsec-timestamp-zero-20071106
    1054: viced-missing-lock-20071109
    1055: viced-accurately-track-file-callbacks-20071112
  - krb5 capable klog packaged as klog.krb5 in openafs-krb5


author: Stephan Wiesand <stephan.wiesand@desy.de> 1.4.6-58.SLx
changelog:
  - new upstream release; fixes fileserver bugs (OPENAFS-SA-2007-003, DOS)
  - this obsoletes patches 1052,54,55;
  - also removed linux-nsec-timestamp-zero (1053) for the time being
  - renamed klog.krb5 to k5log
  - => this is a build of pristine openafs-1.4.6, except for the extra k5log
  - largefile-fileserver is the default since 1.4.5 -> adapt configure options
  - added "--with debugsyms" build option


author: Chris Feist <cfeist@redhat.com> - 0.1.21-1
changelog:
  - Lock methods are now removed when using the lock_nolock protocol
  - Permission checks have been removed from xattr operations
  - Locking order in gfs_get_parent() has been fixed
  - Resolves: rhbz#244343 rhbz#323111 rhbz#400651


author: Chris Feist <cfeist@redhat.com> - 0.1.22-1
changelog:
  - gfs_tool now recognizes GFS files sytems on ppc
  - Fixed a NULL pointer dereference.
  - gfs_quota is now able to perform efficient list operations
  - Resolves: rhbz#429633 rhbz#426291 rhbz#430134


author: Chris Feist <cfeist@redhat.com> - 0.1.23-5.el5_2.3
changelog:
  - Fixed an assertion caused by the inode glock holder never getting
    dequeued through gfs_readpage.
  - Resolves: rhbz#465327


author: Abhijith Das <adas@redhat.com> - 0.1.34-10
changelog:
  - Fixes "Resource tempory unavailable" for EWOULDBLOCK message with 
    flocks on gfs file
  - Resolves: rhbz#515717


author: Abhijith Das <adas@redhat.com> - 0.1.34-11
changelog:
  - Fixes "Resource tempory unavailable" for EWOULDBLOCK message with
    flocks on gfs file
  - Resolves: rhbz#515717


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.19
changelog:
  - kvm-qcow2-Fix-qemu-img-check-segfault-on-corrupted-image.patch [bz#610342]
  - kvm-qcow2-Don-t-try-to-check-tables-that-couldn-t-be-loa.patch [bz#610342]
  - kvm-qemu-img-check-Distinguish-different-kinds-of-errors.patch [bz#618206]
  - kvm-qcow2-Change-check-to-distinguish-error-cases.patch [bz#618206]
  - Resolves: bz#610342
    ([kvm] segmentation fault when running qemu-img check on faulty image)
  - Resolves: bz#618206
    ([kvm] qemu image check returns cluster errors when using virtIO block (thinly provisioned) during e_no_space events (along with EIO errors))


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.20
changelog:
  - kvm-virtio-net-correct-packet-length-checks.patch [bz#610343]
  - Resolves: bz#610343
    (Virtio: Transfer file caused guest in same vlan abnormally quit)


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.21
changelog:
  - kvm-Fix-segfault-in-mmio-subpage-handling-code.patch [bz#619412]
  - Resolves: bz#619412
    (CVE-2010-2784 qemu: insufficient constraints checking in exec.c:subpage_register() [rhel-5.5.z])


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.23
changelog:
  - kvm-qemu-don-t-strip-qemu-img-and-qemu-io-in-make-instal.patch [bz#629635]
  - Resolves: bz#629635
    ([kvm] debug-info missing from kvm-qemu-img-83-164.el5_5.12)


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.24
changelog:
  - Updated kversion to 2.6.18-194.17.1.el5 to match build root
  - kvm.spec: fix ./configure arguments
    (ensure spice, kvm-cap-pit and kvm-cap-device-assignment are always enabled)
  - kvm-kernel-KVM-Fix-fs-gs-reload-oops-with-invalid-ldt.patch [bz#639886]
  - Resolves: bz#639886
    (CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic [rhel-5.5.z])
  - CVE: CVE-2010-3698


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.25
changelog:
  - Adding load_gs_index to kmod symbol greylist
  - Related: bz#639886
    (CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic [rhel-5.5.z])


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.28
changelog:
  - kvm-implement-dummy-PnP-support.patch [bz#659850]
  - kvm-load-registers-after-restoring-pvclock-msrs.patch [bz#660239]
  - Resolves: bz#659850
    (If VM boot seq. is set up as nc (PXE then disk) the VM is always stuck on trying to PXE boot)
  - Resolves: bz#660239
    (clock drift when migrating a guest between mis-matched CPU clock speed)


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.29
changelog:
  - kvm-kernel-KVM-Don-t-spin-on-virt-instruction-faults-during-reb.patch [bz#661397]
  - kvm-kernel-KVM-VMX-Return-0-from-a-failed-VMREAD.patch [bz#661397]
  - Resolves: bz#661397
    (reboot(RB_AUTOBOOT) fails if kvm instance is running)


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-164.el5_5.30
changelog:
  - Revert the bz#661397 patches as they are not enough
    - kvm-kernel-Revert-KVM-VMX-Return-0-from-a-failed-VMREAD.patch [bz#661397]
    - kvm-kernel-Revert-KVM-Don-t-spin-on-virt-instruction-faults-dur.patch [bz#661397]
  - Related: bz#661397
    (reboot(RB_AUTOBOOT) fails if kvm instance is running)
  - kvm-kernel-KVM-fix-AMD-initial-TSC-offset-problems-additional-f.patch [bz#656984]
  - Resolves: bz#656984
    (TSC offset of virtual machines is not initialized correctly by 'kvm_amd' kernel module.)


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-222.el5
changelog:
  - kvm-kernel-kvm-change-signed-int-to-unsigned-in-mmu_shrink.patch [bz#661117]
  - Resolves: bz#661117
    ([RHEL5.6 CC] mmu_shrink patch)


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-223.el5
changelog:
  - Updated kversion to 2.6.18-237.el to match build root
  - Reverting patches for bz#608709 as they are not complete
    - kvm-kernel-Revert-KVM-VMX-Return-0-from-a-failed-VMREAD.patch [bz#608709]
    - kvm-kernel-Revert-KVM-Don-t-spin-on-virt-instruction-faults-dur.patch [bz#608709]
  - bz#608709: reboot(RB_AUTOBOOT) fails if kvm instance is running
  - Related: bz#661117


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-224.el5
changelog:
  - kvm-kernel-KVM-x86-zero-kvm_vcpu_events-interrupt.pad.patch [bz#665407]
  - Resolves: bz#665407
    (kvm_vcpu_events.interrupt.pad must be zeroed)
  - CVE: CVE-2010-4525


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-239.el5
changelog:
  - Updated kversion to 2.6.18-269.el to match build root
  - kvm-Revert-Make-migration-robust-to-trashing-workloads.patch [bz#713392]
  - Resolves: bz#713392
    (Increase migration max_downtime/or speed cause guest stalls.)


author: Eduardo Habkost <ehabkost@redhat.com> - kvm-83-239.el5_7.1
changelog:
  - kvm-e1000-prevent-buffer-overflow-when-processing-legacy.patch [bz#772079]
  - Resolves: bz#772079
    (EMBARGOED CVE-2012-0029 qemu-kvm: e1000: process_tx_desc legacy mode packets heap overflow [rhel-5.7.z])
  - kvm-Fix-external-module-compat.c-not-to-use-unsupported-.patch [bz#753860]
    (build fix)
  - kvm-kernel-KVM-x86-Prevent-starting-PIT-timers-in-the-absence-o.patch [bz#770100]
  - Resolves: bz#770100
    (CVE-2011-4622 kernel: kvm: pit timer with no irqchip crashes the system [rhel-5.7.z])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-247.el5
changelog:
  - kvm-kernel-KVM-Remove-ability-to-assign-a-device-without-iommu-.patch [bz#770095]
  - kvm-kernel-KVM-Device-assignment-permission-checks.patch [bz#770095]
  - Resolves: bz#770095
    (CVE-2011-4347 kernel: kvm: device assignment DoS [rhel-5.8])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-248.el5
changelog:
  - kvm-e1000-prevent-buffer-overflow-when-processing-legacy.patch [bz#772080]
  - CVE: CVE-2012-0029
  - Resolves: bz#772080
    (EMBARGOED CVE-2012-0029 qemu-kvm: e1000: process_tx_desc legacy mode packets heap overflow [rhel-5.8])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-249.el5
changelog:
  - kvm-kernel-KVM-x86-Prevent-starting-PIT-timers-in-the-absence-o.patch [bz#770101]
  - CVE: CVE-2011-4622
  - Resolves: bz#770101
    (CVE-2011-4622 kernel: kvm: pit timer with no irqchip crashes the system [rhel-5.8])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-249.el5_8.2
changelog:
  - kvm-kernel-KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch [bz#808205]
  - Resolves: bz#808205
    (CVE-2012-1601 kernel: kvm: irqchip_in_kernel() and vcpu->arch.apic inconsistency [rhel-5.8.z])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-249.el5_8.3
changelog:
  - kvm-fix-l1_map-buffer-overflow.patch [bz#816207]
  - Resolves: bz#816207
    (qemu-kvm segfault in tb_invalidate_phys_page_range())


author: Michal Novotny <minovotn@redhat.com> - kvm-83-249.el5_8.4
changelog:
  - kvm-kernel-KVM-unmap-pages-from-the-iommu-when-slots-are-remove.patch [bz#814151]
  - CVE: CVE-2012-2121
  - Resolves: bz#814151
    (CVE-2012-2121 kvm: device assignment page leak [rhel-5.8])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-249.el5_8.5
changelog:
  - kvm-console-bounds-check-whenever-changing-the-cursor-du-58.patch [bz#851255]
  - CVE: CVE-2012-3515
  - Resolves: bz#851255
    (EMBARGOED CVE-2012-3515 qemu/kvm: VT100 emulation vulnerability [rhel-5.8.z])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-261.el5
changelog:
  - kvm-vnc-disable-VNC-password-authentication-security-typ.patch [bz#805676]
  - Resolves: bz#805676
    (FIPS 140-2 kernel and KVM)


author: Michal Novotny <minovotn@redhat.com> - kvm-83-262.el5
changelog:
  - kvm-virtio-Factor-virtqueue_map_sg-out.patch [bz#684745]
  - kvm-virtio-blk-fix-the-list-operation-in-virtio_blk_load.patch [bz#684745]
  - kvm-virtio-blk-Fix-migration-of-queued-requests.patch [bz#684745]
  - kvm-block-prevent-snapshot-mode-TMPDIR-symlink-attack.patch [bz#825687]
  - Resolves: bz#684745
    (Guest I/O can't be resumed after I/O failure on one host and then migration to another host)
  - Resolves: bz#825687
    (CVE-2012-2652 qemu: vulnerable to temporary file symlink attacks [rhel-5.9])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-262.el5_1
changelog:
  - kvm-e1000-Discard-packets-that-are-too-long-if-SBP-and-L.patch [bz#910839]
  - kvm-e1000-Discard-oversized-packets-based-on-SBP-LPE.patch [bz#910839]
  - Resolves: bz#910839
    (CVE-2012-6075  qemu (e1000 device driver): Buffer overflow when processing large packets when SBP and LPE flags are disabled [rhel-5.9.z])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-262.el5_2
changelog:
  - kvm-kernel-KVM-Fix-for-buffer-overflow-in-handling-of-MSR_KVM_S.patch [bz#917018]
  - kvm-kernel-KVM-Convert-MSR_KVM_SYSTEM_TIME-to-use-kvm_write_gue.patch [bz#917022]
  - kvm-kernel-KVM-Fix-bounds-checking-in-ioapic-indirect-register-.patch [bz#917028]
  - kvm-kernel-do-not-GP-on-unaligned-MSR_KVM_SYSTEM_TIME-write.patch [bz#bz917019]
  - Resolves: bz#917018
    (CVE-2013-1796 kernel: kvm: buffer overflow in handling of MSR_KVM_SYSTEM_TIME [rhel-5.9.z])
  - Resolves: bz#917022
    (CVE-2013-1797 kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME [rhel-5.9.z])
  - Resolves: bz#917028
    (CVE-2013-1798 kernel: kvm: out-of-bounds access in ioapic indirect register reads [rhel-5.9.z])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-262.el5_3
changelog:
  - kvm-kernel-kvm-accept-unaligned-MSR_KVM_SYSTEM_TIME-writes.patch [bz#947363]
  - Resolves: bz#947363
    (RHEL.5.8.32 guest hang when installing)


author: Michal Novotny <minovotn@redhat.com> - kvm-83-265.el5
changelog:
  - kvm-kernel-kvm-accept-unaligned-MSR_KVM_SYSTEM_TIME-writes.patch [bz#924597]
  - Resolves: bz#924597
    (RHEL.5.8.32 guest hang when installing)


author: Michal Novotny <minovotn@redhat.com> - kvm-83-266.el5
changelog:
  - Updated kversion to 2.6.18-348.4.1.el5
  - kvm-fix-l1_map-buffer-overflow.patch [bz#956511]
  - Resolves: bz#956511
    (qemu-kvm segfault in tb_invalidate_phys_page_range())


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83-266_10.1.el5
changelog:
  - KVM: x86: prevent cross page vapic_addr access (CVE-2013-6368) [bz#1032219]
  - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) [bz#1032216]
  - Resolves: bz#1032219
    (CVE-2013-6368 kvm: cross page vapic_addr access [rhel-5.10])
  - Resolves: bz#1032216
    CVE-2013-6367 kvm: division by zero in apic_get_tmcct() [rhel-5.10.z]


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83-268.el5
changelog:
  - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) [bz#1032217]
  - Resolves: bz#1032217
   (CVE-2013-6367 kvm: division by zero in apic_get_tmcct() [rhel-5.11])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83-269.el5
changelog:
  - KVM: x86: Improve thread safety in pit
  - Resolves: bz#1152985
   (CVE-2014-3611 kernel: kvm: PIT timer race condition)


author: Jeff E. Nelson <jen@redhat.com> - kvm-83-270.el5
changelog:
  - KVM: x86: Check non canonical addresses upon WRMSR
  - Resolves: bz#1152982
   (CVE-2014-3610 kernel: kvm: noncanonical MSR writes [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83.272.el5
changelog:
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219266]
  - Resolves: bz#1219266
    (kvm: qemu: floppy disk controller flaw [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83.273.el5
changelog:
  - kvm-pcnet-Properly-handle-TX-requests-during-Link-Fail.patch [bz#1225896]
  - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225896]
  - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225896]
  - Resolves: bz#1225896 
    (EMBARGOED CVE-2015-3209 kvm: qemu: pcnet: multi-tmd buffer overflow in the tx path [rhel-5.11.z)


author: Jeff E. Nelson <jen@redhat.com> - kvm-83.274.el5
changelog:
  - net-add-checks-to-validate-ring-buffer-pointers.patch [bz#1263272]
  - Resolves: bz#1263272
    (CVE-2015-5279 kvm: qemu: Heap overflow vulnerability in ne2000_receive() function [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83.275.el5
changelog:
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1334173]
  - Resolves: bz#1334173
    CVE-2016-3710 kvm: qemu: incorrect banked access bounds checking in vga module [rhel-5.11.z]


author: Miroslav Rezanina <mrezanin@redhat.com> - 83-275.el5_11
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359723]
  - Resolves: bz#1359723
    CVE-2016-5403 kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-5.11.z]


author: Miroslav Rezanina <mrezanin@redhat.com> - 83-277.el5_11
changelog:
  - kvm-Fix-hardware-accelerated-video-to-video-copy-on-Cirr.patch [bz#1421564]
  - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop.patch [bz#1421564]
  - kvm-cirrus-fix-blit-region-check.patch [bz#1421564]
  - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrus_bltbuf.patch [bz#1421564]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1421564]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1421564]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1421564]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1421564]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1421564]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1421564]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1421564]
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1421564]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1421564]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1421564]
  - Resolves: bz#1421564
    (CVE-2017-2615 kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-5.11.z])


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-17
changelog:
  - ftpd: also do PAM session and credential management when ftp clients use
    strong authentication (#286291)


author: Nalin Dahyabhai <nalin@redhat.com>
changelog:
  - fix storage of delegated krb5 credentials when they've been wrapped up in
    spnego (#436460)
  - return a delegated credential handle even if the application didn't pass a
    location to store the flags which would be used to indicate that credentials
    were delegated (#436465)
  - add patch to fall back to TCP kpasswd servers for kdc-unreachable,
    can't-resolve-server, and response-too-big errors (#436467)
  - use the right sequence numbers when generating password-set/change requests
    for kpasswd servers after the first one (#436468)
  - backport from 1.6.3 to initialize a library-allocated get_init_creds_opt
    structure the same way we would one which was allocated by the calling
    application, to restore kinit's traditional behavior of doing a password
    change right when it detects an expired password (#436470)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-17.el5_1.1
changelog:
  - add preliminary patch to fix use of uninitialized pointer / double-free in
    KDC (CVE-2008-0062,CVE-2008-0063) (#432620, #432621)
  - add backported patch to fix use-after-free in libgssapi_krb5 (CVE-2007-5901)
    (#415321)
  - add backported patch to fix double-free in libgssapi_krb5 (CVE-2007-5971)
    (#415351)
  - add preliminary patch to fix incorrect handling of high-numbered descriptors
    in the RPC library (CVE-2008-0947) (#433596)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-24
changelog:
  - kdb_ldap: add patch to recognize "nsAccountLock: TRUE" as indicating that
    an entry should have the DISALLOW_ALL_TIX flag set (read only), for better
    interop with Fedora, Netscape, Red Hat Directory Server (Simo Sorce, #431784)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-25.el5_2.1
changelog:
  - backport fix from 1.6.3 to abort a sequential scan of a keytab if the
    handle to the keytab has become invalidated during the scan (via Vince
    Worthington, #461908)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-31.el5_3.1
changelog:
  - add backport of svn patch to fix a bug in how the gssapi library
    handles certain error cases in gss_accept_sec_context (CVE-2009-0845,


