# changelog

author: Archit Shah <ashah@redhat.com> 0:1.2.1-2jpp_1fc
changelog:
  - remove unnecessary build dependencies on jacorb and jonathan-rmi
  - include fix to Axis bug 2142
  - merge from upstream 2jpp


author: Permaine Cheung <pcheung@redhat.com> - 0:1.2.1-2jpp.7
changelog:
  - Add missing connection hostname check against X.509 certificate name
  - Resolves: CVE-2012-5784
  - Add patches to build with java 1.6


author: Adam Tkac <atkac redhat com> 30:9.3.6-18.P1
changelog:
  - document `dig` return codes
  - bind-chroot-admin: don't create symlinks with double "//" in the paths
  - nslookup failed to resolve name in certain cases


author: Adam Tkac <atkac redhat com> 30:9.3.6-20.P1
changelog:
  - zone->curmaster before return in dns_zone_setmasterswithkeys()
  - named could fail to send a uncompressable zone


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-394.el5]
changelog:
  - Revert: [net] bridge: Fix typo that may render snooping less effective (Amerigo Wang) [902454]
  - Revert: [net] bridge: only expire the mdb entry when query is received (Amerigo Wang) [902454]
  - Revert: [net] bridge: send query as soon as leave is received (Amerigo Wang) [902454]
  - Revert: [net] bridge: fix some kernel warning in multicast timer (Amerigo Wang) [902454]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-395.el5]
changelog:
  - [fs] gfs2: When glock is freed make sure it gets unlocked in DLM (Abhijith Das) [1022254]
  - [fs] gfs2: Requeue work if reply becomes pending during work_func (Abhijith Das) [1022254]
  - [fs] gfs2: Wait for glock demotes when evicting an inode (Abhijith Das) [1022254]
  - [fs] gfs2: Attempt to close GLF_DIRTY timing windows (Abhijith Das) [1022254]
  - [fs] gfs2: Change truncate page allocation to be GFP_NOFS (Abhijith Das) [1022254]
  - [net] tg3: Poll cpmu link state on APE + ASF enabled devices (Ivan Vecera) [1097866]
  - [net] tg3: Fix Read DMA workaround for 5719 A0 (Ivan Vecera) [924590]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-396.el5]
changelog:
  - [s390] kernel: fix restore of invalid floating-point-control (Hendrik Brueckner) [1121953]
  - [fs] cifs: Use cifs_set_ops() in fill_in_inode() functions (Sachin Prabhu) [1108624]
  - [fs] cifs: Fix cifs_set_ops() (Sachin Prabhu) [1108624]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-397.el5]
changelog:
  - [fs] gfs2: Detect and release delayed bufdata structures (Robert S Peterson) [516025]
  - [fs] nfs: don't invalidate dentries that act as mountpoints (Steve Dickson) [1117211]
  - [audit] auditsc: audit_krule mask accesses need bounds checking (Denys Vlasenko) [1102703] {CVE-2014-3917}
  - [scsi] Initialize eh_timeout value earlier on probe (Ewan Milne) [1119532]
  - [mm] writeback: Fix hang when low on memory due to NFS traffic (Larry Woodman) [1080194]
  - [fs] skip atime update on a frozen filesystem (Aaron Tomlin) [1000836]
  - [xen] x86: check segment descriptor read in 64-bit OUTS emulation (Radim Krcmar) [1012959]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-400.el5]
changelog:
  - [net] bridge: disable snooping if there is no querier (Frantisek Hrbata) [902454]
  - [s390] kernel: sysinfo: convert /proc/sysinfo to seqfile (Alexander Gordeev) [1131283]
  - [net] netlink: verify permisions of socket creator (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: store effective caps at socket() time (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Rename netlink_capable netlink_allowed (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Fix permission check in netlink_connect() (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix possible spoofing from non-root processes (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Make NETLINK_USERSOCK work again (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix for too early rmmod (Jiri Benc) [1094266] {CVE-2014-0181}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-402.el5]
changelog:
  - [block] virtio: Reset device after blk_cleanup_queue() (Stefan Hajnoczi) [1006536]
  - [block] virtio: Call del_gendisk() before disable guest kick (Stefan Hajnoczi) [1006536]
  - [block] virtio: Drop unused request tracking list (Stefan Hajnoczi) [1006536]
  - [fs] cifs: setfacl removes part of ACL when setting POSIX ACLs (Sachin Prabhu) [1105625]
  - [fs] splice: perform generic write checks (Eric Sandeen) [1155908] {CVE-2014-7822}
  - [fs] ext4: verify block bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: fix type declaration of ext4_validate_block_bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: error out if verifying the block bitmap fails (Lukas Czerner) [1034403]
  - [x86] traps: stop using IST for #SS (Petr Matousek) [1172809] {CVE-2014-9322}