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-31.el5_3.2
changelog:
  - add fix for potential buffer read overrun in the SPNEGO GSSAPI mechanism
    (#490635, CVE-2009-0844)
  - add fix for NULL pointer dereference when handling certain error cases
    in the SPNEGO GSSAPI mechanism (#490635, CVE-2009-0845)
  - add fix for attempt to free uninitialized pointer in the ASN.1 decoder
    (#490635, CVE-2009-0846)
  - add fix for bug in length validation in the ASN.1 decoder (CVE-2009-0847)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-36.el5_4.1
changelog:
  - add candidate patch to correct KDC integer overflows which could be
    triggered by malformed RC4 and AES ciphertexts (CVE-2009-4212, #546347)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-36.el5_5.2
changelog:
  - pull changes to libkrb5 to properly handle and chase "off-path" referrals
    back from 1.7 (#574387)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-36.el5_5.3
changelog:
  - add upstream patch to fix a few use-after-free bugs, including one in
    kadmind (CVE-2010-0629, #578185)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-36.el5_5.4
changelog:
  - add candidate patch to correct KDC null pointer dereference which
    could be triggered by malformed client requests (CVE-2010-1321, #583703)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-36.el5_5.5
changelog:
  - ksu: perform PAM account and session management before dropping privileges
    to those of the target user (#602967, #615261)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-36.el5_5.6
changelog:
  - incorporate candidate patch for checksum acceptance issues from
    MITKRB5-SA-2010-007 (CVE-2010-1323, #652307)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-55.el5_6
changelog:
  - incorporate upstream patch for checksum acceptance issues from
    MITKRB5-SA-2010-007 (CVE-2010-1323, #652308)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-55.el5_6.1
changelog:
  - add upstream patch to fix hang or crash in the KDC when using the LDAP kdb
    backend (CVE-2011-0281, CVE-2011-0282, #671096)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-62.el5_7
changelog:
  - incorporate a fix to teach the file labeling bits about when replay caches
    are expunged (#712453)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-68.el5
changelog:
  - backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
    to talk to a KDC by using poll() if it's detected at compile-time, revised
    (#701444, RT#6905)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-78.el5
changelog:
  - gssapi: pull in upstream fix for a possible NULL dereference in spnego
    (CVE-2014-4344, #1121509)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.15-1.2.2.el5_2.1
changelog:
  - Fix insufficient input validation in ReadEmbeddedTextTag
  - Fix unsigned -> signed integer cast issue in cmsAllocGamma
  - Resolves: #473469


author: Tomas Bzatek <tbzatek@redhat.com> - 1.18-beta1.1.el5_3.1
changelog:
  - Rebase to upstream 1.18beta1
  - CVE-2009-0581 LittleCms memory leak
  - CVE-2009-0723 LittleCms integer overflow
  - CVE-2009-0733 LittleCms lack of upper-bounds check on sizes
  - Resolves: #487513


author: Jiri Skala <jskala@redhat.com> - 3.7.11-2
changelog:
  - Resolves: #504591 - Problems with spaces in file names over HTTP
  - Resolves: #504594 - Alias ''edit' has multiple flaws


author: Ondrej Vasik <ovasik@redhat.com> - 3.7.11-4.el5_5.2
changelog:
  - Related: CVE-2010-2251 - describe new option xfer:auto-rename 
    which could restore old behaviour in manpage


author: Ondrej Vasik <ovasik@redhat.com> - 3.7.11-4.el5_5.3
changelog:
  - Related: CVE-2010-2251 - document change of xfer:clobber default
    value in manpage, respect xfer:clobber on with xfer:auto-rename on
    (old behaviour)


author: Soren Sandmann <ssp@redhat.com> 1.2.2-1.0.5.el5
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Benjamin Tissoires <btissoir@redhat.com> 1.2.2-1.0.6
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-3
changelog:
  - New upstream release 0.1.2
  - Fixes a serious issue with libdhash where hash_enter() would never update
  - existing entries for a key.


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-10
changelog:
  - Resolves: rhbz#677753 - ding-libs developer docs on RHEL 5 are not
  -                         multilib-clean
  - Removed API documentation from packages


author: Richard Hughes <rhughes@redhat.com> - 0.6.21-1
changelog:
  - Update to version 0.6.21 fixing many bugs and CVEs
  - Remove upstreamed patches
  - Resolves: #839913


author: Tomas Mraz <tmraz@redhat.com> 1.4.4-1
changelog:
  - update to 1.4.4 (#444803)
  - do not abort when the fips mode kernel flag is inaccessible
    due to permissions
  - hobble the library to drop the ECC support
  - add hmac FIPS integrity verification check


author: Doug Ledford <dledford@redhat.com> - 1.3.3-1.el5
changelog:
  - Update to latest upstream source
  - Remove dependence on libibcommon since we no longer use it
  - Related: bz518218


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.1-57
changelog:
  - Process all groups from a single nesting level
  - Resolves: rhbz#846664
  - Backport the option to disable srchost processing
  - Resolves: rhbz#841677


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.1-68
changelog:
  - Add a forgotten break in a switch statement
  - Related: rhbz#886165 - sssd will stop functioning correctly if sssd_be
                           hangs for a while


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.1-69
changelog:
  - Fix startup with a broken configuration
  - Resolves: rhbz#974036 - sssd core process keeps running after backends quit


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.1-70
changelog:
  - Fix IPA provider performance issue when storing large host groups
  - Resolves: rhbz#979047 - sssd_be goes to 99% CPU and causes significant
                            login delays when client is under load


author: Tom Lane <tgl@redhat.com> 2:1.2.10-13
changelog:
  - Back-port fixes for CVE-2011-2690, CVE-2011-2692
    Note: CVE-2011-2691, announced at the same time, does not apply to 1.2.10;
    likewise for CVE-2011-2501
  Resolves: #721304


author: Tom Lane <tgl@redhat.com> 2:1.2.10-7.0.3
changelog:
  - Back-port critical fixes from libpng 1.2.22, primarily to fix CVE-2007-5269
  Resolves: #337521
  - Update License tag and some other obsolete bits in specfile


author: Tom Lane <tgl@redhat.com> 2:1.2.10-7.1.el5_5.3
changelog:
  - Back-port fixes for CVE-2009-2042, CVE-2010-0205, CVE-2010-1205,
    CVE-2010-2249
  Resolves: #609921


author: Tom Lane <tgl@redhat.com> 2:1.2.10-7.1.el5_7.4
changelog:
  - Back-port fixes for CVE-2011-2690, CVE-2011-2692
    Note: CVE-2011-2691, announced at the same time, does not apply to 1.2.10;
    likewise for CVE-2011-2501
  Resolves: #721303


author: Miroslav Grepl <mgrepl@redhat.com> - 1.33.4-5.6
changelog:
  - Add
    - selinux_virtual_domain_context_path
    - selinux_virtual_image_context_path
  Resolves:#582612


author: Dan Walsh <dwalsh@redhat.com> 1.15.1-1
changelog:
  - Upgrade to latest from NSA
  	* Merged fix for version comparison that was preventing range
  	  transition rules from being written for a version 5 base policy
  	  from Darrel Goeddel.


author: Dan Walsh <dwalsh@redhat.com> 1.15.2-1.el5
changelog:
  - Upgrade to latest from NSA
  	* Merged fix from Karl MacMillan for a segfault when linking
  	  non-MLS modules with users in them.


author: Simo Sorce <ssorce@redhat.com> 3.0.33-3.29.el5.3
changelog:
  - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694,
    CVE-2011-2522, CVE-2011-1678
  - resolves: #722552


author: Stephen Gallagher <sgallagh@redhat.com> - 2.0.1-11
changelog:
  - Resolves: rhbz#643038 - libtalloc needs to support the older library for
  -                         backward compatibility


author: Stephen Gallagher <sgallagh@redhat.com> - 2.0.1-13
changelog:
  - Run 'make test' during RPM build
  - Resolves: rhbz#837853 - talloc doesn't ensure that the sibling linked list
                            remains valid during a free


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-1
changelog:
  - Rebase to 2.0.7
  - Resolves: rhbz#855862 - Rebase libtalloc to version 2.0.7 to pick
                            the latest bug fixes


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-2
changelog:
  - Mark libraries as executable so that they are stripped and included
    in the -debuginfo
  - Resolves: rhbz#855862 - Rebase libtalloc to version 2.0.7 to pick
                            the latest bug fixes


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-6
changelog:
  - Resolves: rhbz#693785 - tdb_extend() can cause a memory-usage explosion if
  -                         the size of its entries are very large


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.10-1
changelog:
  - Rebase to version 1.2.10 to support new samba 3.6.6
  - Resolves: rhbz#837865 - Rebase libtdb to version 1.2.10 in RHEL 5.9


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-1
changelog:
  - Resolves: rhbz#951045 - Rebase libtevent to version 0.9.18
  - Relax libtalloc requirements - only require 2.0.7 and do not check for
    pytalloc presence if python is disabled
  - Drop the ABI compatibility patch (no longer needed)
  - Drop the tevent_signal segv patch (upstreamed)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-2
changelog:
  - Resolves: rhbz#975488 - Additional flags might have no effect
                            on 32bit architectures


author: Tom Lane <tgl@redhat.com> 3.8.2-13
changelog:
  - Fix incorrect fix for CVE-2011-0192
  Resolves: #688828
  - Add fix for CVE-2011-1167
  Resolves: #688745


author: Tom Lane <tgl@redhat.com> 3.8.2-17
changelog:
  - Fix incomplete patch for CVE-2012-3401
  - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works
    with pre-4.0.2 libtiff
  Resolves: #885308


author: Tom Lane <tgl@redhat.com> 3.8.2-17
changelog:
  - Fix incomplete patch for CVE-2012-3401
  - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works
    with pre-4.0.2 libtiff
  Resolves: #885309


author: Petr Hracek <phracek@redhat.com> - 3.8.2-19
changelog:
  - Resolves: #1063460 CVE-2013-1960 CVE-2013-1961 CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244
    libtiff various flaws


author: Tom Lane <tgl@redhat.com> 3.8.2-7.el5.1
changelog:
  - Fix LZW decoding vulnerabilities (CVE-2008-2327)
  Resolves: #458812
  - Remove sgi2tiff.1 and tiffsv.1, since they are for programs we don't ship
  Resolves: #460120


author: Tom Lane <tgl@redhat.com> 3.8.2-7.el5.3
changelog:
  - Fix some more LZW decoding vulnerabilities (CVE-2009-2285)
  Resolves: #507725
  - Update upstream URL


author: Tom Lane <tgl@redhat.com> 3.8.2-7.el5_6.7
changelog:
  - Fix incorrect fix for CVE-2011-0192
  Resolves: #688827
  - Add fix for CVE-2011-1167
  Resolves: #688744


author: Karsten Hopp <karsten@redhat.com> 1.5.22-7
changelog:
  - add fix for CVE-2009-3736,
    libltdl may load and execute code from a library in the current directory


author: Daniel P. Berrange <berrange@redhat.com> - 0.3.3-14.el5_3.1
changelog:
  - Add missing readonly checks for APIs (CVE-2008-5086)
  - Add missing buf check in proxy daemon (CVE-2009-0036)


author: Jiri Denemark <jdenemar@redhat.com> - 0.6.3-33.el5_5.2
changelog:
  - Fix discrepancy between xm list and virsh list (rhbz 618200)
  - Set a stable & high MAC addr for guest TAP devices on host (rhbz 617243)


author: Jiri Denemark <jdenemar@redhat.com> - 0.6.3-33.el5_5.3
changelog:
  - Explicitly set qcow2 backing store format (CVE-2010-2239)
  - Remap privileged source ports from guests behind NAT (CVE-2010-2242)
  - Eliminate memory leak in xenUnifiedDomainInfoListFree (rhbz 619711)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.2-15.el5_6.3
changelog:
  - Properly report error in virConnectDomainXMLToNative (CVE-2011-1146)
  - Guess rhel macro based on dist macro (rhbz#688728)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.2-20.el5
changelog:
  - Support enabling or disabling the HPET for Xen domains (rhbz#703193)
  - SMBIOS support (rhbz#661365)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.8.2-28.el5
changelog:
  - qemu: Rollback on used USB devices (rhbz#816601)
  - qemu: Don't delete USB device on failed qemuPrepareHostdevUSBDevices (rhbz#816601)


author: Harald Hoyer <harald@redhat.com> 095-14.19
changelog:
  - removed zaptel rules (rhbz #294061)
  - fixed segfault for empty lines in passwd (rhbz#413831)
  - added patch for iscsi ids (Daniel Berrange) (rhbz#427640)
  - added /etc/sysconfig/udev-stw, which makes MODULES 
    configurable (Jeff Bastian) (rhbz#437979)
  - added ext4 support to vol_id (rhbz#444528)
  - updated dasd_id from dasdinfo of s390-tools-1.6.2 (rhbz#430532)
  - Resolves: rhbz#294061, rhbz#413831, rhbz#427640
  - Resolves: rhbz#437979, rhbz#444528, rhbz#430532


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.12.el5_7.2
changelog:
  - Fix the semantic of XPath axis for namespace/attribute nodes CVE-2010-4008
  - Fix an off by one error in encoding CVE-2011-0216
  - Fix some potential problems on reallocation failures CVE-2011-1944
  - Fix missing error status in XPath evaluation CVE-2011-2834
  - Make sure the parser returns when getting a Stop order CVE-2011-3905
  - Fix an allocation error when copying entities CVE-2011-3919.patch
  - Resolves: rhbz#771906


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.15.el5
changelog:
  - Fix the semantic of XPath axis for namespace/attribute nodes CVE-2010-4008
  - Fix an off by one error in encoding CVE-2011-0216
  - Fix some potential problems on reallocation failures CVE-2011-1944
  - Fix missing error status in XPath evaluation CVE-2011-2834
  - Make sure the parser returns when getting a Stop order CVE-2011-3905
  - Fix an allocation error when copying entities CVE-2011-3919.patch
  - Resolves: rhbz#771907


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.15.el5_8.3
changelog:
  - Fix parser local buffers size problems (rhbz#843739)
  - Fix entities local buffers size problems (rhbz#843739)
  - Fix an error in previous commit (rhbz#843739)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.15.el5_8.5
changelog:
  - Implement some default limits in the XPath module (CVE-2011-1944)
  - Change the XPath code to percolate allocation errors (CVE-2011-1944)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.24.el5
changelog:
  - fixed one regexp bug and added a (rhbz#922450)
  - Another small change on the algorithm for the elimination of epsilon (rhbz#922450)


author: Daniel Veillard <veillard@redhat.com> - 1.1.17-4.el5_8.1
changelog:
  - fixes CVE-2011-1202 CVE-2011-3970 CVE-2012-2825 CVE-2012-2871 CVE-2012-2870
  - Fix portability to upcoming libxml2-2.9.0
  - Fix generate-id() to not expose object addresses (CVE-2011-1202)
  - Fix some case of pattern parsing errors (CVE-2011-3970)
  - Fix a bug in selecting XSLT elements (CVE-2012-2825)
  - Fix default template processing on namespace nodes (CVE-2012-2871)
  - Fixed problem with namespace on compound predicate
  - Fix direct pattern matching bug
  - Big fixes of pattern compilations
  - Fixes #527297 general patter comps fix and cleanup other cleanups Daniel
  - QName parsing fix for patterns
  - Cleanup of the pattern compilation code (CVE-2012-2870)
  - Hardening of code checking node types in various entry point (CVE-2012-2870)
  - Hardening of code checking node types in EXSLT (CVE-2012-2870)
  - Fix system-property with unknown namespace
  - Xsltproc should return an error code if xinclude fails
  - Fix a dictionary string usage
  - Avoid a heap use after free error


author: Yuval Kashtan <ykashtan@redhat.com> - 1.0-5.el5
changelog:
  - add i386, for qspice-xpi, to fix #552566: log4cpp is not built for i386 
  - resolve: #502679: multilib conflict in log4cpp-1.0-3.el5


author: Ivana Varekova <varekova@redhat.com> 7.3-7
changelog:
  - Resolves: #440606
    fix release tag
  - Resolves: #460993
    parse several unmatched logs in posix service
  - Resolves: #465212
    tag *.hdr as archive
  - Resolves: #466455
    parse new unmatched entroes in up2date log
  - Resolves: #489490
    add missing directories
  - Resolves: #511928
    fix the location of samba logs
  - Resolves: #424031
    fix several posix problems


author: Karel Klic <kklic@redhat.com> 7.3-9
changelog:
  - Added fix for CVE-2011-1018: Privilege escalation due improper
    sanitization of special characters in log file names
    Resolves: #680301


author: Hans de Goede <j.w.r.degoede@hhs.nl> 5.1.1-2
changelog:
  - Only link /usr/bin/lua with readline / do not link %{_libdir}/liblua-5.1.so
    with readline so that we don't cause any License troubles for packages
    linking against liblua-5.1.so, otherwise lua could drag the GPL only readline
    lib into the linking of non GPL apps.


author: Ryan McCabe <rmccabe@redhat.com> 0.12.2-24
changelog:
  - Fix bz493662 (RFE: Separate the Oracle 10g Failover Instance in Conga to two resources called "Oracle Instance" and "Oracle Listener")


author: Jan Pokorny <jpokorny@redhat.com> 0.12.2-51
changelog:
  - Fix bz711494 (CVE-2011-1948 plone: reflected XSS vulnerability)
  - Fix bz771920 (CVE-2011-4924 Zope: Incomplete upstream patch for CVE-2010-1104/bz577019)


author: Jan Pokorny <jpokorny@redhat.com> 0.12.2-59
changelog:
  - Fix bz835649 (luci uninstall will leave /var/lib/luci/var/pts and /usr/lib*/luci/zope/var/pts behind)


author: Ryan McCabe <rmccabe@redhat.com> 0.12.2-60
changelog:
  - Improvements for bz832185 (Luci cannot configure the "identity_file" attribute for fence_ilo_mp)
  - Improvements for bz822633 (Add luci support for nfsrestart)


author: Jan Pokorny <jpokorny@redhat.com> 0.12.2-64
changelog:
  - Improvements for bz786372 (Better protect luci's authentication cookie)
  - Improvements for bz607179 (Improper handling of session timeouts)


author: Jan Pokorny <jpokorny@redhat.com> - 0.12.2-78
changelog:
  - luci: reflect startup_wait parameter added in postgres-8 RA
    Resolves: rhbz#1065263
  - luci: Multiple information leak flaws in various luci site extensions
    Resolves: rhbz#1076148


author: Jan Pokorny <jpokorny@redhat.com> - 0.12.2-79
changelog:
  - luci: drop unsuccessful monkey patch application wrt. Plone 20121106 advisory
    Related: rhbz#956861


author: Milan Broz <mbroz@redhat.com> - 2.02.56-8.el5_5.5
changelog:
  - Fix initialisation of logging to file to not cause boot failure.
  - Fix lvchange --refresh to require partial flag if PVs are missing.
    Resolves: #601079 #601078


author: Tomas Hoger <thoger@redhat.com> - 2.8.5-28.1.1
changelog:
  - add patch for CVE-2008-4690 (rhbz#468184)
    - prompt user before executing commands from the lynxcgi: handler,
      even in the advanced user mode
    - mark all lynxcgi: URIs as untrusted in the default lynx.cfg
  - add patch to prevent lynx from opening configuration files in the
    current working directory (CVE to be assigned) (rhbz#214205)


author: Miloslav Trmač <mitr@redhat.com> - 0.16-6.el5.4
changelog:
  - Drop the Python lock around operations that can block for a long time.
    Resolves: #472690
  - Only send the "selector" part of URL in requests sent over a proxy.  Patch by
    James Bowes <jbowes@redhat.com>.
    Resolves: #491674
  - Explicitly close sockets underlying https connections.
    Resolves: #460692


author: Jan Kaluza <jkaluza@redhat.com> - 3:2.1.9-5
changelog:
  - fix #290661 - use relative symlink in /etc/smrsh
  - fix #461707 - break CC field correctly
  - fix #453377 - don't parse problematic mails many times, but isolate them
  - fix #521888 - fix instances of #!/usr/bin/env python in mailman
  - fix #515157 - fixed traceback when changing email address globally


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-6
changelog:
  - Bugzilla Bug #749401 - https://server.testrelm/ipa/xml: Bad Request
    intermittent errors
  - Bugzilla Bug #749402 - may be possible to spoof mod_nss FakeBasicAuth
  - Bugzilla Bug #749405 - mod_nss fails debug assertion
  - Bugzilla Bug #749406 - Add 'libnssckbi.so' runtime dependency . .