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-24
changelog:
  - Try to avoid overwriting text with page labels (STR #3415,
    bug #527187).
  - Reverted patch for bug #572338 as that and related bugs need a
    solution that can guarantee no regressions.


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-25
changelog:
  - Applied patch to fix cupsd memory corruption vulnerability
    (CVE-2010-2941, STR #3648, bug #624438).
  - Fix latent privilege escalation vulnerability (CVE-2010-2431,
    STR #3510, bug #605397).


author: Jiri Popelka <jpopelka@redhat.com> 1:1.3.7-28
changelog:
  - Web interface didn't show completed jobs for printer (STR #3436, bug #625900)
  - Serial backend didn't allow a raw job to be canceled (STR #3649, bug #625955)
  - Fixed condition in textonly filter to create temporary file
    regardless of the number of copies specified. (bug #660518)


author: Jiri Popelka <jpopelka@redhat.com> 1:1.3.7-29
changelog:
  - The imageto* filters could crash with bad GIF files
    (CVE-2011-2896, STR #3867, STR #3914, bug #752118).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-31
changelog:
  - Applied patch to fix CVE-2012-5519 (privilege escalation for users
    in SystemGroup or with equivalent polkit permission).  This prevents
    HTTP PUT requests with paths under /admin/conf/ other than that for
    cupsd.conf, and also prevents such requests altering certain
    configuration directives such as PageLog and FileDevice (bug #875898).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-32
changelog:
  - New SSLOptions directive to enable SSL3 and/or RC4, which are now
    disabled by default (bug #1161218).


author: Remi Collet <rcollet@redhat.com> - 5.3.3-17
changelog:
  - reorder security patches
  - add security fixes for CVE-2012-2688, CVE-2012-0831,
    CVE-2011-1398, CVE-2013-1643


author: Remi Collet <rcollet@redhat.com> - 5.3.3-23
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-25
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-13
changelog:
  - do not crash when using a lot of file descriptors (#958195)
  - fix errors in man page (#891503)
  - fix for command substitutions caused regressions, use different fix (#912443)
  - pipe used in command substitution could affect return codes (#892206)
  - prevent fork bomb trigered by SIGSTP (#910923)
  - fix handling of SIGTTOU signal (#888749)
  - fix memory leak when using arrays in functions (#921138)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-392.el5]
changelog:
  - [redhat] kabi: Adding symbol pci_num_vf (Jiri Olsa) [999389]
  - [fs] gfs2: Allocate directory memory with GFP_NOFS (Robert S Peterson) [1103256]
  - [kernel] compat: compat_sys_times: don't take tasklist_lock (Mateusz Guzik) [984541]
  - [fs] nfs4: Add recovery for individual stateids (Dave Wysochanski) [867570]
  - [fs] nfs4: Don't start state recovery in nfs4_close_done (Dave Wysochanski) [867570]
  - [s390] kernel: fix save and restore of the fp-control register (Hendrik Brueckner) [1034342]
  - [net] bridge: fix some kernel warning in multicast timer (Amerigo Wang) [902454]
  - [net] bridge: send query as soon as leave is received (Amerigo Wang) [902454]
  - [net] bridge: only expire the mdb entry when query is received (Amerigo Wang) [902454]
  - [net] bridge: Fix typo that may render snooping less effective (Amerigo Wang) [902454]
  - [net] AF_UNIX: EOF on non-blocking SOCK_SEQPACKET (Swapnil Nagarkar) [1025410]
  - [fs] gfs2: clear directory cache from master directory at unmount (Robert S Peterson) [859964]
  - [net] netlink: Make netlink processing routines semi-synchronious (Daniel Borkmann) [947562]
  - [xen] page-alloc: scrub anonymous domain heap pages upon freeing (Vitaly Kuznetsov) [1103649]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-393.el5]
changelog:
  - [fs] jbd: don't wake kjournald unnecessarily (Denys Vlasenko) [1081785]
  - [fs] jbd: don't wait (forever) for stale tid caused by wraparound (Denys Vlasenko) [1081785]
  - [fs] ext4: fix waiting and sending of barrier in ext4_sync_file() (Denys Vlasenko) [1081785]
  - [fs] jbd2: Add function jbd2_trans_will_send_data_barrier() (Denys Vlasenko) [1081785]
  - [fs] jbd2: fix sending of data flush on journal commit (Denys Vlasenko) [1081785]
  - [fs] ext4, jbd2: Add barriers for file systems with ext journals (Denys Vlasenko) [1081785]
  - [fs] jbd: fix fsync() tid wraparound bug (Denys Vlasenko) [1081785]
  - [fs] ext4: fix fdatasync() for files with only i_size changes (Eric Sandeen) [1102768]
  - [fs] ext3: explicitly rm inode from orphan list after failed io (Eric Sandeen) [1088041]
  - [infiniband] mlx4: Fix BlueFlame race (Amir Vadai) [1088582]


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-1.66.1.13.0
changelog:
  - updated to icedtea 1.13
  - updated to openjdk-6-src-b28-04_oct_2013
  - added --disable-lcms2 configure switch to fix tck
  - removed upstreamed patch7,java-1.6.0-openjdk-jstack.patch
  - added patch7 1.13_fixes.patch to fix 1.13 build issues
  - adapted patch0 java-1.6.0-openjdk-optflags.patch
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - removed useless runtests parts
  - included also java.security.old files
  - adapted patch8 java-1.6.0-openjdk-pstack.patch 
  - Resolves: rhbz#1017616


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-3.1.13.0
changelog:
  - updated to icedtea 1.13.1
   - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/
  - updated to jdk6, b30,  21_jan_2014
   - https://openjdk6.java.net/OpenJDK6-B30-Changes.html
  - adapted patch7 1.13_fixes.patch
  - pre 2011 changelog moved to (till now  wrong) pre-2009-spec-changelog (rh1043611)
  - added --disable-system-lcms to configure options to pass build
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#1050188


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-5.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - renmoved upstreamed patch9, 1051245.patch
  - Resolves: rhbz#1085008


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - Resolves: rhbz#1115866


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148898


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Also includes PR2180, so patch dropped from RPM.
  - Resolves: rhbz#1180289


author: Soren Sandmann <ssp@redhat.com> 1.2.2-1.0.5.el5
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Benjamin Tissoires <btissoir@redhat.com> 1.2.2-1.0.6
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-14
changelog:
  - fix possible buffer overflow in pdo_odbc (#869694)
  - rename php-5.3.3-extrglob.patch and reorder
  - php script hangs when it exceeds max_execution_time
    when inside an ODBC call (#864954)
  - fix zend garbage collector (#892695)
  - fix transposed memset arguments in libzip (#953818)
  - fix possible segfault in pdo_mysql (#869693)
  - fix imap_open DISABLE_AUTHENTICATOR param ignores array (#859369)
  - fix stream support in fileinfo (#869697)
  - fix setDate when DateTime created from timestamp (#869691)
  - fix permission on source files (#869688)
  - add php(language) and missing provides (#837044)
  - fix copy doesn't report failure on partial copy (#951413)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-15
changelog:
  - fix segfault in error_handler with
    allow_call_time_pass_reference = Off (#951075)
  - fix double free when destroy_zend_class fails (#951076)


author: Honza Horak <hhorak@redhat.com> 5.5.31-10
changelog:
  - Fix service status for unprivileged user
    Resolves: #975117
  - Add README.mysql-devel to document how -devel package should be used
    Resolves: #975119