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-7
changelog:
  - Fix 'Bugzilla Bug #749405 - mod_nss fails debug assertion' by removing
    'mod_nss-no_shutdown_if_not_init.patch' and applying
    'mod_nss-no_shutdown_if_not_init_2.patch' instead
  - The 'mod_nss-no_shutdown_if_not_init_2.patch' patch also fixes
    Bugzilla Bug #784548 - File descriptor leak after "service httpd reload"
    or httpd doesn't reload


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-8
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #989724 - mod_nss does not respect `NSSVerifyClient` in
    Directory [rhel-5.10.z]


author: Doug Ledford <dledford@redhat.com> - 1.1.0-0.3355.1.el5
changelog:
  - Update to final ofed 1.4.1 bits
  - Compile against non-XRC libibverbs
  - Related: bz506258, bz506097


author: Tom Lane <tgl@redhat.com> 5.0.45-1
changelog:
  - Update to MySQL 5.0.45
  Resolves: #256501, #240813, #246309, #254012
  Resolves: #280811, #316451, #349121, #367131
  - Synchronize with current Fedora package, which is pretty well tested by now;
    see past bzs 245770, 241912, 233771, 221085, 223713, 203910, 193559, 199368


author: Tom Lane <tgl@redhat.com> 5.0.45-7
changelog:
  - Adjust thread stack requests to allow for platform-specific guard page size;
    necessary to prevent stack overrun on PPC with RHEL5's 64K page size.
  Resolves: #435391
  - Remove calendar-dependent queries from "view" test; necessary to get
    regression tests to pass after 2007.


author: Tom Lane <tgl@redhat.com> 5.0.77-1
changelog:
  - Update to MySQL 5.0.77, for numerous fixes described at
    http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-77.html
    including low-priority security issues CVE-2008-2079, CVE-2008-3963
  Resolves: #448487, #448534, #452824, #453156, #455619, #456875
  Resolves: #457218, #462534, #470036, #476896, #479615
  - Improve mysql.init to pass configured datadir to mysql_install_db,
    and to force user=mysql for both mysql_install_db and mysqld_safe.
  Resolves: #450178
  - Fix mysql.init to wait correctly when socket is not in default place
  Resolves: #435494


author: Tom Lane <tgl@redhat.com> 5.0.77-3
changelog:
  - Add fix for CVE-2009-2446 (format string vulnerability in COM_CREATE_DB and
    COM_DROP_DB processing)
  Resolves: #512200


author: Tom Lane <tgl@redhat.com> 5.0.77-4.2
changelog:
  - Add fixes for CVE-2009-4019, CVE-2009-4028, CVE-2009-4030
  Resolves: #556505
  - Use non-expired certificates for SSL testing (upstream bug 50702)
  - Emit explicit error message if user tries to build RPM as root
  - Add comment suggesting disabling symbolic links in /etc/my.cnf


author: Tom Lane <tgl@redhat.com> 5.0.77-4.4
changelog:
  - Add fixes for CVE-2010-3677, CVE-2010-3680, CVE-2010-3681, CVE-2010-3682,
    CVE-2010-3833, CVE-2010-3835, CVE-2010-3836, CVE-2010-3837, CVE-2010-3838,
    CVE-2010-3839, CVE-2010-3840
  Resolves: #645642
  - Backpatch strmov fix so that code can be tested on more recent platforms


author: Tom Lane <tgl@redhat.com> 5.0.77-4.5
changelog:
  - Add fix for crash during SHOW CREATE TABLE
  Resolves: #659609
  - Add fix for corruption of large BLOB values during dump/reload
  Resolves: #658863


author: Tom Lane <tgl@redhat.com> 5.0.77-4.el5_6.6
changelog:
  - Add fix for regression with input lines over 1MB (caused by fix for 658863)
  Resolves: #700497
  - Add fix for memory leak with DISTINCT, ORDER BY in subquery
  Resolves: #692953


author: Tom Lane <tgl@redhat.com> 5.0.95-1.el5_7.1
changelog:
  - Update to 5.0.95, to get the last upstream bugfixes in this release series
    including numerous CVEs announced in January 2012
  Resolves: #787140


author: Tom Lane <tgl@redhat.com> 5.0.95-1
changelog:
  - Update to 5.0.95, to get the last upstream bugfixes in this release series
    including numerous CVEs announced in January 2012
  Resolves: #787141


author: Tom Lane <tgl@redhat.com> 5.0.95-2
changelog:
  - Support rotation of mysqld log (though this is not enabled by default)
  Resolves: #647223
  - Fix crash with EXPLAIN and prepared statements
  Resolves: #654000
  - Adopt init script updates from the last Fedora init script (F-15)
  Resolves: #703476
  - Re-enable profiling feature, unintentionally disabled in 5.0.95-1
  Resolves: #806365


author: Honza Horak <hhorak@redhat.com> 5.1.69-6
changelog:
  - Restore SELinux context after installing -server package
  - Sub-package -test should require -libs
  - Added BuildRequire: scl-utils-build for any case


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #986138


author: Honza Horak <hhorak@redhat.com> 1-10
changelog:
  - Handle context of the init script
  - Change context on whole root directory (libselinux is fixed now #953947)
  - Add better descriptions for packages
  - Create SELinux context rules also for RHEL-5


author: Honza Horak <hhorak@redhat.com> 5.5.32-1
changelog:
  - Update to MySQL 5.5.32, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html
    Resolves: #975113
  - Use man pages from 5.5.30 due to license change
    Resolves: #975785
  - Fix issues found by Coverity
    Resolves: #975904


author: Honza Horak <hhorak@redhat.com> 5.5.32-2
changelog:
  - Fix text in mysql-readme-devel for RHEL-5
    Resolves: #975119
  - Fix misleading error message when uninstalling built-in plugins
    Resolves: #985402
  - Do not use pie linker flags, they don't work in RHEL-5
    Resolves: #985418


author: Honza Horak <hhorak@redhat.com> 5.5.36-1
changelog:
  - Update to MySQL 5.5.36, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-36.html
    Including fixes for CVE-2014-0412, CVE-2014-0437, CVE-2013-5908,
    CVE-2013-5807, CVE-2014-0420, CVE-2014-0393, CVE-2013-5891,
    CVE-2014-0386, CVE-2013-3839, CVE-2014-0401, CVE-2014-0402,
    Resolves: #1055875


author: Honza Horak <hhorak@redhat.com> - 5.5.37-1
changelog:
  - Update to MySQL 5.5.37, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html
    Includes fixes for: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432
    CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1089202


author: Honza Horak <hhorak@redhat.com> - 5.5.37-1
changelog:
  - Update to MySQL 5.5.37, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html
    Includes fixes for: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432
    CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1089203


author: Matej Muzila <mmuzila@redhat.com> - 5.5.40-1
changelog:
  - Rebase to 5.5.40
    Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464
    CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
    CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564
    Resolves: #1160514


author: Matej Muzila <mmuzila@redhat.com> - 5.5.45-1
changelog:
  - Rebase to 5.5.45
    Includes fixes for: CVE-2014-6568 CVE-2015-0374
    CVE-2015-0381 CVE-2015-0382 CVE-2015-0391 CVE-2015-0411 CVE-2015-0432
    CVE-2015-0501 CVE-2015-2568 CVE-2015-0499 CVE-2015-2571 CVE-2015-0433
    CVE-2015-0441 CVE-2015-0505 CVE-2015-2573 CVE-2015-2582 CVE-2015-2620
    CVE-2015-2643 CVE-2015-2648 CVE-2015-4737 CVE-2015-4752 CVE-2015-4757
    Resolves: #1247020


author: Jan Safranek <jsafranek@redhat.com> - 5.3.1-23
changelog:
  - add ipIfStatsTable to build
  - make ipv6ScopeZoneIndexTable loading quiet (#433446)
  - make ipAddressPrefixTable loading quiet (#253399 related)
  - fix inetToMediaTable to recover from error when ipv6 kernel module is 
    not present (#431977)


author: Jan Safranek <jsafranek@redhat.com> - 5.3.1-24.1
changelog:
  - fix buffer overflow in perl module (CVE-2008-2292) (#449897)
  - fix SNMPv3 authentication checks (unknown CVE) (#449897)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-18
changelog:
  - added support of ocfs2, tmpfs and reiserfs in hrStorageTable
    (#754652, #755958, #822061)
  - updated documentation of '-c' option of snmptrapd (#760001)
  - fixed endless loop after truncating 64bit int (#783892)
  - fixed snmpd exiting shortly after startup due to incoming signal (#799699)
  - fixed decoding of COUNTER64 values from AgentX (#803585)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#805689)
  - fixed CVE-2012-2141, an array index error in the extension table (#815813)
  - fixed snmpd showing "failed to run mteTrigger query" when 'monitor'
    config option is used (#830042)
  - added support for port numbers in 'clientaddr' configuration option
    (#828691)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-19
changelog:
  - fixed support for port numbers in 'clientaddr' configuration option
    (#840861, #845974)
  - added support of cvfs filesystem hrStorageTable (#846391)
  - removed various error log messages when IPv6 is disabled (#845155)
  - removed various error log messages related to counte64 expansions
    (#846905)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20
changelog:
  - fixed error message when the address specified by clientaddr option
    is wrong or cannot be bound (#840861)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20.1
changelog:
  - Fixed CVE-2012-6151: snmpd crashing when AgentX subagent disconnects in
    the middle of request processing (#1073224)
  - Fixed CVE-2014-2285: snmptrapd crash when using a trap with empty community
    string (#1073224)


author: Steve Dickson <steved@redhat.com> 1.0.9-33
changelog:
  - In both rpcgssd and rpcsvcgssd initscrips move the 
    SECURE_NFS check back to be a global check. This
    stops false failures from happen when the services
    are stopped when they are not configured to start (bz 435267)


author: Steve Dickson <steved@redhat.com> 1.0.9-35z
changelog:
  - Added the warning.patch to fix some warning which were
    flaged by rpmdiff during the errata phasea (Errata 2008:0486)


author: Steve Dickson <steved@redhat.com> 1.0.9-40
changelog:
  - Fixed arguments to the hosts_ctl() call in the good_client() 
    routine used in the tcpwrapper support. (bz 440120)


author: Steve Dickson <steved@redhat.com> 1.0.9-42
changelog:
  - mountd: Check host alias with netgroups (bz 478952)
  - exportfs: fixed typo in man page (bz 474848)
  - nfs.init: NFS server reboot results in "Stale NFS file handle" (bz 474449) 
  - nfslock.init: options not correctly parsed (bz 459591)
  - mount.nfs: mounts fail with read-only /etc (bz 450646)
  - nfslock.init: lockd not using settings in sysconfig/nfs (bz 434795)
  - tcpwrappers: updated code to correctly use api  (bz 494878)
  - nhfsstone: added v3 and v4 support (bz 465933)
  - mount.nfs: add support for lookupcache= option (bz 489335).


author: Steve Dickson <steved@redhat.com> 1.0.9-58
changelog:
  - gss: turned off more excessive syslogs (bz 593097)
  - initfiles: more initscripts improvements (bz 710020)
  - specfile: correct typo when nfsnobodys gid already exists (bz 729603)


author: Steve Dickson <steved@redhat.com> 1.0.9-59
changelog:
  - gss: turned of even more excessive syslogs (bz 593097)
  - mount.nfs: Ignored the SIGXFSZ when handling RLIMIT_FSIZE changes (bz 697979)


author: Steve Dickson <steved@redhat.com> 1.0.9-60
changelog:
  - Updated idmapd.conf and idmapd.conf.man to reflect the 
    static user name mapping (502707)
  - Fixed an umount regression introduced by bz 513094 (bz 781931)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Retagging to fix an inconsitency in the release tags
  - Resolves: rhbz#1002641 - Rebase RHEL 5 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-1
changelog:
  - Update to nspr-4.10.2
  - Remove an unused patch
  - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Fix changelog comments
  - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200921 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269359 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption [rhel-5.11.z]


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-0.1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297943 - Rebase RHEL 5.11.z to NSPR 4.11 in preparation for Firefox 45


author: Elio Maldonado Batiz <emaldona@redhat.com> - 4.8.9-1
changelog:
  - Resolves: rhbz#788672 - [RFE] Async update nspr to make firefox 10 LTS rebase possible
  - Update to 4.8.9


author: Elio Maldonado <emaldona@redhat.com> - 4.9.1-2
changelog:
  - Resolves: rhbz#834219 - restore top section of nspr-config-pc.patch
  - Needed to prevent multilib regressions


author: Elio Maldonado <emaldona@redhat.com> - 4.9.1-4
changelog:
  - Resolves: rhbz#834219 - Fix postinstall scriptlet failures
  - Fix %post and %postun lines per packaging guidelines
  - Updated License: to MPLv2.0 per upstream


author: Kai Engert <kengert@redhat.com> - 3.12.0.3-1
changelog:
  - Update to NSS_3_12_RC4
  - Enable loading of external ECC modules
  - Include upstream fix for a deadlock in the certutil tool, bug 447431


author: Kai Engert <kengert@redhat.com> - 3.12.2.0-3
changelog:
  - Update to NSS_3_12_2_WITH_CKBI_1_73_RTM
  - Add dependency to pkgconfig to devel package (bug456849)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-2
changelog:
  - Resolves: rhbz#834219 - Fix multilib and scriptlet problems
  - Fix %post and %postun lines per packaging guildelines
  - Add %{?_isa} to tools Requires: per packaging guidelines
  - Fix explicit-lib-dependency zlib error reported by rpmlint


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Resolves: rhbz#834219 - Fix the changes to the %post line
  - Having multiple commands requires that /sbin/lconfig be the beginning of the scriptlet


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-4
changelog:
  - Related: rhbz#834219 - Fix ia64 / i386 multilib nss install failure
  - Remove no longer needed %pre and %preun scriplets meant for nss updates from RHEL-5.0


author: Elio Maldonado <emaldona@redhat.com> - 3.13.6-3
changelog:
  - Fix changelog inconsistencies with commit and bug resolved
  - Resolves: rhbz#891149 [CVE-2013-0743]


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Fix rpmdiff test reported failures and remove other unwanted changes
  - Resolves: rhbz#949845 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Define -DNO_FORK_CHECK when compiling softoken for ABI compatibility
  - Remove the unused and obsolete nss-nochktest.patch
  - Resolves: rhbz#949845 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to nss-3.15.3
  - Remove unused patch
  - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]


author: Kai Engert <kaie@redhat.com> - 3.15.3-3
changelog:
  - remove unnecessary and problematic template-removal patch
    which was added as part of the 3.15.1 rebase
  - bump release number


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042683 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Remove two unused patches
  - Resolves: Bug 1042683 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117)


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-1
changelog:
  - Rebase to nss-3.16.1 for FF31
  - Resolves: Bug 1110860 - Rebase nss in RHEL 5.11 to NSS 3.16.1, required for FF 31


author: Kai Engert <kaie@redhat.com> - 3.16.1-4
changelog:
  - Adjust softokn patch to be compatible with legacy softokn API.
  - Resolves: Bug 1145430 - CVE-2014-1568


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Enable additional ssl test cycles and document why some aren't enabled
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Copy PayPalICA.cert and PayPalRootCA.cert to nss/tests/libpkix/certs
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Kai Engert <kaie@redhat.com> - 3.18.0-6
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-7
changelog:
  - Pick up upstream patch from nss-3.19.1
  - Resolves: Bug 1236954 - CVE-2015-2730 NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)
  - Resolves: Bug 1236967 - CVE-2015-2721 NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-1
changelog:
  - Rebase nss to 3.19.1
  - Pick up upstream fix for client auth. regression caused by 3.19.1
  - Revert upstream change to minimum key sizes
  - Remove patches that rendered obsolote by the rebase
  - Update existing patches on account of the rebase


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-35.2
changelog:
  - when setting file contexts for creation of new files, only fail outright
    if we were in enforcing mode and the file needed to be given a specific
    label (#368281)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-35.4
changelog:
  - import Kees Cook's patch to fix accidental leakage of part of ./DB_CONFIG
    (#580542, CVE-2010-0826)


author: Nalin Dahyabhai <nalin@redhat.com> - 253-11
changelog:
  - backport changes to group parsing from version 254 to fix heap corruption
    when parsing nested groups (#444031)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-18.el5
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-8.el5
changelog:
  - avoid use of uninitialized floating-point values in clock_select (#250838)
  - generate man pages from html source, include config man pages (#307271)
  - add note about paths and exit codes to ntpd man page (#242925, #246568)
  - add section about exit codes to ntpd man page (#319591)
  - always return 0 in scriptlets


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-9.el5
changelog:
  - fix selecting multicast interface (#444106)
  - disable kernel discipline when -x option is used (#431729)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-9.el5_3.2
changelog:
  - fix buffer overflow when parsing Autokey association message 
    (#500783, CVE-2009-1252)
  - fix buffer overflow in ntpq (#500783, CVE-2009-0159)


author: Connie Sieh <csieh@fnal.gov> 0.9.9-24
changelog:
  - Changed from using "ifconfig" to "ip" for NETWORKS as more consistent between
  - versions.  This allows for same version for 5, 6 and 7


author: Connie Sieh <csieh@fnal.gov> 0.9.9-25
changelog:
  - Changed from hardcoding what interfaces we will look at to finding all
  - that are UP and have either a ipv4 or ipv6 address


author: Steven Dake <sdake@redhat.com> 0.80.6-7
changelog:
  - Resolves: rhbz#506778
  - Add upstream revision 1959 - fix leaking of shared memory objects during
    shutdown of cman.


author: Steven Dake <sdake@redhat.com> 0.80.6-8
changelog:
  - Resolves: rhbz#506119
  - Add upstream revision 1998 - Ensure that leaving processors in totempg have
    their assembly state reset.