author: Honza Horak <hhorak@redhat.com> 5.5.32-1
changelog:
  - Update to MySQL 5.5.32, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html
    Resolves: #975113
  - Use man pages from 5.5.30 due to license change
    Resolves: #975785
  - Fix issues found by Coverity
    Resolves: #975904


author: Honza Horak <hhorak@redhat.com> 5.5.32-2
changelog:
  - Fix text in mysql-readme-devel for RHEL-5
    Resolves: #975119
  - Fix misleading error message when uninstalling built-in plugins
    Resolves: #985402
  - Do not use pie linker flags, they don't work in RHEL-5
    Resolves: #985418


author: Honza Horak <hhorak@redhat.com> 5.5.36-1
changelog:
  - Update to MySQL 5.5.36, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-36.html
    Including fixes for CVE-2014-0412, CVE-2014-0437, CVE-2013-5908,
    CVE-2013-5807, CVE-2014-0420, CVE-2014-0393, CVE-2013-5891,
    CVE-2014-0386, CVE-2013-3839, CVE-2014-0401, CVE-2014-0402,
    CVE-2014-0001
    Resolves: #1055876


author: Honza Horak <hhorak@redhat.com> - 5.5.37-1
changelog:
  - Update to MySQL 5.5.37, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html
    Includes fixes for: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432
    CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1089203


author: Matej Muzila <mmuzila@redhat.com> - 5.5.40-1
changelog:
  - Rebase to 5.5.40
    Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464
    CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
    CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564
    Resolves: #1160514


author: Tomas Heinrich <theinric@redhat.com> 5.8.12-1
changelog:
  - rebase from rsyslog-3.22.1-7 to rsyslog-5.8.12
    fixing: #769599, #820396, #823778, #831539
  - add several directories for storing auxiliary data
  - drop unneeded patches


author: Peter Vrabec <pvrabec@redhat.com> 5.8.12-2
changelog:
  - prepare package for dual component situation in RHEL5
  - rename to rsyslog5
  - conflicts with rsyslog
    Resolves: #820396


author: Remi Collet <rcollet@redhat.com> - 5.1.6-45
changelog:
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
  - xmlrpc: fix buffer overflow in date parser #1155607


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.39.1.11.11
changelog:
  - added and applied (temporally) one more patch to xalan/xerces privileges
   - patch9 jaxp-backport-factoryfinder.patch
  - will be upstreamed
  - Resolves: rhbz#950384


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950384


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.41.1.11.11.90
changelog:
  - updated to icedtea6-1.11.11.90.tar.gz
  - removed upstreamed patch9 jaxp-backport-factoryfinder.patch
  - removed upstreamed patch10 fixToFontSecurityFix.patch.
  - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#973128


author: Patsy Franklin <pfrankli@redhat.com> 2013i-1
changelog:
  - Rebase with early release of 2013i from Paul Eggert github.
    - Jordan switches back to standard time at 00:00 on December 20,2013.
    - The 2006-2011 transition schedule is planned to resume in 2014.
    - The compile-time flag NOSOLAR has been removed.
    - The files solar87, solar88, and solar89 are no longer distributed.
    - tz-link.htm now mentions Noda Time.


author: Patsy Franklin <pfrankli@redhat.com> - 2014b-1
changelog:
  - Rebase to 2014b
    - Crimea switches to Moscow time on 2014-03-30 at 02:00 local time.
    - New entry for Troll station, Antarctica.


author: Patsy Franklin <pfrankli@redhat.com> - 2014c-1
changelog:
  - Rebase to 2014c
    - Egypt's government to re-apply daylight saving time.
    - zic now generates transitions for minimum time values
    - Port to Cygwin sans glibc.
    - Remove now-confusing comment about Jordan.


author: Patsy Franklin <pfrankli@redhat.com> - 2014d-1
changelog:
  - Rebase to 2014d
    - zic no longer generates files containing time stamps before
      the Big Bang.  This works around GNOME bug 730332


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-1
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan 
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00


author: Patsy Franklin <pfrankli@redhat.com> - 2014f-1
changelog:
  - Rebase to 2014f
    - Several Russian time zone changes effective on 2014-10-26
      at 02:00 local time.  See NEWS file for additional details.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-22
changelog:
  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
    vulnerability and additional DTLS fixes (#771770)
  - fix for CVE-2011-4109 - double free in policy checks (#771771)
  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-23
changelog:
  - fix problem with the SGC restart patch that might terminate handshake
    incorrectly
  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
  - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-27
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use __secure_getenv() everywhere instead of getenv() (#839735)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-30
changelog:
  - fix CVE-2014-0221 - recursion in DTLS code leading to DoS
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-119
changelog:
  - Add support for newer L3 caches on x86-64 and correctly count
    the number of hardware threads sharing a cacheline (#1003420).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-121
changelog:
  - Fix return code when starting an already started nscd daemon (#979413).
  - Fix getnameinfo for many PTR record queries (#1020486).
  - Return EINVAL error for negative sizees to getgroups (#995207).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-123
changelog:
  - Remove gconv transliteration loadable modules support (CVE-2014-5119,
    - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,


author: Jason Vas Dias <jvdias@redhat.com> - 3.1.8-81
changelog:
  - rebuild for new gcc, glibc, glibc-kernheaders
  - workaround new refusal of /usr/bin/install to chown


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-72.el5
changelog:
  - add part-backported fix to avoid possible use-after-free when encrypting
    delegated creds (Jatin Nansi, #1004632)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-73.el5
changelog:
  - incorporate backported upstream patch for remote crash of KDCs which serve
    multiple realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-74.el5
changelog:
  - add patch based on one from Filip Krska to not call poll() with a negative
    timeout when the caller's intent is for us to just stop calling it (#1089732)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-75.el5
changelog:
  - pull in backported fix for denial of service by injection of malformed
    GSSAPI tokens (CVE-2014-4341, #1121509)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-78.el5
changelog:
  - gssapi: pull in upstream fix for a possible NULL dereference in spnego
    (CVE-2014-4344, #1121509)


author: Patsy Franklin <pfrankli@redhat.com> - 2014g-1
changelog:
  - Rebase to 2014g
    - Turks & Caicos is switching from US eastern time to UTC-4
      year-round, modeled as a switch from EST/EDT to AST
      on 2014-11-02 at 02:00.


author: Petr Machata <pmachata@redhat.com> - 2014h-1
changelog:
  - Rebase to 2014h
    - Changes to historical transitions in America/Jamaica and
      Asia/Novokuznetsk.
    - Africa/{Blantyre, Bujumbura, Gaborone, Harare, Kigali, Lubumbashi,
      Lusaka} now alias Africa/Maputo, because they don't differ in
      post-1970 stamps.
    - Africa/Maseru and Africa/Mbabane now alias Africa/Johannesburg for
      the same reason.


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-35
changelog:
  - add missing 'ed' builddep
  - set LDFLAGS and CPPFLAGS so that our local copy of DB is more likely to be
    found by the configure script


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-35.2
changelog:
  - when setting file contexts for creation of new files, only fail outright
    if we were in enforcing mode and the file needed to be given a specific
    label (#368281)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-36
changelog:
  - import Kees Cook's patch to fix accidental leakage of part of ./DB_CONFIG
    (#580543, CVE-2010-0826)


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-28
changelog:
  - Proper region tag validation on package/header read (CVE-2012-0060)
  - Double-check region size against header size (CVE-2012-0061)
  - Validate negated offsets too in headerVerifyInfo() (CVE-2012-0815)


author: Florian Festi <ffesti@redhat.com> - 4.4.2.3-29
changelog:
  - Add DWARF 3 and 4 support to debugedit (#808547)
  - No longer add \n to group tag in Python bindings (#783451)
  - Fix typos in Japanese rpm man page (#760552)
  - Bump Geode compatibility up to i686 (#620570)


author: Florian Festi <ffesti@redhat.com> - 4.4.2.3-30
changelog:
  - Document -D and -E options in man page (#814602)
  - Require matching arch for freshen on colored transactions (#813282)