author: Caolán McNamara <caolanm@redhat.com> - 1:2.3.0-6.11
changelog:
  - Resolves: rhbz#461984 Cannot use -headless with wrapper scripts
  - Resolves: rhbz#469302 add openoffice.org-3.0.0.ooo88446.ucb.rename.patch
  - Resolves: rhbz#469330 Euro Converter type detection
  - Resolves: rhbz#470210 Failed to save refresh property of native format
  - Resolves: rhbz#469990 Crash in numbering during html import
  - Resolves: rhbz#456845 Fix GdkPixbuf warning on launch of math
  - Resolves: rhbz#462055 Better rtf export encodings for CJK text
  - Resolves: rhbz#469321 Import newer format .odbs
  - Resolves: rhbz#469615 Allow .met files to be opened from command-line
  - Resolves: rhbz#480829 Writer layout crash in certain tables
  - Resolves: rhbz#476959 Better .doc TOC export
  - Resolves: rhbz#476221 Retain use mods to psprint.conf
  - Resolves: rhbz#480369 Don't keep print dialog around after closed
  - Resolves: rhbz#469630 Don't have a non-functional next button in formula wizard
  - Resolves: rhbz#469145 The whole paragraph words cut are displayed at "Undo" line


author: David Tardon <dtardon@redhat.com> - 1:2.3.0-6.11.2
changelog:
  - Resolves: rhbz#529750 openoffice.org various flaws
  - CVE-2009-2950 GIF file parsing heap overflow
  - CVE-2009-2949 integer overflow in XPM processing


author: David Tardon <dtardon@redhat.com> - 1:2.3.0-6.11.4
changelog:
  - Resolves: rhbz#529750 openoffice.org various flaws
  - CVE-2009-3301 OpenOffice.org Word sprmTDefTable Memory Corruption
  - CVE-2009-3302 OpenOffice.org Word sprmTSetBrc Memory Corruption


author: Caolan McNamara <caolanm@redhat.com> - 1:2.3.0-6.5.2
changelog:
  - CVE-2008-3282 numeric truncation error in OOo memory allocator
  - Resolves: rhbz#458064 Handle memory allocation exceptions in bitmap handling code


author: David Tardon <dtardon@redhat.com> - 1:2.3.0-6.5.3
changelog:
  - CVE-2008-2237 OpenOffice.org WMF integer overflow
  - Resolves: rhbz#462644 integer overflow in WMF parser


author: David Tardon <dtardon@redhat.com> - 1:3.1.1-19.9
changelog:
  - Resolves: rhbz#642185 openoffice.org various flaws
  - CVE-2010-3450 directory traversal flaws in handling of XSLT jar filter
    descriptions and OXT extension files
  - CVE-2010-3451 Array index error by insecure parsing of broken rtf
    tables
  - CVE-2010-3452 Integer signedness error (crash) by processing certain
    RTF tags
  - CVE-2010-3453 Heap-based buffer overflow by processing *.doc files
    with WW8 list styles with specially-crafted count of list levels
  - CVE-2010-3454 Array index error by scanning document typography
    information of certain *.doc files
  - CVE-2010-3689 soffice insecure LD_LIBRARY_PATH setting


author: David Tardon <dtardon@redhat.com> - 1:3.2.1-19.10
changelog:
  - Resolves: rhbz#642185 openoffice.org various flaws
  - CVE-2010-4253 heap based buffer overflow in PPT import
  - CVE-2010-4643 heap based buffer overflow when parsing TGA files


author: David Tardon <dtardon@redhat.com> - 1:3.2.1-19.10.2
changelog:
  - Resolves: CVE-2012-1149 Integer overflows, leading to heap-buffer
    overflows in JPEG, PNG and BMP reader implementations


author: David Tardon <dtardon@redhat.com> - 1:3.2.1-19.10.3
changelog:
  - Resolves: CVE-2012-2334 Integer overflow leading to buffer overflow by
    processing invalid Escher graphics records length in the Powerpoint
    documents


author: David Tardon <dtardon@redhat.com> - 1:3.1.1-19.5.4
changelog:
  - Resolves: rhbz#642184 openoffice.org various flaws
  - CVE-2010-3450 directory traversal flaws in handling of XSLT jar filter
    descriptions and OXT extension files
  - CVE-2010-3451 Array index error by insecure parsing of broken rtf
    tables
  - CVE-2010-3452 Integer signedness error (crash) by processing certain
    RTF tags
  - CVE-2010-3453 Heap-based buffer overflow by processing *.doc files
    with WW8 list styles with specially-crafted count of list levels
  - CVE-2010-3454 Array index error by scanning document typography
    information of certain *.doc files
  - CVE-2010-3689 soffice insecure LD_LIBRARY_PATH setting


author: David Tardon <dtardon@redhat.com> - 1:3.2.1-19.5.5
changelog:
  - Resolves: rhbz#642184 openoffice.org various flaws
  - CVE-2010-4253 heap based buffer overflow in PPT import


author: David Tardon <dtardon@redhat.com> - 1:3.2.1-19.5.6
changelog:
  - Resolves: rhbz#642184 openoffice.org various flaws
  - CVE-2010-4643 heap based buffer overflow when parsing TGA files


author: Doug Ledford <dledford@redhat.com> - 3.2.6-2.el5
changelog:
  - Fix an incorrect use of #elif that makes later gcc versions give an error
  - Fix compile flags to include -fno-strict-aliasing that is also needed on
    later gcc versions


author: Doug Ledford <dledford@redhat.com> - 3.3.3-1.el5
changelog:
  - Update to latest upstream version
  - Own the var/cache/opensm directory
  - don't include the bare .so file in the libs package, put it in devel
  - Related: bz518218


author: Dennis Gregorovic <dgregor@redhat.com> - 4.3p2-26.el5_2.1
changelog:
  - CVE-2007-4752 - Prevent ssh(1) from using a trusted X11 cookie if creation of an
    untrusted cookie fails (#280361)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-9
changelog:
  - fix CVE-2007-3108 - side channel attack on private keys (#250581)
  - fix CVE-2007-5135 - off-by-one in SSL_get_shared_ciphers (#309881)
  - fix CVE-2007-4995 - out of order DTLS fragments buffer overflow (#321221)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8b-10
changelog:
  - compile with -march=z900 on s390 for performance improvements (#250818)
  - make ssl session ID matching strict (#233599)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12.1
changelog:
  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
  - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
    is called prematurely by application (#546707)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12.4
changelog:
  - do not disable SSLv2 in the renegotiation patch - SSLv2 does
    not support renegotiation
  - allow unsafe renegotiation on clients with SSL_OP_LEGACY_SERVER_CONNECT


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12.5
changelog:
  - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
    in the RHEL-5 and newer versions will crash in such case (#569774)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12.7
changelog:
  - fix CVE-2010-4180 - completely disable code for
    SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-19
changelog:
  - presort list of ciphers available in SSL (#688901)
  - accept connection in s_server even if getaddrinfo() fails (#561260)
  - point to openssl dgst for list of supported digests (#608639)
  - fix handling of future TLS versions (#599112)
  - added VeriSign Class 3 Public Primary Certification Authority - G5
    and StartCom Certification Authority certs to ca-bundle (#675671, #617856)
  - upstream fixes for the CHIL engine (#622003, #671484)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-20.1
changelog:
  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
    vulnerability and additional DTLS fixes (#771770)
  - fix for CVE-2011-4109 - double free in policy checks (#771771)
  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-21
changelog:
  - add known answer test for SHA2 algorithms (#740866)
  - make default private key length in certificate Makefile 2048 bits
    (can be changed with PRIVATE_KEY_BITS setting) (#745410)
  - fix incorrect return value in parse_yesno() (#726593)
  - added DigiCert CA certificates to ca-bundle (#735819)
  - added a new section about error states to README.FIPS (#628976)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-22.1
changelog:
  - fix problem with the SGC restart patch that might terminate handshake
    incorrectly
  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
  - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-26.1
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use __secure_getenv() everywhere instead of getenv() (#839735)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-27.4
changelog:
  - fix CVE-2014-0221 - recursion in DTLS code leading to DoS
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-33
changelog:
  - fix CVE-2014-8275 (without introduction of CVE-2015-0286) - various
    certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Kai Engert <kaie@redhat.com> 0.9.8e-34
changelog:
  - Rebase ca-bundle.crt to the upstream version 2.4 with legacy
    modifications. For compatibility reasons, several CA certificates with
    RSA sizes of 1024 bits are still included.
  - Add a patch to the source RPM that documents the changes from the
    upstream version.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-35
changelog:
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-38
changelog:
  - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
  - disable SSLv2 in the generic TLS method (can be reenabled
    by setting environment variable OPENSSL_ENABLE_SSL2)


author: Tomas Mraz <tmraz@redhat.com> 0.9.7a-9
changelog:
  - fix CVE-2006-2937 - mishandled error on ASN.1 parsing (#207276)
  - fix CVE-2006-2940 - parasitic public keys DoS (#207274)
  - fix CVE-2006-3738 - buffer overflow in SSL_get_shared_ciphers (#206940)
  - fix CVE-2006-4343 - sslv2 client DoS (#206940)


author: Steve Grubb <sgrubb@redhat.com> - 2.6.14-1
changelog:
  - new upstream release
  Resolves: #450125 openswan and strongswan fail to interoperate with IKEv2
  Resolves: #450126 openswan should negotiate CCM algorithm
  Resolves: #450127 openswan doesn't accept null esp auth alg
  Resolves: #450128 openswan logging segfault when phase2alg=null
  Resolves: #450129 openswan IKEv2 crashes when interoperating with racoon2
  Resolves: #450334 openswan doesn't delete expired SA's


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-6.2
changelog:
  - fix insecure dropping of priviledges in pam_xauth
    and pam_mail - CVE-2010-3316 (#637898), CVE-2010-3435 (#641335)
  - fix insecure executing of scripts with user supplied environment
    variables in pam_namespace - CVE-2010-3853 (#643043)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.14-1.el5_2.1
changelog:
  - add backported fix for ccache permissions bypass when the "existing_ticket"
    option is used (CVE-2008-3825, #462112)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.14-13
changelog:
  - add patch to add the "chpw_prompt" option, to allow the older behavior
    of attempting a password-change during authentication if libkrb5 detects
    an expired password, based on patch from Olivier Fourdan (#509092)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.14-14
changelog:
  - backport the "multiple_ccaches" option from HEAD, requiring that it
    be enabled to not immediately remove an old ccache when asked to create
    a new one (#463417)


author: Nalin Dahyabhai <nalin@redhat.com> 2.2.14-15
changelog:
  - update backport for selecting which key to use for validation so that it
    prefers services with the local host name as the instance, from HEAD (more
    of #450776)


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.8.8-32.el5.5
changelog:
  - CVE-2010-2761 CVE-2010-4410 perl: CGI module multiple issues fixed by update
    of CGI module to 3.54
  - Resolves: rhbz#743626


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.8.8-32.el5.6
changelog:
  - CVE-2010-2761 CVE-2010-4410 perl: CGI module multiple issues fixed by security
    patch based on commit from version 3.50
  - Related: rhbz#743626


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-40
changelog:
  - Fix CVE-2012-5195 heap buffer overrun at repeatcpy (Resolves: rhbz#915690)
  - Fix CVE-2012-5526 newline injection due to improper CRLF escaping in
    Set-Cookie and P3P headers (Resolves: rhbz#915690)
  - Fix CVE-2012-6329 possible arbitrary code execution via Locale::Maketext
    (Resolves: rhbz#915690)
  - Fix CVE-2013-1667 DoS in rehashing code (Resolves: rhbz#915690)


author: Joe Orton <jorton@redhat.com> 5.1.6-20.el5_2.1
changelog:
  - add security fixes for CVE-2007-5898, CVE-2007-4782, CVE-2007-5899,
    CVE-2008-2051, CVE-2008-2107, CVE-2008-2108 (#445923)


author: Joe Orton <jorton@redhat.com> 5.1.6-23.1.el5
changelog:
  - add security fixes for CVE-2008-3658, CVE-2008-3660,
    CVE-2008-5498, CVE-2008-5557, CVE-2008-5814, and mbstring
    func_overload issue (#487369)


author: Joe Orton <jorton@redhat.com> - 5.1.6-24.3
changelog:
  - add security fixes for CVE-2009-2687, CVE-2009-3291, CVE-2009-3292,
    CVE-2009-3546 CVE-2009-4017 (#541597)
  - add build fix for mysqli on some biarch systems (#543469)


author: Joe Orton <jorton@redhat.com> - 5.1.6-27.1
changelog:
  - add security fixes for CVE-2010-1917, CVE-2010-3065, CVE-2010-2531,
    CVE-2010-1128, CVE-2010-0397 (#626735)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 5.1.6-27.4
changelog:
  - add security fixes for CVE-2011-4885, CVE-2011-4566, CVE-2011-0708,
    CVE-2011-1148, CVE-2011-1466, CVE-2011-1469, CVE-2011-2202 (#769756)


author: Remi Collet <rcollet@redhat.com> - 5.1.6-45
changelog:
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
  - xmlrpc: fix buffer overflow in date parser #1155607


author: Joe Orton <jorton@redhat.com> - 5.3.3-1.2
changelog:
  - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148,
    CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470,
    CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740733)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-23
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-25
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Peter Vrabec <pvrabec@redhat.com> - 0.7.3-3
changelog:
  - fix source url
  - move postun to preun, mainly because of install-info
  - add pinentry-gtk-2 entry into gtk files section


author: Ryan O'Hara <rohara@redhat.com> 0.8.4-25
changelog:
  - Resolves: #739223 - ipvsadm errors should not be fatal
  - Resolves: #786364 - reread config can cause lvsd to segfault


author: Phil Knirsch <pknirsch@redhat.com> - 0.99.3-9.el5
changelog:
  - Fixed a problem with the sysconfig patch (#438877)
  - Corrected the fix for the stale /.suspended file (#270861)
  - Resolves: #438877,#270861


author: Dan Walsh <dwalsh@redhat.com> 1.33.12-14.4
changelog:
  - Add semodule -DB support
  Resolves: #493115
  - Add ~/www ~/web to restorecond.conf
  Resolves: #458687
  - Fix sort order for portsPage
  Resolves: #468170
  - Allow <<none>> in homedir 
  Resolves: #354361


author: Miroslav Grepl <mgrepl@redhat.com> 1.33.12-14.7
changelog:
  - Remove semanage translation functionality
  Resolves: #460970
  - Fix semanage port add/delete problems
  Resolves: #505521
  - Fix instances of #!/usr/bin/env python in policycoreutils-gui
  Resolves: #521298
  - Fix semanage command does not support -node option
  Resolves: #527487


author: Marek Kasik <mkasik@redhat.com> - 0.5.4-4.4.el5_4.10
changelog:
  - Add poppler-0.5.4-JBIG2-segment-reading.patch to
    fix reading of arithmetically encoded JBIG2 images with
    unknown length.
  - Resolves: #528147


author: Marek Kasik <mkasik@redhat.com> - 0.5.4-4.4.el5_4.11
changelog:
  - Fixes various flaws addressed in bugs #526637, #526893 and #526915
    which were tracked in #527403.
  - Resolves: #527403


author: Marek Kasik <mkasik@redhat.com> - 0.5.4-4.4.el5_5.12
changelog:
  - Add poppler-0.5.4-current-stream.patch
  - Use customized getPos() function for JBIG2Stream
  - Resolves: #624702


author: Marek Kasik <mkasik@redhat.com> - 0.5.4-4.4.el5_5.14
changelog:
  - Add poppler-0.5.4-CVE-2010-3702.patch
      (Properly initialize parser)
  - Add poppler-0.5.4-CVE-2010-3704.patch
      (Fix crash in broken pdf (code < 0))
  - Resolves: #639839


author: Jindrich Novy <jnovy@redhat.com> - 4.4.2.3-19
changelog:
  - fix CVE-2010-2059, fails to drop SUID/SGID bits on package upgrade (#626707)
  - fix SELinux memory leak (#627630), patch from Florian Festi


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-26
changelog:
  - Add support for XZ-compressed sources and patches to rpmbuild (#620674)
  - Avoid unnecessary assert-death when closing NULL fd (#573043)
  - Add scriptlet error notification callbacks (#533831)


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-28
changelog:
  - Proper region tag validation on package/header read (CVE-2012-0060)
  - Double-check region size against header size (CVE-2012-0061)
  - Validate negated offsets too in headerVerifyInfo() (CVE-2012-0815)


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-34
changelog:
  - Fix segfault on rpmdb addition when header unload fails (#706935)
  - Fix segfault on invalid OpenPGP packet (#743203)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-35
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163057)


author: Thomas Woerner <twoerner@redhat.com> 2:2.3.3-2.1
changelog:
  - fixed postfix privilege problem with symlinks in the mail spool directory
    (CVE-2008-2936)
    Resolves: rhbz#456717


author: Tom Lane <tgl@redhat.com> 8.1.11-1.el5_1.1
changelog:
  - Update to PostgreSQL 8.1.11 to fix CVE-2007-4769, CVE-2007-4772,
    CVE-2007-6067, CVE-2007-6600, CVE-2007-6601
  Resolves: #427137
  - Use tzdata package's data files instead of private copy, so that
    postgresql-server need not be turned for routine timezone updates


author: Tom Lane <tgl@redhat.com> 8.1.18-1.el5_4.1
changelog:
  - Update to PostgreSQL 8.1.18 to fix CVE-2009-0922, CVE-2009-3230,
    and assorted other bugs described at
    http://www.postgresql.org/docs/8.1/static/release.html
  Resolves: #525284


author: Tom Lane <tgl@redhat.com> 8.1.21-1.el5_5.1
changelog:
  - Update to PostgreSQL 8.1.21 to fix CVE-2010-1169, CVE-2010-1170,
    CVE-2009-4136, CVE-2010-0733, CVE-2010-0442, and assorted other bugs
    described at
    http://www.postgresql.org/docs/8.1/static/release.html
  Resolves: #586058


author: Tom Lane <tgl@redhat.com> 8.1.22-1.el5_5.1
changelog:
  - Update to PostgreSQL 8.1.22, for various fixes described at
    http://www.postgresql.org/docs/8.1/static/release.html
    including the fix for CVE-2010-3433
  Resolves: #639931


author: Tom Lane <tgl@redhat.com> 8.1.23-1.el5_6.1
changelog:
  - Update to PostgreSQL 8.1.23, for various fixes described at
    http://www.postgresql.org/docs/8.1/static/release.html
    This is the last upstream release in the 8.1.x series.
  - Ensure we don't package any .gitignore files from the source tarball
  - Back-port upstream fix for CVE-2010-4015
  Resolves: #672632


author: Pavel Raiskup <praiskup@redhat.com> - 8.1.23-9
changelog:
  - fix #1065840: CVE-2014-0060, CVE-2014-0061, CVE-2014-0063, CVE-2014-0064,
    CVE-2014-0065
  - better incorporate strlcpy function (upstream git diff c92f7e..062421)


author: Tom Lane <tgl@redhat.com> 8.4.7-1
changelog:
  - Update to PostgreSQL 8.4.7, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-7.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-6.html
    including the fix for CVE-2010-4015
  Resolves: #672637
  - Ensure we don't package any .gitignore files from the source tarball


author: Tom Lane <tgl@redhat.com> 8.4.9-1
changelog:
  - Update to PostgreSQL 8.4.9, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-9.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-8.html
    including the fix for CVE-2011-2483
  Resolves: #740740


author: Tom Lane <tgl@redhat.com> 8.4.11-1
changelog:
  - Update to PostgreSQL 8.4.11, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-10.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #812077


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830723


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852018


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830724


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852019


author: Jozef Mlich <jmlich@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017833)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065839) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Tom Lane <tgl@redhat.com> 8.4.4-1.el5_5.1
changelog:
  - Update to PostgreSQL 8.4.4, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-4.html
    including fixes for CVE-2010-1169 and CVE-2010-1170
  Resolves: #586060


author: Tom Lane <tgl@redhat.com> 8.4.5-1.el5_5.1
changelog:
  - Update to PostgreSQL 8.4.5, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-5.html
    including the fix for CVE-2010-3433
  Resolves: #639933


author: Tom Lane <tgl@redhat.com> 8.4.7-1.el5_6.1
changelog:
  - Update to PostgreSQL 8.4.7, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-7.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-6.html
    including the fix for CVE-2010-4015
  Resolves: #672636
  - Ensure we don't package any .gitignore files from the source tarball


author: Tom Lane <tgl@redhat.com> 8.4.9-1.el5_7.1
changelog:
  - Update to PostgreSQL 8.4.9, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-9.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-8.html
    including the fix for CVE-2011-2483
  Resolves: #740739


author: James Antill <james.antill@redhat.com> - 2.4.3-23
changelog:
  - Fix gettext problem
  - Resolves: rhbz#444088
  - Add socketmodule constants (bug #436560)
  - Fix xmlrpclib marchal problem (python bug #1739842)
  - Fix fd leak in urllib2
  - Resolves: rhbz#460694


author: James Antill <james.antill@redhat.com> - 2.4.3-24
changelog:
  - Remove unapproved socket constants and xmlrpclib fixes.
  - Resolves: rhbz#444088
  - Resolves: rhbz#460694


author: Jan iankko Lieskovsky <jlieskov@redhat.com> - 2.4.3-24.el5_3.6
changelog:
  - Fix all of the low priority security bugs:
  - Resolves: rhbz#486351
  - Multiple integer overflows in python core (CVE-2008-2315)
  - Resolves: 455008
  - PyString_FromStringAndSize does not check for negative size values (CVE-2008-1887)
  - Resolves: 443810
  - Multiple integer overflows discovered by Google (CVE-2008-3143)
  - Resolves: 455013
  - Multiple buffer overflows in unicode processing (CVE-2008-3142)
  - Resolves: 454990
  - Potential integer underflow and overflow in the PyOS_vsnprintf C API function (CVE-2008-3144)
  - Resolves: 455018
  - imageop module multiple integer overflows (CVE-2008-4864)
  - Resolves: 469656
  - stringobject, unicodeobject integer overflows (CVE-2008-5031) 
  - Resolves: 470915
  - integer signedness error in the zlib extension module (CVE-2008-1721)
  - Resolves: 442005
  - off-by-one locale.strxfrm() (possible memory disclosure) (CVE-2007-2052)
  - Resolves: 235093
  - imageop module heap corruption (CVE-2007-4965)
  - Resolves: 295971


author: David Malcolm <dmalcolm@redhat.com> - 2.4.3-41
changelog:
  - backport support for the "no_proxy" environment variable to the urllib and
  urllib2 modules (patches 204 and 205, respectively)
  Resolves: rhbz#549372


author: David Malcolm <dmalcolm@redhat.com> - 2.4.3-42
changelog:
  - fix test_pyclbr to match the urllib change in patch 204 (patch 206)
  - allow the "no_proxy" environment variable to override "ftp_proxy" in
  urllib2 (patch 207)
  - fix typos in names of patches 204 and 205
  Related: rhbz#549372


author: David Malcolm <dmalcolm@redhat.com> - 2.4.3-44
changelog:
  - add patch adapted from upstream (patch 208) to add support for building
  against system expat; add --with-system-expat to "configure" invocation; remove
  embedded copy of expat-1.95.8 from the source tree during "prep"
  - ensure pyexpat.so gets built by explicitly listing all C modules in the
  payload in %files, rather than using dynfiles
  Resolves: CVE-2009-3720
  - backport three security fixes to 2.4 (patches 209, 210, 211):
  Resolves: CVE-2011-1521
  Resolves: CVE-2011-1015
  Resolves: CVE-2010-3493


author: David Malcolm <dmalcolm@redhat.com> - 2.4.3-46.el5_8.1
changelog:
  - distutils.commands.register: create ~/.pypirc securely
  Resolves: CVE-2011-4944
  - send encoding in SimpleHTTPServer.list_directory to protect IE7 against
  potential XSS attacks
  Resolves: CVE-2011-4940
  - oCERT-2011-003: add -R command-line option and PYTHONHASHSEED environment
  variable, to provide an opt-in way to protect against denial of service
  attacks due to hash collisions within the dict and set types
  Resolves: CVE-2012-1150


author: Nima Talebi <nima@it.net.au> - 3.10.8-1
changelog:
  - New Upstream release.
  - Big-endian and little-endian approved.
  - Packaged unit-test to tarball.
  - Rewritten unit-test to be able to run as non-root user, where it will not
    try to read /dev/mem.
  - Added two dmidump data files to the unit-test.


author: Monty <cmontgom@redhat.com> - 0.4.9-0.13.20080908
changelog:
  - Correct versioning typo in spec
  - Remove unused codecs from build (allowing a stright configure to succeed)


author: Uri Lublin <uril@redhat.com> - 0.3.0-54.el5_5.2
changelog:
  - Fix unsafe accesses
    + spice: drop libpng from windows components (537849)
    + libspice: fix unsafe guest data accessing
  Resolves: #568719
    + fix unsafe free() call.
  Resolves: #568723
    + spice server: fix unsafe cursor items handling.
  Resolves: #568719


author: Uri Lublin <uril@redhat.com> - 0.3.0-56.el5
changelog:
  - Fix unsafe accesses
    + spice: drop libpng from windows components (537849)
    + libspice: fix unsafe guest data accessing
  Resolves: #568720
    + fix unsafe free() call.
  Resolves: #568724
    + spice server: fix unsafe cursor items handling.
  Resolves: #568720


author: Jaroslav Reznik <jreznik@redhat.com> - 4.2.1-1.1
changelog:
  - Resolves: #737815, qt/harfbuzz buffer overflow, CVE-2011-3193
  - Resolves: #234633, UTF-8 overlong sequence decoding vulnerability, CVE-2007-0242


author: Adam Tkac <atkac redhat com> - 0.98.6-7.1
changelog:
  - fix CVE-2011-3323
  - fix CVE-2011-3324
  - fix CVE-2011-3325
  - fix CVE-2011-3326
  - fix CVE-2011-3327
  - fix CVE-2012-0249
  - fix CVE-2010-1674


author: Petr Pisar <ppisar@redhat.com> - 1:3.13-6
changelog:
  - Do not use real domains in warnquota example (Resolves: #680429)
  - Use /proc/mounts for mountpoint scanning (Resolves: #689822)
  - Use rq_bsize to convert quotas transferred by RPC (bug #667360)
  - Make RPC block factor dynamic (bug #667360)


author: Chris Feist <cfeist@redhat.com> - 2.0.50-1
changelog:
  - Extra checks from the oracle agents have been removed.
  - Several fixes to prevent DOS attacks through insecure use of /tmp/ files have
    been implemented.
  - vm.sh now uses libvirt
  - Users can now define an explicit service processing order when
    central_processing is enabled
  - Resolves: rhbz#470917 rhbz#412911 rhbz#468691 rhbz#492828


author: Chris Feist <cfeist@redhat.com> - 2.0.51-1
changelog:
  - In some cases virtual machines will be restarted after a successful migration
    when the cluster configuration is updated.
  - Resolves: rhbz#505340


author: Chris Feist <cfeist@redhat.com> - 2.0.52-1
changelog:
  - When vm.sh does a status check and gets 'no state' it is now treated as a
    running state.
  - Resolves: rhb#514044


author: Lon Hohberger <lhh@redhat.com> - 2.0.52-19
changelog:
  - Fix changelog format
  - rgmanager: Fix reference count handling
    (fix_reference_count_handling.patch)
    Resolves: rhbz#692771


author: Lon Hohberger <lhh@redhat.com> - 2.0.52-20
changelog:
  - resource-agents: Improve LD_LIBRARY_PATH handling by SAP*
    (resource_agents_improve_ld_library_path_handling_by_sap*.patch)
    Resolves: rhbz#710637


author: Lon Hohberger <lhh@redhat.com> - 2.0.52-21
changelog:
  - rgmanager: Fix bad passing of SFL_FAILURE up
    (fix_bad_passing_of_sfl_failure_up.patch)
    Resolves: rhbz#711521


author: Milan Zazrivec <mzazrivec@redhat.com> 0.4.20-33
changelog:
  - Resolves: #566479, include new Red Hat CA certificate
  - Related: #495680 - send 3 more dmi keys to rhnparent


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 3.0.6-2
changelog:
  - Remove BuildRequires dependency on popt-devel, until the package
    is being shipped with RHEL-5 (resolve build issues)


author: Vojtech Vitek <vvitek@redhat.com> - 3.0.6-3
changelog:
  - Add upstream patch to fix CVE-2011-1097 - Incremental file-list
    corruption due to temporary file_extra_cnt increments
    Resolves: #688923


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-5.el5_3.7
changelog:
  - security fixes. (#505087)
  - CVE-2007-1558: APOP password disclosure vulnerability.
  - CVE-2009-0642: Incorrect checks for validity of X.509 certificates.
  - CVE-2009-1904: DoS vulnerability in BigDecimal.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-5.el5_4.8
changelog:
  - Fix a regression of the fix in BigDecimal that suppress the zero after
    the decimal point in Float. (#546245)


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-19.el5_6.1
changelog:
  - Address CVE-2011-1004 "Symlink race condition by removing directory trees in
    fileutils module"
    * ruby-1.8.7-CVE-2011-1004.patch
  - Address CVE-2011-1005 "Untrusted codes able to modify arbitrary strings"
    * ruby-1.8.7-CVE-2011-1005.patch
  - Address CVE-2011-0188 "memory corruption in BigDecimal on 64bit platforms"
    * ruby-1.8.7-CVE-2011-0188.patch
  - Address CVE-CVE-2010-0541 "Ruby WEBrick javascript injection flaw"
    * ruby-1.8.7-CVE-2010-0541.patch
  - Address CVE-CVE-2009-4492 "ruby WEBrick log escape sequence"
    * ruby-1.8.6-CVE-2009-4492.patch
  - Resolves: rhbz#709957


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-20.1
changelog:
  - Address CVE-2011-4815 "DoS (excessive CPU use) via hash meet-in-the-middle
    attacks (oCERT-2011-003)"
    * ruby-1.8.7-CVE-2011-4815.patch
    - Resolves: rhbz#768829


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-22.1
changelog:
  - Properly initialize the random number generator when forking new process
    * ruby-1.8.7-CVE-2011-3009.patch
    - Related: rhbz#768829


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-25
changelog:
  - Resolve buffer overflow causing gem installation issues.
    * ruby-1.8.7-syck-avoid-buffer-overflow.patch
    - Resolves: rhbz#834381


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-26
changelog:
  - $SAFE escaping vulnerability about Exception#to_s / NameError#to_s
    * ruby-1.8.7-p371-CVE-2012-4481.patch
    - Resolves: rhbz#867750
  - unintentional file creation caused by inserting an illegal NUL character
    * ruby-1.8.6-CVE-2012-4522-io.c-rb_open_file-should-check-NUL-in-path.patch
    - Resolves: rhbz#867750


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-27
changelog:
  - unintentional file creation caused by inserting an illegal NUL character
    * ruby-1.8.6-CVE-2012-4522-io.c-pipe_open-command-name-should-not-contain-null-.patch
    - Related: rhbz#867750


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-28
changelog:
  - Addresses entity expansion DoS vulnerability in REXML.
    * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch
  - Resolves: rhbz#915377


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-29
changelog:
  - Fix regression introduced by fix for entity expansion DOS vulnerability
    in REXML (https://bugs.ruby-lang.org/issues/7961)
    * ruby-2.0.0-add-missing-rexml-require.patch
  - Related: rhbz#915377


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-30
changelog:
  - hostname check bypassing vulnerability in SSL client.
    * ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch
    - Resolves: rhbz#979297


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-31
changelog:
  - Fix regression introduced by CVE-2013-4073
    https://bugs.ruby-lang.org/issues/8575
    * ruby-2.0.0-p255-Fix-SSL-client-connection-crash-for-SAN-marked-critical.patch
    - Related: rhbz#979297


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-5.el5_1.1
changelog:
  - security fix for CVE-2007-5162 and CVE-2007-5770
  - ruby-1.8.5-CVE-2007-5162.patch: fix issues that is insufficient verification
    of SSL certificate. (#320331)
  - Fix the multilib regression issue.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-5.el5_2.1
changelog:
  - security fixes. (#451928)
  - CVE-2008-2662: Integer overflow in rb_str_buf_append().
  - CVE-2008-2663: Integer overflow in rb_ary_store().
  - CVE-2008-2664: Unsafe use of alloca in rb_str_format().
  - CVE-2008-2725: Integer overflow in rb_ary_splice().
  - CVE-2008-2726: Integer overflow in rb_ary_splice().


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-5.el5_2.4
changelog:
  - security fixes. (#461590)
  - CVE-2008-3655: multiple insufficient safe mode restrictions.
  - CVE-2008-3656: WEBrick DoS vulnerability (CPU consumption).
  - CVE-2008-3657: missing "taintness" checks in dl module.
  - CVE-2008-3905: use of predictable source port and transaction id in DNS
                   requests done by resolv.rb module.
  - CVE-2008-3443: Memory allocation failure in Ruby regex engine
                   (remotely exploitable DoS).
  - CVE-2008-3790: DoS vulnerability in the REXML module.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-5.el5_2.4
changelog:
  - security fixes. (#461590)
  - CVE-2008-3655: multiple insufficient safe mode restrictions.
  - CVE-2008-1145: WEBrick DoS vulnerability (CPU consumption).
  - CVE-2008-3657: missing "taintness" checks in dl module.
  - CVE-2008-3905: use of predictable source port and transaction id in DNS
                   requests done by resolv.rb module.
  - CVE-2008-3443: Memory allocation failure in Ruby regex engine
                   (remotely exploitable DoS).
  - CVE-2008-3790: DoS vulnerability in the REXML module.


author: Akira TAGOH <tagoh@redhat.com> - 1.8.5-5.el5_2.6
changelog:
  - security fix (#470262)
  - CVE-2008-4310: real fix for CVE-2008-3656. original patch named as fix for
                   CVE-2008-3656 actually fixed different issue (CVE-2008-1145),
                   hence we are providing correct patch and renaming original
                   patch to refer to proper CVE.


author: Simo Sorce <ssorce@redhat.com> 3.0.28-0.el5.7
changelog:
  - Add another 2 patches to solve 429024 completely, as some cases were not
    covered:
    - Fix domain trusts while running as a DC
    - Fix credential chain with windows 2008
  - Make some configure flag explicit even if they are on by default so that we
    can catch build errors if something is wrong instead of silently missing
    features supposed to be compiled in
  - related: #429024


author: Simo Sorce <ssorce@redhat.com> 3.0.28-0.el5.8
changelog:
  - Yet another 2 patches for regressions related to operations on a DC with
    trusted domains. Fiux idmap with legacy configuration options, and fix the
    pam module, pam logins were broken for trusted domains
  - related: #429024


author: Simo Sorce <ssorce@redhat.com> 3.0.28-1.el5_2.1
changelog:
  - Security fix for CVE-2008-1105
  - Fix join verification
  - Fix smb signing
  - resolves: CVE-2008-1105
  - resolves: #447380
  - resolves: #444637


author: Guenther Deschner <gdeschner@redhat.com> 3.0.33-3.15.el5
changelog:
  - Security Release, fixes CVE-2009-1888, CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906
  - resolves: #526660


author: Guenther Deschner <gdeschner@redhat.com> - 3.6.23-10
changelog:
  - resolves: #1322685 - Fix CVE-2015-5370
  - resolves: #1322685 - Fix CVE-2016-2110
  - resolves: #1322685 - Fix CVE-2016-2111
  - resolves: #1322685 - Fix CVE-2016-2112
  - resolves: #1322685 - Fix CVE-2016-2115
  - resolves: #1322685 - Fix CVE-2016-2118 (Known as Badlock)


author: - Andreas Schneider <asn@redhat.com> - 3.6.6-0.134
changelog:
  - Check for system libtevent and require version 0.9.18.
  - Use tevent epoll backend in winbind.
  - resolves: #869295


author: - Andreas Schneider <asn@redhat.com> - 3.6.6-0.135
changelog:
  - Fix PIDL parsing with newer versions of gcc.
  - Fix dereferencing a unique pointer in the WKSSVC server.
  - resolves: #982484


author: - Andreas Schneider <asn@redhat.com> - 3.6.6-0.136
changelog:
  - resolves: #984807 - CVE-2013-4124: DoS via integer overflow when reading
                        an EA list


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.6-0.140
changelog:
  - resolves: #1112150 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1112150 - CVE-2014-3493: DoS in smbd with unicode path names.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.31.el5_2.1
changelog:
  - Remove RPATH from shared libraries in sblim-cmpi-{dns,fsvol,network,
    nfsv3,nfsv4,samba,syslog}
    and create appropriate record in /etc/ld.so.conf.d (CVE-2008-1951)
    Resolves: #446859


author: Mike Christie <mchristie@redhat.com> - 0.0-5.20080917snap
changelog:
  - Rebase to latest upstream snapshot to include tgt-admin and static config.
  - When doing a "tgtd stop" kill running targets if run level indicates
  system is shutting down or restarting.


author: Mike Christie <mchristie@redhat.com> - 0.0-6.20091205snap.1
changelog:
  - Rebase to latest upstream snapshot from Dec 5th 2009 (git id
  97832d8dcd00202a493290b5d134b581ce20885c)
  - 545785 fix segfault when running tgtadm --mode connection --op delete
  - 545786 fix tgtd crash under load
  - 531041 fix tgt segfault on 31st target creation