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-33
changelog:
  - Account for excludes and hardlinks wrt payload max size (#716853)
  - Fix payload size tag generation on big-endian systems (#648516)


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-34
changelog:
  - Fix segfault on rpmdb addition when header unload fails (#706935)
  - Fix segfault on invalid OpenPGP packet (#743203)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-35
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163057)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to nss-3.15.3
  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Remove unused patch and retag for update to nss-3.15.3
  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Pick up corrections made in the rhel-10.Z branch, remove an unused patch
  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042684 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Improve shell code for error detection on %check section
  - Resolves: Bug 1035281 - Suboptimal shell code in nss.spec


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-1
changelog:
  - Rebase to nss-3.16.1 for FF31
  - Resolves: Bug 1110860 - Rebase nss in RHEL 5.11 to NSS 3.16.1, required for FF 31


author: Kai Engert <kaie@redhat.com> - 3.16.1-4
changelog:
  - Adjust softokn patch to be compatible with legacy softokn API.
  - Resolves: Bug 1145430 - CVE-2014-1568


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.4.1.el5
changelog:
  - updated to security icedtea 2.4.4
   - icedtea_version set to 2.4.4
   - updatever bumped to       51
   - release reset to 1
  - build requires: java-devel >= 1:1.6.0 changed java7-devel 
  - Resolves: rhbz#1050193


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.55-2.4.7.0.el5
changelog:
  - bumped to future icedtea-forest 2.4.7
  - updatever set to 55, buildver se to 13, release reset to 0
  - removed BuildRequires on pulseaudio >= 0.9.1, devel is enough
  - removed Requires: rhino, BuildRequires is enough
  - updated patch400, java-1.7.0-openjdk-remove-gstabs.patch
  - added JRE_RELEASE_VERSION and ALT_PARALLEL_COMPILE_JOBS
  - ppc64 repalced by power64 macro
  - patch111 applied as dry-run (6.5 forward port)
  - Resolves: rhbz#1085001


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115873


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.71-2.5.3.1
changelog:
  - Bump to 2.5.3 with security updates.
  - Remove obsolete patches which are now included upstream.
  - Disable LCMS via environment variables rather than maintaining a patch.
  - Resolves: rhbz#1148890


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.0
changelog:
  - Bump to 2.5.4 using OpenJDK 7u75 b13.
  - Fix elliptic curve list as part of fsg.sh
  - Resolves: rhbz#1180294


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.7-5
changelog:
  - change permissions of deliver and dovecot.conf to prevent possible password exposure
  - Resolves: #436287


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.7-7
changelog:
  - permissions of deliver and dovecot.conf from 1.0.7-5 reverted
  - password can be stored in different file readable only for root now
  - Resolves: #436287, CVE-2008-4870


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.97
changelog:
  - xserver-1.1.1-x86emu-1.13.patch: Sync x86emu bugfixes with upstream
    xserver. (#858014)
  - xserver-1.1.1-xkb-width-fix.patch: Fix a crash in XKB keymap resize
    across different RHELs. (#822438)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.100
changelog:
  - xserver-1.1.1-more-regen-leaks.patch: Cope with root cursor refcounting
    being differently broken in different DDXes. (#498357)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.104
changelog:
  - xserver-1.1.1-randr-config-timestamps.patch: Backport timestamp comparison
    fix from upstream RANDR code (#1006076)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.107
changelog:
  - CVE-2014-8091 denial of service due to unchecked malloc in client
    authentication (#1168680)
  - CVE-2014-8092 integer overflow in X11 core protocol requests when
    calculating memory needs for requests (#1168684)
  - CVE-2014-8097 out of bounds access due to not validating length or offset
    values in DBE extension (#1168705)
  - CVE-2014-8095 out of bounds access due to not validating length or offset
    values in XInput extension (#1168694)
  - CVE-2014-8096 out of bounds access due to not validating length or offset
    values in XC-MISC extension(#1168700)
  - CVE-2014-8099 out of bounds access due to not validating length or offset
    values in XVideo extension (#1168710)
  - CVE-2014-8100 out of bounds access due to not validating length or offset
    values in Render extension (#1168711)
  - CVE-2014-8102 out of bounds access due to not validating length or offset
    values in XFixes extension (#1168714)
  - CVE-2014-8101 out of bounds access due to not validating length or offset
    values in RandR extension (#1168713)
  - CVE-2014-8093 xorg-x11-server: integer overflow in GLX extension requests
    when calculating memory needs for requests (#1168688)
  - CVE-2014-8098 xorg-x11-server: out of bounds access due to not validating
    length or offset values in GLX extension (#1168707)