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-200
changelog:
  - Allow ldap to connect to sasl
  - avc denials during samba active directory join
  Resolves: #474852
  - samba - winbind - periodic avc denials
  Resolves: #474854
  - "Syntax error on line 1 ' [type=SQUOTE]" upgrading selinux-policy-devel
  Resolves: #474868
  - missing policy
  Resolves: #475273


author: Dan Walsh <dwalsh@redhat.com> 2.4.6-254
changelog:
  - Add ipsec_match_default_spd back into userdomain
  - Allow sysadm_t to execute setkey and racoon executables
  - Dontaudit write of logwatch to etc_t
  - Allow samba as domain controller to change passwords
  Resolves: #475562


author: Miroslav Grepl <mgrepl@redhat.com> 2.4.6-279.el5_5.2
changelog:
  - Allow aisexec to read and write unconfined user SysV sempaphores and shared memory segments
  Resolves: #644821


author: Miroslav Lichvar <mlichvar@redhat.com> 8.13.8-6.el5
changelog:
  - fix verification of SSL certificate with NUL in name (#553618, CVE-2009-4565)
  - do not accept localhost.localdomain as valid address from smtp (#449391)
  - skip colon separator when parsing service name in ServiceSwitchFile (#512871)
  - exit with non-zero error code when free space is low (#299951)
  - fix -qG description in man page (#250552)
  - fix comments in sendmail.mc to use correct certs path (#244012)
  - add MTA to provides (#494408)
  - fix %dist macro use (#440616)
  - compile with -fno-strict-aliasing
  - skip t-sem test as it doesn't allow parallel testing


author: John Dennis <jdennis@redhat.com> - 2.0.5-2
changelog:
  - Resolve: bug #437857: python error in system shutdown
  	- Resolve: bug #436564: socket.getsockopt() on ppc generates exception


author: John Dennis <jdennis@redhat.com> - 2.0.5-3
changelog:
  - Resolve: bug #436564: socket.getsockopt() on ppc generates exception
  	  Fix typo in original setroubleshoot-get_credentials.patch


author: Ondrej Vasik <ovasik@redhat.com> 2.5.58-5.el5
changelog:
  - Added uidgid pair (59:59) for tss (#457593)
  - Added uidgid pair (52:52) for puppet (#471918)
  - Added uidgid pair (17:17) for pkiuser (#476317)
  - Added gid (:36) for kvm (#481021)
  - Added uid (36:) for vdsm (#481021)
  - Change reserved shell for news to /sbin/nologin(#449555)
  - increase consistency of behaviour between csh and bash(#199817)


author: Ondrej Vasik <ovasik@redhat.com> 2.5.58-6.el5
changelog:
  - due to different sourcing order, move umask setting for csh
    to csh.login for login shells(#199817)
  - do not show error output from profile.d shell scripts in
    noninteractive bash sessions(#199817)


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.17-19
changelog:
  - fix sequence of arg. parsing and execution in faillog
  - fix ACL support
  - do not alter UIDs over 2147483647 in pwconv and pwunconv
    Resolves: #619150, #673091, #681020


author: Peter Vrabec <pvrabec@redhat.com> 2:4.0.17-20
changelog:
  - prevent faillog to grow after setmax operation(-m)
  - man page adjustments
  - make useradd delete lock files on failure
    Resolves: #670364, #688892, #715214, #709605


author: Troy Dawson <dawson@fnal.gov> - 5.1-1
changelog:
  - Moved everything to 51
  - Added the new redhat rpm key
  - Changed sources to be 5rolling instead of 50


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.60
changelog:
  - Add ethtool pause, coalesce and ring (-a, -c, -g) options to network plugin
    Resolves: bz726421
  - Update MRG grid plugin to collect additional logs and configuration
    Resolves: bz641020


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.61
changelog:
  - Make single threaded operation default and add --multithread to override
    Resolves: bz708346
  - Support multiple possible locations of VRTSexplorer script
    Resolves: bz565996
  - Collect wallaby dump and inventory information in mrggrid plugin
    Resolves: bz641020


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.62
changelog:
  - Always log plugin exceptions that are not raised to the interpreter
    Resolves: bz717480
  - Ensure relative symlink targets are correctly handled when copying
    Resolves: bz717962
  - Correctly handle libxml2 parser exceptions when reading cluster.conf
    Resolves: bz750573
  - Update Red Hat Certificate System plugin for current versions
    Resolves: bz627416


author: Yuval Kashtan <ykashtan@redhat.com> - 2.2-1.el5
changelog:
  - changed plugin location to /usr/lib{,64}/mozilla/plugins
  - still need to remove nspluginwrapper or edit its conf file to ignore libnsISpicec*
  - now using mkstemp to create temporary ca file and delete it afterwards.
  - resolve: #573367, #570165


author: Jiri Skala <jskala@redhat.com> 7:2.6.STABLE21-4
changelog:
  - Resolves: #521926 - squid 'stop after stop' is not LSB compliant
  - Resolves: #496170 - Add arp filter option
  - Resolves: #516245 - negotiate support not enabled in squid
  - Resolves: #538738 - Squid accelerator mode works only if port 80 is opened
  - Resolves: #470843 - Squid 'error_map' does not work when used 'Accep-Encoding: gzip'


author: Michal Luscon <mluscon@redhat.com> 7:2.6.STABLE21-7
changelog:
  - Resolves: #1134976 - CVE-2013-4115 buffer overflow when processing overly long DNS names
  - Resolves: #1134976 - CVE-2014-3609 assertion failure in header processing


author: Michal Hlavinka <mhlavink@redhat.com> - 1.4.8-19
changelog:
  - patch for CVE-2010-2813 modified wrong file (#808598)
  - correct requirement is mod_php not php (#789353)
  - comply with RFC2822 line length limits (#745469)
  - document that SELinux boolean httpd_can_sendmail needs to be 
    turned on (#745380)
  - add support for big UIDs on 32bit machines (#450780)
  - do not corrupt html attachments (#359791)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.4.8-5.1
changelog:
  - don't transmit cookies under non-SSL connections if the session
    is started under an SSL (https) connection
  - Resolves: CVE-2008-3663, #468398
  - fix release number with respect to Z-stream nvr policy


author: Michal Hlavinka <mhlavink@redhat.com> - 1.4.8-5.11
changelog:
  - fix: CVE-2010-1637 : Port-scans via non-standard POP3 server ports in 
    Mail Fetch plugin
  - fix: CVE-2010-2813 : DoS (disk space consumption) by random IMAP login 
    attempts with 8-bit characters in the password
  - fix: CVE-2010-4554 : Prone to clickjacking attacks
  - fix: CVE-2010-4555 : Multiple XSS flaws
  - fix: CVE-2011-2023 : XSS in <style> tag handling
  - fix: CVE-2011-2752 : CRLF injection vulnerability
  - fix: CVE-2011-2753 : CSRF in the empty trash feature and in Index Order page


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-35
changelog:
  - Resolves: rhbz#707340 - latest sssd fails if ldap_default_authtok_type is
  -                         not mentioned
  - Resolves: rhbz#707574 - SSSD's async resolver only tries the first
  -                         nameserver in /etc/resolv.conf


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-37
changelog:
  - Reverts:  rhbz#680443 - Dynamic DNS update fails if multiple servers are
  -                         given in ipa_server config option


author: Deepak Bhole <dbhole@redhat.com> 1.2.9-4jpp.7
changelog:
  - Resolves: rhbz#1092457
  - CVE-2014-0114: Fixed ClassLoader manipulation vulnerability
  - Added dist tag to release


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-3.el5_3.1
changelog:
  - audit patch rediff (one chunk failed to apply due to fuzz=0)
  - Fix for incorrect handling of groups in Runas_User (#481720)
    Resolves: #481820


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-4
changelog:
  - audit patch rediff (one chunk failed to apply due to fuzz=0)
  - Fix for incorrect handling of groups in Runas_User (#481720)
    Resolves: #481821


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-11
changelog:
  - backported selinux support from 1.7.4p5 (#477185, #673157)
  - fixed bug in Runas_Spec group matching (#627543)
  - disable `sudo -l' output word wrapping if the output
    is piped (#697111)
  - fixed overwriting of errno after execve failure (#673157)
  - fixed segmentation fault (#673072)
  - add a sudoers entry to the nsswitch.conf file
    on install (and delete it on uninstall) (#617061)
    Resolves: rhbz#697111
    Resolves: rhbz#673157
    Resolves: rhbz#673072
    Resolves: rhbz#627543
    Resolves: rhbz#617061
    Resolves: rhbz#477185


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-14.1
changelog:
  - don't remove the sudoers: line from nsswitch.conf on update
  - use safe temporary file for nsswitch.conf
  - call restorecon after modifying nsswitch.conf
  - fixed command escaping
  - patch: Use SIG_SETMASK when resetting signal mask instead of SIG_UNBLOCK
    Resolves: rhbz#842759
    Resolves: rhbz#844420
    Resolves: rhbz#844419
    Resolves: rhbz#844418
    Resolves: rhbz#844443


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-26
changelog:
  - updated sudoers man-page to clarify the behavior of the user
    negation operator and the behavior of wildcard matching in command
    specifications
    Resolves: rhbz#846118
    Resolves: rhbz#856902


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-27
changelog:
  - visudo: fixed incorrect warning and parse error regarding
    undefined aliases which were in fact defined
    Resolves: rhbz#849679
    Resolves: rhbz#905624


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-28
changelog:
  - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-2777
    Resolves: rhbz#968221


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-29
changelog:
  - added patch for CVE-2014-0106: certain environment variables not
    sanitized when env_reset is disabled
    Resolves: rhbz#1072210


author: Ivana Hutarova Varekova <varekova@redhat.com> - 7.0.2-11
changelog:
  - Related: #716959                                                                                                                                                                                             
    fix cve-2007-3852 - sysstat insecure temporary file usage


author: Tim Waugh <twaugh@redhat.com> 0.7.32.9-1
changelog:
  - 0.7.32.9:
    - Fixed Forward button sensitivity when Back pressed (bug #217516).
    - Don't pre-select make and model when not discoverable
      (bug #217522).
    - Fixed typo in show_HTTP_Error (bug #217538).
    - Fixed hex digits list in percentDecode (bug #224140).
    - Driver existence check improvements (part of bug #227662).
    - Fixed traceback in driver existence check (part of bug #227662).
    - Driver existence check: give up if there are HTML entities
      (bug #227662).
    - Prevent username/password loss when applying changes
      (bug #227663).
    - Handle unknown job options (bug #227678).
    - Case-insensitive Device ID matching (part of bug #228506).
    - Preserve case in debug output (part of bug #228506).
    - Fixed logic for matching against Device ID (part of
      bug #228506).
    - Handle applying changes in the correct place (bug #229474).
    - Reconnect to CUPS when needed (bug #229861).
    - Delete button should not be sensitive for remote queues
      (bug #250387).
    - Fixed SMB browsing problem (bug #452853).
    - Fixed expandability of servers in the SMB browser (part of
      bug #452853).
    - Decrease minimum width of window (bug #229473).
    - Moved widgets around to avoid window being too wide (part of
      bug #229473).


author: Tim Waugh <twaugh@redhat.com> 0.7.32.10-1
changelog:
  - 0.7.32.10:
    - Don't call populateList() after saving printer, just update the
      printer we changed.  This prevents a GTK+ crash (bug #229474).


author: Frank Ch. Eigler <fche@redhat.com> - 0.9.7-5.3
changelog:
  - rhbz556564-2: CVE-2009-4273 cont'd aka CVE-2010-0412
  - rhbz559719: CVE-2010-0411
  - pr11286: stap-client --server operation


author: Peter Vrabec <pvrabec@redhat.com> 2:1.15.1-23
changelog:
  - Fix default ACLs on files problem. Header fixes. root => trusted.
  - Fix NIL termination for ACLs.
  - Fix star/POSIX compat. for ACLs
  - Resolves: #221971
  - all fixes made by james.antill@redhat.com


author: Ondrej Vasik <ovasik@redhat.com> 2:1.15.1-23.0.1.2
changelog:
  - CVE-2007-4476 - fix stack crashing in safer_name_suffix
  - CVE-2010-0624 - fix heap-based buffer overflow by expanding
    a specially-crafted archive


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.4.13-5
changelog:
  - Threaded / nonthreaded versions of tcl are now switchable through alternatives
    Resolves: rhbz#478961


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.4.13-6
changelog:
  - Fixed infinite loop in regex NFA optimization code
    Resolves: CVE-2007-4772
  - Fixed O(N^2) compile time (and huge memory requirements) for some regexps
    Resolves: CVE-2007-6067


author: Jindrich Novy <jnovy@redhat.com> 3.0-33.14
changelog:
  - fix CVE-2010-2642 CVE-2011-0433 CVE-2011-0764 CVE-2011-1552
    CVE-2011-1553 CVE-2011-1554, texlive various flaws (#773180)


author: Martin Stransky <stransky@redhat.com> - 2.0.0.12-5
changelog:
  - updated starting script, fixes #217402 - Thunderbird misplaces 
    OO files that are being fowarded from open app


author: Vitezslav Crhonek <vcrhonek@redhat.com> 2:2.7.0-1
changelog:
  - Upgrade to upstream version 2.7.0
    Resolves: #427498
  - Fix OpenPegasus SRPM fails to build Test RPM
    Resolves: #252462
  - Mark files in /var/lib/Pegasus as noverify in spec file
    Resolves: #250186


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.15
changelog:
  - Resolves: rhbz#217630, 217141 naming-factory-dbcp.jar missing causes
  - JNDI errors. Change made to tomcat5.conf, added javax.sql.DataSource.
  - Factory to JAVA_OPTS


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.22
changelog:
  - Resolves: CVE-2011-0013 rhbz 675931
  - Resolves: CVE-2010-3718 rhbz 675931
  - Resolves: CVE-2011-1184 rhbz 744983
  - Resolves: CVE-2011-2204 rhbz 719181


author: Fernando Nasser <fnasser@redhat.com> - 0:5.5.23-0jpp.3.0.2
changelog:
  From jean-frederic clere <jclere@redhat.com>:
  - Patch for CVE-2007-3382 and CVE-2007-3385
    Resolves: rhbz#254155


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.38
changelog:
  - Resolves: CVE-2012-3439 rhbz#882008 three DIGEST authentication
  - implementation
  - Resolves: CVE-2012-3546, rhbz#913034 Bypass of security constraints.
  - Remove unneeded handling of FORM authentication in RealmBase


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.39
changelog:
  - Resolves: CVE-2013-1976 Improper TOMCAT_LOG management in 
  - initscript. Change location of TOMCAT_LOG to /var/log so
  - only root can write to it. Touching TOMCAT_LOG is no longer 
  - required during initscript startup. Permissions and ownership
  - changed to 0755 tomcat:root for logdir


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.40
changelog:
  - Related: CVE-2013-1976 It was found during additional testing
  - that the tomcat5 init may fail to start because the user
  - shell is set to sbin/nologin. Fixed in init scrip. SU now
  - uses -s /bin/sh during startup


author: David Walluck <dwalluck@redhat.com> 0:5.5.23-0jpp.7
changelog:
  - add patch for CVE-2008-1232
    Resolves: rhbz#457727
  - add patch for CVE-2008-1947
    Resolves: rhbz#449916
  - add patch for CVE-2008-2370
    Resolves: rhbz#458634
  - add patch for CVE-2008-2938
    Resolves: rhbz#456214


author: Fernando Nasser <fnasser@redhat.com> 0:5.5.23-0jpp.7.2
changelog:
  From  David Knox <dknox@redhat.com>:
  - add patch for CVE-2007-5333
    Resolves: rhbz#427779
  - add patch for CVE-2008-5515
    Resolves: rhbz#504758
  - add patch for CVE-2009-0033
  - add patch for CVE-2009-0580
    Resolves: rhbz#503980
  - add patch for CVE-2009-0783
    Resolves: rhbz#504162


author: Fernando Nasser <fnasser@redhat.com> 0:5.5.23-0jpp.7.2
changelog:
  - Actually add the patch files this time
    Resolves: rhbz#427779
    Resolves: rhbz#504758
    Resolves: rhbz#503980
    Resolves: rhbz#504162


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.8
changelog:
  - Patches backported from RHEL-5 tomcat5-5.5.23-0jpp.10.el5
  - Updated init script for LSB compliance, catalina.log permissions
  - Resolves: CVE-2009-2693, CVE-2009-2902, CVE-2010-2227
  - CVE_2010-0781


author: Steve Grubb <sgrubb@redhat.com> - 0.3.1-3
changelog:
  Resolves: #431616 static libs need to require devel package
  Resolves: #431667 switch tss user to root


author: Petr Machata <pmachata@redhat.com> - 2007j-1
changelog:
  - Upstream 2007j
    - New links America/St_Barthelemy and America/Marigot
    - Venezuela is changing their clocks on December 9 at 03:00
  - Upstream 2007i
    - Syria DST will take place at Midnight between Thursday and Friday.
    - Cuba will end DST on the last Sunday of October.
  - Update tst-timezone.c from glibc CVS
  - Resolves: #410101


author: Petr Machata <pmachata@redhat.com> - 2008b-2
changelog:
  - Upstream 2008b
    - DST changes for Syria, Cuba; Iraq abandons DST
    - Saigon zone renamed Ho_Chi_Minh; backward link provided
    - Add America/Argentina/San_Luis information
  - Pakistan introduces DST
  - Resolves: #447270


author: Petr Machata <pmachata@redhat.com> - 2008e-1
changelog:
  - Upstream 2008c
    - Mongolia changes zone
    - Pakistan DST is scheduled until Sep/1, instead of Aug/31
  - Upstream 2008d
    - Changes for Brazil and Mauritius
  - Upstream 2008e
    - Changes for Mauritius
    - Leap second coverage for 31/Dec 2008
    - Corrections of historical dates
  - Drop Morocco and Pakistan patches that are superseded by upstream
  - Pakistan DST is scheduled until Oct/31
  - Morocco DST is scheduled until Aug/31
  - Resolves: #460059 #460365 #452679


author: Petr Machata <pmachata@redhat.com> - 2008f-1
changelog:
  - Upstream 2008f
    - Gaza strip runs on different clocks during Ramadan
    - Argentina and Brazil will start DST on Sunday October 19, 2008
  - Drop Pakistan & Morocco patches
  - Resolves: #462707


author: Petr Machata <pmachata@redhat.com> - 2008i-1.el5
changelog:
  - Upstream 2008g
    - Fixed future DST transitions for Brazil
  - Upstream 2008h
    - Fix exact DST transition hour for Mauritius
    - Syria will leave the period of DST on Nov 1
    - Fix coordinates of Pacific/Niue
  - Upstream 2008i
    - Updates for Argentina: Drop DST in zones America/Argentina/Jujuy,
      La_Rioja, San_Juan, Catamarca, Mendoza, Rio_Gallegos, Ushuaia; new
      zone America/Argentina/Salta (for provinces SA, LP, NQ, RN).
  - Resolves: #467188


author: Petr Machata <pmachata@redhat.com> - 2009f-1.el5
changelog:
  - Upstream 2009a
    - Fix Asia/Kathmandu spelling
    - Historical timestamps for Switzerland and Cuba
    - DST update for America/Resolute
  - Upstream 2009d
    - Morocco will observe DST from 2009-06-01 00:00 to 2009-08-21 00:00
    - Tunisia will not observe DST this year.
    - Syria will start DST on 2009-03-27 00:00 this year
    - Cuba will start DST on midnight between 2009-03-07 and 2009-03-08
    - Province of San Luis, Argentina, went to UTC-04:00 on 2009-03-15
  - Upstream 2009e
    - Historical changes for Jordan
    - Palestine will start DST on 2009-03-26 and end 2009-09-27
  - Upstream 2009f
    - Pakistan will observe DST between 2009-04-15 and (probably) 2009-11-01
  - Resolves: #495470
  - Egypt ends DST on 2009-09-24
  - Resolves: #492263


author: Petr Machata <pmachata@redhat.com> - 2009i-1.el5
changelog:
  - Upstream 2009i
    - Bangladesh introduces DST 2009-06-20
  - Upstream 2009h
    - Convert use of 00:00 stamps to 24:00 of the previous day
    - Clarify that the data is Public Domain
  - Drop Cairo patch
  - Resolves: #503832


author: Petr Machata <pmachata@redhat.com> - 2009i-2.el5
changelog:
  - Official announcement is for the Bangladesh change to occur at 23:00
    of local time, not 24:00.  Add upstream patch implementing the same.
  - Resolves: #503832


author: Petr Machata <pmachata@redhat.com> - 2009k-1.el5
changelog:
  - Upstream 2009j
    - DST switch for Bangladesh will occur an hour earlier than was
      thought (we can drop Bangladesh patch).
  - Upstream 2009k
    - Mauritius will not continue to observe DST the coming summer
    - Arbitrarily end DST at the end of 2009 so that a POSIX-style time
      zone string can appear in the Dhaka binary file
  - Egypt starts winter time on August 21.
  - Resolves: #517009


author: Petr Machata <pmachata@redhat.com> - 2009m-1.el5
changelog:
  - Upstream 2009m
    - Palestine will will revert back to winter time on Friday, 2009-09-04
    - Samoa passed the DST Bill that fixes DST dates for 2009 and 2010
  - Drop Egypt patch
  - Add markers for autoupdate of spec file
  - Pakistan leaves the period of DST on October 1
  - Resolves: #524198


author: Petr Machata <pmachata@redhat.com> - 2009o-1.el5
changelog:
  - Upstream 2009o
    - Bangladesh won't go back to Standard Time from October 1, 2009
    - Pakistan leaves DST on October 1, 2009
  - Dropped tzdata-2009m-karachi.patch
  - Argentina does not enter DST on October 18 (tzdata-2009o-argentinas.patch)
  - Resolves: #529427


author: Petr Machata <pmachata@redhat.com> - 2009o-2.el5
changelog:
  - San Luis (Argentina) entered DST on October 11 (tzdata-2009o-argentinas.patch)
  - Resolves: #529427


author: Petr Machata <pmachata@redhat.com> - 2009u-1.el5
changelog:
  - Upstream 2009p
    - Argentina does not enter DST on October 18
    - San Luis switched from UTC-4 to UTC-3 on October 11th
  - Upstream 2009q
    - Change DST end in Syria from November 1 to last Friday in October
    - Changes to past Hong Kong transitions
    - Kemerovo oblast' in Russia will change current time zone on March 28, 2010.
      Asia/Novokuznetsk is the new time zone name
  - Upstream 2009r
    - Changes to local times of three Australian research stations in Antarctica
  - Upstream 2009s
    - Fiji plans to re-introduce DST from November 29th 2009 to April 25th 2010
  - Upstream 2009u
    - Bangladesh changed their clock back to Standard Time on December 31, 2009
    - Resolves: #550570
  - Dropped tzdata-2009o-argentinas.patch


author: Petr Machata <pmachata@redhat.com> - 2010c-1.el5
changelog:
  - Upstream 2010a
    - Source code cleanups
  - Upstream 2010b
    - Northern Mexico's border cities share the DST schedule with the
      United States
  - Upstream 2010c
    - Paraguay DST now in effect from 2nd Sunday of April to 1st Sunday
      of October
  - Resolves: #568667


author: Petr Machata <pmachata@redhat.com> - 2010e-1.el5
changelog:
  - Upstream 2010d
    - The DST change in Bangladesh takes place a minute earlier
    - Fiji to end DST on 2010-03-28 at 03:00, about a month earlier
    - Samoa to observe DST this year; they didn't observe DST last year
    - DST in Chile extended to 3 April
    - Resolves: #571538
  - Upstream 2010e:
    - Fix a typo in Bangladesh DST rule


author: Petr Machata <pmachata@redhat.com> - 2010f-8.el5
changelog:
  - On RHEL 5, arch package cannot have noarch subpackages.  Instead we
    build tzdata as arch package.  Or argh.
  - Resolves: #576611


author: Petr Machata <pmachata@redhat.com> - 2010f-9.el5
changelog:
  - Tunisia not to observe DST in 2010 (tzdata-2010g-tunis.patch)
  - Resolves: #577793
  - Pakistan not to observe DST in 2010 (tzdata-2010g-karachi.patch)
  - Resolves: #577710


author: Petr Machata <pmachata@redhat.com> - 2010i-1.el5
changelog:
  - Upstream 2010g:
    - No Bangladesh DST in 2010 and forward.
    - Gaza DST starts last Saturday in March at 12:01 a.m. in 2010 and forward
    - Kamchatka and Anadyr change to Moscow+8 on 2010-03-28
    - Samara changes to Moscow+0 on 2010-03-28
    - Related zone.tab updates
  - Upstream 2010h:
    - No DST in Tunisia in 2010 and forward
    - No DST in Pakistan in 2010 and forward
  - Upstream 2010i:
    - Morocco will have DST from 2010-05-02 to 2010-08-08
    - San Luis, Argentina will keep permanent DST after April 11, 2010
    - Updates of historical stamps for Taiwan
  - Dropped tzdata-2010g-tunis.patch
  - Dropped tzdata-2010f-g.patch
  - Dropped tzdata-2010g-karachi.patch
  - Resolves: #584847


author: Andreas Schwab <schwab@redhat.com> - 2010k-1.el5
changelog:
  - Upadate to 2010k (#618593)
    - No DST in Egypt during Ramadan in 2010
    - Bahía de Banderas moved to UTC-6 on April 4, 2010, new time zone
      America/Bahia_Banderas
    - Rename Pacific/Truk to Pacific/Chuuk and Pacific/Ponape to Pacific/Pohnpei
    - Update historical data of Europe/Helsinki
    - Update tz-links page


author: Petr Machata <pmachata@redhat.com> - 2010l-1.el5
changelog:
  - Upstream 2010l:
    - Change Cairo's 2010 reversion to DST from the midnight between
      September 8 and 9 to the midnight between September 9 and 10.
    - Change Gaza's 2010 return to standard time to the midnight between
      August 10 and 11.
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010
  - Resolves: #628637


author: Petr Machata <pmachata@redhat.com> - 2010o-1.el5
changelog:
  - Upstream 2010m:
    - Hong Kong didn't observe DST in 1977
    - In zone.tab, remove obsolete association of Vostok Station with
      South Magnetic Pole; add association with Lake Vostok
  - Upstream 2010n:
    - Change end of DST in Samoa in 2011 from 2011-04-03 0:00 to
      2011-04-03 1:00
  - Upstream 2010o:
    - Fiji will end DST on March 6, 2011, not March 27, 2011
  - Resolves: #662777


author: Petr Machata <pmachata@redhat.com> - 2011b-1.el5
changelog:
  - Upstream 2011a:
    - Updates of historical stamps for Hawaii
  - Upstream 2011b:
    - America/North_Dakota/Beulah: Mercer County, North Dakota, changed
      from the mountain time zone to the central time zone
  - Kemerovo oblast should use OMST/OMSST abbreviation (tzdata-2011b-kemerovo.patch)
  - tzdata-2011b-c.patch
    - Update of historical stamps for Juneau, Sitka, and histcurrent
      stamps for Metlakatla.  Sitka and Metlakatla are new zones.
    - Delay end of DST in Chile in 2011 until first Sunday in April.
  - Resolves: #681594


author: Petr Machata <pmachata@redhat.com> - 2011d-1.el5
changelog:
  - Upstream 2011d:
    - Change end of DST in Samoa in 2011.
    - Change start of DST in Cuba in 2011.
    - Move start of DST in Turkey by one day in 2011.
  - Dropped tzdata-2011b-c.patch
  - Resolves: #684212


author: Petr Machata <pmachata@redhat.com> - 2011d-3.el5
changelog:
  - Morocco introduced DST for 2011 from April 2 to July 31. (tzdata-2011d-morocco.patch)
  - Resolves: #692160


author: Petr Machata <pmachata@redhat.com> - 2011g-1.el5
changelog:
  - Upstream 2011e:
    - Morocco introduced DST for 2011 from April 2 to July 31.
    - Delay end of DST in Chile in 2011 until May 7.
  - Resolves: #698608
  - Upstream 2011f:
    - The Falkland Islands will not turn back clocks this winter, but
      stay on daylight saving time.
  - Upstream 2011g:
    - Egypt abandons DST in 2011 (and forward)
  - Resolves: #698397
  - Dropped tzdata-2011d-chile.patch
  - Dropped tzdata-2011d-morocco.patch


author: Petr Machata <pmachata@redhat.com> - 2011h-1.el5
changelog:
  - Upstream 2011h:
    - Russia abandons DST in 2011.
    - *.tab: change AN (Netherlands Antilles) to CW (Curacao)
  - Resolves: #701268


author: Petr Machata <pmachata@redhat.com> - 2011h-2.el5
changelog:
  - Patch for upcoming change in Newfoundland.  The transition time
    changes from 12:01 AM to 2:00 AM.
  - Resolves: #729697


author: Petr Machata <pmachata@redhat.com> - 2011l-2
changelog:
  - Upstream 2011l:
    - Fix ancient stamps for America/Sitka
    - Asia/Hebron transitioned to standard time already on Sep 30, not Oct 3
    - Fiji will introduce DST on Oct 22
  - Resolves: #739916


author: Petr Machata <pmachata@redhat.com> - 2011l-3.el5
changelog:
  - State of Bahia, Brazil, to resume Summer Time on Oct 16
  - The project moved, reflect this in URL
  - Resolves: #739916


author: Petr Machata <pmachata@redhat.com> - 2011n-1.el5
changelog:
  - Rebase to 2011n
    - Cuba postponed DST by two weeks to Nov 13
    - Fiji will enter DST on Jan 21
  - Add a patch for the leap second that will occur this summer
  - Resolves: #782173


author: Petr Machata <pmachata@redhat.com> - 2011n-2.el5
changelog:
  - The Chilean Government has decided to postpone the entrance into
    winter time (to leave DST) from March 11 2012 to April 28th 2012
  - Resolves: #796747


author: Petr Machata <pmachata@redhat.com> - 2012b-1.el5
changelog:
  - Rebase to 2012b; changes vs. 2011n-2:
    - Changes to zones for Antarctica stations
    - Armenia abolished DST in 2012 and forward
    - Cuba enters DST on 31st March
    - Falkland Islands will stay on permanent Summer Time
    - New zone for Creston Valley, Canada, which differs from Dawson
      Creek in past stamps.  Changes to historical stamps in Canada.
    - Last year, Tokelau skipped over the date line together with Samoa
  - Resolves: #802541


author: Petr Machata <pmachata@redhat.com> - 2012b-2.el5
changelog:
  - Morocco DST starts on the last Sunday of March (March 25, 2012) and
    ends on last Sunday of September, except the month of Ramadan.  It
    is currently unclear what that Ramadan bit means, so this is not
    covered by the patch as of now.
  - Resolves: #802541


author: Petr Machata <pmachata@redhat.com> - 2012c-1.el5
changelog:
  - Upstream 2012c
    - Haiti observes DST from 2012 on
    - Gaza Strip and Hebron observe DST in 2012
    - Change start of DST in Syria to last Friday in March
  - Resolves: #820689


author: Petr Machata <pmachata@redhat.com> - 2012f-1.el5
changelog:
  - Upstream 2012f
    - Fiji will start daylight savings at 2 am on Sunday 21st October 2012
      and end at 3 am on Sunday 20th January 2013.  Guess it will be like
      that in following years as well.
  - Upstream 2012e
    - Tokelau is in time zone UTC+13, not UTC+14 (and always was)
  - Upstream 2012d
    - Morocco will not observe DST during the month of Ramadan.
      DST cessation end date was corrected.
    - Drop tzdata-2012c-morocco.patch


author: Petr Machata <pmachata@redhat.com> - 2012h-2
changelog:
  - Switch back to using system zic, ignore upstream Makefile at all.
    We do so for java anyway.
  - Drop Factory from distribution


author: Petr Machata <pmachata@redhat.com> - 2013b-1
changelog:
  - Upstream 2013b
    - Paraguay will end DST on March 24 this year
    - Haiti uses US daylight-saving rules this year
    - Morocco does not observe DST during Ramadan
  - Upstream 2013a
    - Retire Chile patch, 2013a has the data
    - New Zones Asia/Khandyga, Asia/Ust-Nera, Europe/Busingen
    - Many changes in historical timestamps


author: Petr Machata <pmachata@redhat.com> - 2013c-1
changelog:
  - Upstream 2013c
    - Sync past stamps for Palestine and West Bank with timeanddate.com
    - Assume that the recent change to Paraguay's DST rules is permanent
    - Macquarie was uninhabited between 1919 and 1948.  It's also part
      of Australia (update in zone.tab).


author: Petr Machata <pmachata@redhat.com> - 2013c-2
changelog:
  - Update descriptions in iso3166.tab; make Jerusalem coordinates in
    zone.tab more precise
    (0001-Adjust-commentary-to-try-to-defuse-recent-issues-som.patch)
  - Update local mean time for Jerusalem to match more-precise longitude
    (0002-asia-Asia-Jerusalem-Fix-LMT-to-match-more-precise-lo.patch)
  - Move Morocco's midsummer 2013 transitions
    (0003-Move-Morocco-s-midsummer-2013-transitions.patch)
    Fixes 980805 980807 981019 981020
  - Israel now falls back on the last Sunday of October
    (0004-Israel-now-falls-back-on-the-last-Sunday-of-October.patch)


author: Patsy Franklin <pfrankli@redhat.com> 2013i-1
changelog:
  - Rebase with early release of 2013i from Paul Eggert github.
    - Jordan switches back to standard time at 00:00 on December 20,2013.
    - The 2006-2011 transition schedule is planned to resume in 2014.
    - The compile-time flag NOSOLAR has been removed.
    - The files solar87, solar88, and solar89 are no longer distributed.
    - tz-link.htm now mentions Noda Time.


author: Patsy Franklin <pfrankli@redhat.com> - 2014b-1
changelog:
  - Rebase to 2014b
    - Crimea switches to Moscow time on 2014-03-30 at 02:00 local time.
    - New entry for Troll station, Antarctica.


author: Patsy Franklin <pfrankli@redhat.com> - 2014c-1
changelog:
  - Rebase to 2014c
    - Egypt's government to re-apply daylight saving time.
    - zic now generates transitions for minimum time values
    - Port to Cygwin sans glibc.
    - Remove now-confusing comment about Jordan.


author: Patsy Franklin <pfrankli@redhat.com> - 2014d-1
changelog:
  - Rebase to 2014d
    - zic no longer generates files containing time stamps before
      the Big Bang.  This works around GNOME bug 730332


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-1
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan 
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00


author: Petr Machata <pmachata@redhat.com> - 2014h-1
changelog:
  - Rebase to 2014h
    - Changes to historical transitions in America/Jamaica and
      Asia/Novokuznetsk.
    - Africa/{Blantyre, Bujumbura, Gaborone, Harare, Kigali, Lubumbashi,
      Lusaka} now alias Africa/Maputo, because they don't differ in
      post-1970 stamps.
    - Africa/Maseru and Africa/Mbabane now alias Africa/Johannesburg for
      the same reason.


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d:
    - The Egyptian Cabinet announced that DST will be cancelled for 2015.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style. This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d 
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST (BZ #1425223)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab to the install files. (BZ #1427696)


author: Tom Lane <tgl@redhat.com> 2.2.11-9
changelog:
  - split out libraries into a -libs subpackage, to allow them to be installed
    concurrently with unixODBC64-libs
  Resolves: #497016


author: Tom Lane <tgl@redhat.com> 2.2.11-10
changelog:
  - Compile with -fno-strict-aliasing, per rpmdiff complaint.
  - Install icons in /usr/share/pixmaps, not /usr/share/icons as this package
    has historically done; the former is considered correct.  Also per rpmdiff.
  Related: #497016


author: Tom Lane <tgl@redhat.com> 2.2.14-1
changelog:
  - Constructed from current Fedora package, removing -kde subpackage because
    2.2.14 seems to need a newer version of Qt than RHEL-5 provides.
  - Split libraries into a -libs subpackage to allow installation concurrent
    with the original unixODBC package (or at least its -libs subpackage).
  Resolves: #742597


author: Tom Lane <tgl@redhat.com> 2.2.14-2
changelog:
  - Treat ia64 as a multilib architecture, because rpmdiff has started to
    whinge about it
  Related: #742597


author: Karel Zak <kzak@redhat.com> 2.13-0.57
changelog:
  - fix #646300 - login doesn't update /var/run/utmp properly
  - fix #726572 - import missing fsfreeze into util-linux 
  - fix #678430 - fdisk should not report error on 1gB LUNs
  - fix #699639 - mount man page is missing support for ext4/xfs
  - fix #650937 - blockdev man page missing information
  - fix #678407 - ipcs and ipcrm in wrong man section


author: Karsten Hopp <karsten@redhat.com> 7.0.109-4.3z
changelog:
  - fixes CVE-2008-3074 (tar plugin)
  - fixes CVE-2008-3075 (zip plugin)
  - fixes CVE-2008-3076 (netrw plugin)
  - fixes CVE-2008-4101 (keyword and tag lookup)


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:4.1-79
changelog:
  - CVE-2010-0424 vixie-cron, cronie: Race condition by setting timestamp 
    of user's crontab file, when editing the file
  - Resolves: rhbz#741534


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:4.1-80
changelog:
  - 654961 crond process ignores the changes of user's home directory needs
    bigger changes of code. The fix wasn't applied, detail in comment#11.
  - Related: rhbz#249512


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:4.1-81
changelog:
  - 455664 adoptions of crontab orphans, forgot add buffer for list of
    orphans
  - Related: rhbz#455664


author: Martin Nagy <mnagy@redhat.com> - 2.0.5-11
changelog:
  - add new option to log login failures based on user list
  - Resolves: #345791
  - fix user_config_dir option
  - Resolves: #400921
  - allow usernames starting with '_' or '.'
  - Resolves: #386561
  - fix the write/race condition when uploading files simultaneously
  - Resolves: #240553
  - fix the bug that causes every new file stored with STOU to have a prefix '.1'
  - Resolves: #392231
  - make vsftpd wildcard matching more greedy
  - Resolves: #392181


author: Jiri Skala <jskala@redhat.com> - 2.0.5-16.el5_5.1
changelog:
  - Resolves: #580055 - vsftpd prematurely closes connection just before processing of post-auth command
  - Resolves: #580396 - vsftpd issues in RHEL5


author: Radek Vokál <rvokal@redhat.com> 0.99.5-1
changelog:
  - multiple security issues fixed (#225781)
  - CVE-2007-0459 - The TCP dissector could hang or crash while reassembling HTTP packets
  - CVE-2007-0459 - The HTTP dissector could crash.
  - CVE-2007-0457 - On some systems, the IEEE 802.11 dissector could crash.
  - CVE-2007-0456 - On some systems, the LLT dissector could crash.


author: Radek Vokál <rvokal@redhat.com> 0.99.6-1
changelog:
  - upgrade to 0.99.6
  - Wireshark could crash when dissecting an HTTP chunked response
  - Wireshark could crash while reading iSeries capture files
  - Wireshark could exhaust system memory while reading a
    malformed DCP ETSI packet
  - Wireshark could loop excessively while reading a malformed SSL packet
  - Resolves: #247623


author: Radek Vokál <rvokal@redhat.com> 0.99.7-1
changelog:
  - upgrade to 0.99.7
  - switch to libsmi from net-snmp
  - disable ADNS due to its lack of Ipv6 support
  - Resolves: #397411


author: Jan Safranek <jsafrane@redhat.com> 1.0.14-1
changelog:
  - upgrade to 1.0.14
  - http://www.wireshark.org/docs/relnotes/wireshark-1.0.14.html
  - fixes CVE-2010-1455 CVE-2010-2283 CVE-2010-2284 CVE-2010-2286 CVE-2010-2287
  - Resolves: #612239


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-1
changelog:
  - upgrade to 1.0.15
  - http://www.wireshark.org/docs/relnotes/wireshark-1.0.15.html
  - fixes CVE-2010-2287 CVE-2010-2284
  - Related: #612239


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-1.4
changelog:
  - fix few security issues
  - Resolves: CVE -2011-0024 CVE-2011-0538 CVE-2011-1139 CVE-2011-1140
    CVE-2011-1141 CVE-2011-1143 #612240


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-3
changelog:
  - fixed various flaws: CVE-2011-1959 CVE-2011-2175 CVE-2011-1958 
    CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066
    CVE-2012-0067


author: Peter Hatina <phatina@redhat.com> 1.0.15-6
changelog:
  - security patches
  - Resolves: CVE-2012-6056
              CVE-2012-6060
              CVE-2012-6061
              CVE-2012-6062
              CVE-2013-3557
              CVE-2013-3559
              CVE-2013-4081
              CVE-2013-4083
              CVE-2013-4927
              CVE-2013-4931
              CVE-2013-4932
              CVE-2013-4933
              CVE-2013-4934
              CVE-2013-4935
              CVE-2013-5721
              CVE-2013-7112
              CVE-2014-2281
              CVE-2014-2299


author: Peter Hatina <phatina@redhat.com> 1.0.15-7
changelog:
  - security patches
  - Resolves: CVE-2014-6421
              CVE-2014-6423
              CVE-2014-6425
              CVE-2014-6428
              CVE-2014-6429


author: Dan Williams <dcbw@redhat.com> - 0.5.10-8
changelog:
  - Generalize disconnection-during-association fixes to iwl3945 and iwlagn
  - Force drivers to disassociate when required (see also #468967)
  - Resolves: #468441


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-120.el5
changelog:
  - Removed patch "ioemu: do asynchronous flushes for IDE drives"(rhbz 651912)
  - Updated patch "Unpause domU as soon as memory scrubbing on source machine starts on live migration" (rhbz 609589)
  - Updated patch "prevent restarting loops when guest crashes at boot time and dump-core is enabled" (rhbz 624959)
  - Updated patch "Report error on attaching non-existing cdrom" (rhbz 645237)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-120.el5_6.1
changelog:
  - Remove overhead when checking duplicate devices (rhbz 666802)
  - Delete device entry on detach (rhbz 666802)
  - Fix xenstore entry accounting (rhbz 666802)
  - Do not check disk sharing with guests in hotplug script (rhbz 680928)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-120.el5_6.2
changelog:
  - Fix logic and integer overflow in xc_try_bzip2_decode() (rhbz 696938)
  - Fix logic and integer overflow in xc_try_lzma_decode() (rhbz 696938)
  - Fix integer and buffer overflows in xc_dom_probe_bzimage_kernel() (rhbz 696938)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-132.el5_7.1
changelog:
  - hotplug: set netback/tap MTU to the same value as the bridge MTU (rhbz 738608)
  - copy the MTU of the physical interface to the Xen bridge (rhbz 738610)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-132.el5_7.2
changelog:
  - Release device backends before restarting guest on the destination machine (rhbz 743850)
  - Fix SCSI buffer overflow and disable SCSI CD-ROMs (rhbz 736289)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-135.el5
changelog:
  - Fix valid cdrom image check (rhbz 737851)
  - pygrub: add more grub2 config file names (rhbz 746602)
  - pygrub: read all MSDOS partitions (rhbz 746602)
  - pygrub: read all GPT partitions (rhbz 746602)
  - pygrub: parse more grub2 config file constructs (rhbz 746602)
  - fix SCSI buffer overflow, disable SCSI CD-ROMs (rhbz 736291)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-135.el5_8.1
changelog:
  - qemu-dm/e1000: bounds packet size against buffer size (rhbz 786862)
  - Use correct expansion in xen-network-common.sh (rhbz 797191)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-142.el5
changelog:
  - Properly close logfile of console daemon on error (rhbz 749776)
  - Fix leaks in block-qcow driver (rhbz 749776)
  - Avoid bogus use of NULL pointer in hvmloader (rhbz 749776)
  - qemu-dm: fix unregister_iomem (rhbz 861349)
  - Backport a single hunk from qemu-xen-unstable commit 13669683 (rhbz 861349)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-142.el5_9.1
changelog:
  - libxc: move error checking next to the function which returned the error (rhbz 876997)
  - libxc: builder: limit maximum size of   kernel/ramdisk (rhbz 876997)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-142.el5_9.2
changelog:
  - e1000: discard packets that are too long if !SBP and !LPE (rhbz 910843)
  - e1000: discard oversized packets based on SBP|LPE (rhbz 910843)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-143.el5
changelog:
  - libxc: move error checking next to the function which returned the error (rhbz 870413)
  - libxc: builder: limit maximum size of   kernel/ramdisk (rhbz 870413)
  - e1000: discard packets that are too long if !SBP and !LPE (rhbz 910844)
  - e1000: discard oversized packets based on SBP|LPE (rhbz 910844)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-144.el5
changelog:
  - xm: Fix vcpu-pin complain for CPU number out of range (rhbz 955656)
  - libxc: Support set affinity for more than 64 CPUS (rhbz 955656)
  - libxc: Fixes for "support affinity for more than 64 CPUS" (rhbz 955656)
  - xend: Fix bug of a cpu affinity vcpu-pin under ia32pa (rhbz 955656)
  - libxc: Fix cpu number overflow for vcpu-pin (rhbz 955656)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-146.el5
changelog:
  - xen-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch
  - xen-FDC-Fix-buffer-overflow-Herv-Poussineau.patch
  - Resolves: bz#1219333
   (xen: qemu: floppy disk controller flaw [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-147.el5
changelog:
  - net: add checks to validate ring buffer pointers 
  - Resolves: bz#1263273
    (xen: qemu: Heap overflow vulnerability in ne2000_receive() function)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-148.el5_11
changelog:
  - xen-qemu-ioport-array-overflow.patch [bz#1401521]
  - Resolves: bz#1401521
    (CVE-2016-9637 xsa199 xen: qemu ioport array overflow (XSA-199) [rhel-5.11.z])


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.3-41.el5_1.3
changelog:
  - Fix QEMU buffer overflow CVE-2007-5730 (rhbz #360381)
  - Fix QEMU block device extents checking CVE-2008-0928 (rhbz #433560)


author: Markus Armbruster <armbru@redhat.com> - 3.0.3-41.el5_1.4
changelog:
  - Fix PVFB to validate frame buffer description (rhbz #443376)
  - Fix PVFB to cope with bogus update requests (rhbz #368931)


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.3-64.el5_2.1
changelog:
  - Remove blktap sharing patch which prevents guests with large
    numbers of disks booting (rhbz #445789)


author: Markus Armbruster <armbru@redhat.com> - 3.0.3-64.el5_2.2
changelog:
  - Correctly limit PVFB size CVE-2008-1952 (rhbz #447760)
  - Disable QEMU USB disk image format auto-detection CVE-2008-1945 (rhbz #445845)


author: Daniel P. Berrange <berrange@redhat.com> - 3.0.3-64.el5_2.9
changelog:
  - More fixes for Xenstore unsafe data access (CVE-2008-4405, rhbz #464817)
  - Fix block-detach regression due to (CVE-2008-4405, rhbz #473882)


author: Jiri Denemark <jdenemar@redhat.com> - 3.0.3-94.el5_4.1
changelog:
  - Fix race condition on domain reboot (rhbz 525143)
  - Avoid multiple restarts of a domain (rhbz 525141)
  - Add grub.conf password protection support to pygrub (rhbz 525142)
  - Ignore unimplemented PHYSDEVOP_map_pirq (rhbz 525149)


author: Johnny Hughes <johnny@centos.org> 2.2.46-1
changelog:
  - upgraded to upstream version 2.2.46
  - added e2fsprogs-devel and ncurses-devel as build requirements.


author: Jan Synáček <jsynacek@redhat.com> -2:2.3.14-18
changelog:
  - Fix leaking file descriptors (#852274)
  - Fix: Service disabled due to bind failure (#811000)
  - CVE-2012-0862 xinetd: enables unintentional services over tcpmux port (#788795)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 1.16-24-1206.1840.2
changelog:
  - backported GSSAPI delegation from upstream version 1.27.04 with strong attention
    to libxmlrpc++ client ABI backward compatibility (#723645)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 1.16.24-1206.1840.4
changelog:
  - Add Requires to subpackages dependent on particular curl version that
    provides the GSSAPI delegation API (#756704, #723645)


author: Daniel Veillard <veillard@redhat.com> - 1.2.9-8.1.2
changelog:
  - disable xslt i/o support in library, tools and examples, CVE-2011-1425
  - Resolves: rhbz#694124
  - limit the paths used for searching the security library loaded dynamically


author: Adam Jackson <ajax@redhat.com> 1.4.13-5
changelog:
  - mga-1.4.13-g200se-12x7-bug.patch: Fix (wrong) selection of 1280x768 on
    G200SE when no monitor connected (#735713)


author: Kristian Høgsberg <krh@redhat.com> - 1.1.0-3
changelog:
  - Add ptr-feedback-class.patch to add a pointer control callback so
    the driver doesn't crash when the device control callback is
    invoked.  Fix for (#441327).


author: Ben Skeggs <bskeggs@redhat.com> 2.1.15-3
changelog:
  - nv.xinf: partially revert previous new chipset support, default to vesa
    on certain configurations that may be problematic due to lack of DP
    support (#514999).


author: Hans de Goede <hdegoede@redhat.com> 0.0.12-2
changelog:
  - Fix crash and vga font corruption when switching vc
    Resolves: rhbz#585141
  - Add support for many more resolutions and enable resolutions > 1024x768
    without requiring an xorg.conf
    Resolves: rhbz#581841


author: Adam Jackson <ajax@redhat.com> 1.3.0-8.2
changelog:
  - vesa-1.3.0-vbe-dpms.patch: Use VBE's DPMS method, instead of manual VGA
    register writes, so that laptop backlights turn off too. (#494671)


author: Adam Jackson <ajax@redhat.com> 1.3.0-8.3
changelog:
  - vesa-1.3.1-*.patch: Backport various fixes from upstream, and allow mismatch
    between 136[0-8]x768 modes. (#614960)
  - Bump xserver requires to a version that includes VBE PanelID.


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.100
changelog:
  - xserver-1.1.1-more-regen-leaks.patch: Cope with root cursor refcounting
    being differently broken in different DDXes. (#498357)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.104
changelog:
  - xserver-1.1.1-randr-config-timestamps.patch: Backport timestamp comparison
    fix from upstream RANDR code (#1006076)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.107
changelog:
  - CVE-2014-8091 denial of service due to unchecked malloc in client
    authentication (#1168680)
  - CVE-2014-8092 integer overflow in X11 core protocol requests when
    calculating memory needs for requests (#1168684)
  - CVE-2014-8097 out of bounds access due to not validating length or offset
    values in DBE extension (#1168705)
  - CVE-2014-8095 out of bounds access due to not validating length or offset
    values in XInput extension (#1168694)
  - CVE-2014-8096 out of bounds access due to not validating length or offset
    values in XC-MISC extension(#1168700)
  - CVE-2014-8099 out of bounds access due to not validating length or offset
    values in XVideo extension (#1168710)
  - CVE-2014-8100 out of bounds access due to not validating length or offset
    values in Render extension (#1168711)
  - CVE-2014-8102 out of bounds access due to not validating length or offset
    values in XFixes extension (#1168714)
  - CVE-2014-8101 out of bounds access due to not validating length or offset
    values in RandR extension (#1168713)
  - CVE-2014-8093 xorg-x11-server: integer overflow in GLX extension requests
    when calculating memory needs for requests (#1168688)
  - CVE-2014-8098 xorg-x11-server: out of bounds access due to not validating
    length or offset values in GLX extension (#1168707)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.25
changelog:
  - xserver-1.1.1-acpi-tokenising-fix.patch: Also expose the builderstring
    as an exported server symbol so external drivers can notice the bugfix.
    (#246175)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.26
changelog:
  - xserver-1.1.1-mmap-{expansion,failure}: Revert, required kernel changes
    not included in 5.1. (#233981)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.26.4
changelog:
  - cve-2007-5760.patch: XFree86-Misc Extension Invalid Array Index Vulnerability
  - cve-2007-5958.patch: Xorg / XFree86 file existence disclosure vulnerability
  - cve-2007-6427.patch: XInput Extension Memory Corruption Vulnerability
  - cve-2007-6428.patch: TOG-CUP Extension Memory Corruption Vulnerability
  - cve-2007-6429.patch: EVI and MIT-SHM Extension Integer Overflow Vulnerability


author: Dave Airlie <airlied@redhat.com> 1.1.1-48.41.1
changelog:
  - cve-2008-1377.patch: Record and Security Extension Input validation
  - cve-2008-1379.patch: MIT-SHM extension Input Validation flaw
  - cve-2008-2360.patch: Render AllocateGlyph extension Integer overflows
  - cve-2008-2361.patch: Render CreateCursor extension Integer overflows
  - cve-2008-2362.patch: Render Gradient extension Integer overflows


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.76.1
changelog:
  - xserver-1.1.1-mod-macro-parens.patch: Fix insufficient parentheses in
    Render and arc computation code. (#495733)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.76.5
changelog:
  - cve-2011-4818.patch: Multiple input sanitization flaws in Render and GLX
  - xorg-x11-server-1.1.0-mesa-copy-sub-buffer.patch: Likewise.


author: Dave Airlie <airlied@redhat.com> 1.1.1-48.87
changelog:
  - xserver-1.1.1-fbdev-iterate-modes.patch: fix fbdev driver not iterating
    across all modes of a certain dimension (#740497)


author: Mike A. Harris <mharris@redhat.com> 7.1-3.fc6
changelog:
  - Remove app-defaults dir from file manifest, as it is owned by libXt (#174021)
  - Add 'dist' tag to package release string.


author: Mike A. Harris <mharris@redhat.com> 1:1.0.5-5.fc6
changelog:
  - Added xdm-1.0.5-sessreg-utmp-fix-bug177890.patch to restore GiveConsole to
    what we shipped in 6.8.2, and also fix bug (#177890)


author: Jindrich Novy <jnovy@redhat.com> 4.999.9-0.2.20091007.beta
changelog:
  - include XZ in RHEL5 (#519122)
  - repack tarball to bz2, RHEL5 doesn't know anything about XZ yet
  Resolves: #519122


author: Troy Dawson <dawson@fnal.gov> - 3.2.19-24.sl
changelog:
  - Fixed the kernel-module plugin so fixing poor yum choices
    doesn't conflict with removing a kernel-module


author: Troy Dawson <dawson@fnal.gov> - 3.2.22-20.sl
changelog:
  - Added kernel-module plugin co-written by Axel Thimm and Troy Dawson
  - Recompiled for Scientific Linux 5.x
  - Added Requires: yum-conf, yum-autoupdate
  - Added Provides: yum-autoupdate to updatesd
  - Changed Patch 0 so the default installonlyn is 4,
    Had to change Patch 120 as well
  - Added a patch to turn a warning into a log level 2
    Warning wasn't in previous versions of yum


author: Troy Dawson <dawson@fnal.gov> - 3.2.22-21.sl
changelog:
  - Fixed string TypeError bug in kernel-module plugin
    Reported and fixed by Yannick Perret
  - Fixed kernel-module plugin bug that happens when a kernel is 
    being updated at the same time that a package that has a 
    kernel module is being updated (such as openafs)


author: James Antill <james.antill@redhat.com> - 1.1.16-13
changelog:
  - Fix the yum-changelog exit, when you pass it dates and ther is no datetime
  - Resolves: rhbz#472389


author: Pat Riehecky <riehecky@fnal.gov> 1.2-1.SL
changelog:
  - added PRERUN and POSTRUN from SL6
  - added /etc/yum.d/yum.cron.updateexec for configuring PRERUN and POSTRUN


author: Troy Dawson <dawson@fnal.gov> 51-2.SL
changelog:
  - Updated gpg keys to include sl and sl5
  - Updated download server list to include ftp1.scientificlinux.org


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: yum-updatesd-spec_add-provides.patch
  -->  On SL5 you must have "yum-autoupdate" this adds the necessary provide
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl5\2
  -->  Modify release string to note changes
  - Added Source: yum-updatesd.ini
  -->  Config file for automated patch script