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.7-10
changelog:
  - fix bug when unselect command on proxy mode caused segmentation fault (#679253)
  - fix lmtp ignorequota on ia64 (#584088)
  - replace instances of #!/usr/bin/env python with #!/usr/bin/python (#521338)
  - don't require lm_sensors-devel, net-snmp-devel is enough (#437999)
  - fix file descriptor leak when moving mailbox folder with quota set (#253854)
  - document that client ignores mupdate_port option (#504813)


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.7-14
changelog:
  - fix CVE-2011-3481: NULL pointer dereference via crafted 
    References header in email (#738391)
  - fix CVE-2011-3372: nntpd authentication bypass (#740822)


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-16
changelog:
  - fixed snmpd showing wrong UCD-SNMP-MIB::ssCpuIdle after 30 days of uptime
    on 32-bit platforms (#663789)
  - fixed parsing of OID argument of 'smuxpeer' configuration option (#751235)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-18
changelog:
  - added support of ocfs2, tmpfs and reiserfs in hrStorageTable
    (#754652, #755958, #822061)
  - updated documentation of '-c' option of snmptrapd (#760001)
  - fixed endless loop after truncating 64bit int (#783892)
  - fixed snmpd exiting shortly after startup due to incoming signal (#799699)
  - fixed decoding of COUNTER64 values from AgentX (#803585)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#805689)
  - fixed CVE-2012-2141, an array index error in the extension table (#815813)
  - fixed snmpd showing "failed to run mteTrigger query" when 'monitor'
    config option is used (#830042)
  - added support for port numbers in 'clientaddr' configuration option
    (#828691)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-19
changelog:
  - fixed support for port numbers in 'clientaddr' configuration option
    (#840861, #845974)
  - added support of cvfs filesystem hrStorageTable (#846391)
  - removed various error log messages when IPv6 is disabled (#845155)
  - removed various error log messages related to counte64 expansions
    (#846905)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20
changelog:
  - fixed error message when the address specified by clientaddr option
    is wrong or cannot be bound (#840861)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20.1
changelog:
  - Fixed CVE-2012-6151: snmpd crashing when AgentX subagent disconnects in
    the middle of request processing (#1073224)
  - Fixed CVE-2014-2285: snmptrapd crash when using a trap with empty community
    string (#1073224)


author: - Andreas Schneider <asn@redhat.com> - 3.6.22-2
changelog:
  - related: #976637 - More cleanup for 'force user' with 'security = ads'.
  - resolves: #1069571 - Fix memory leak reading printer list.
  - resolves: #1067608 - Fix wbinfo -i with one-way trusts.


author: - Andreas Schneider <asn@redhat.com> - 3.6.23-3
changelog:
  - resolves: #1100658 - Allocate the server_info on the correct context.
  - resolves: #1101922 - Add config variables to set spoolss os version.


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.23-5
changelog:
  - resolves: #1112151 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1112151 - CVE-2014-3493: DoS in smbd with unicode path names.


author: Thomas Woerner <twoerner@redhat.com> 8.13.7-3
changelog:
  - using new syntax for access database (#177566)
  - fixed failure message while shutting down sm-client (#119429)
    resolution: stop sm-client before sendmail
  - fixed method to specify persistent queue runners (#126760)
  - removed patch backup files from sendmail-cf tree (#152955)
  - fixed missing dnl on SMART_HOST define (#166680)
  - fixed wrong location of aliases and aliases.db file in aliases man page
    (#166744)
  - enabled CipherList config option for sendmail (#172352)
  - added user chowns for /etc/mail/authinfo.db and move check for cf files
    (#184341)
  - fixed Makefile of vacation (#191396)
    vacation is not included in this sendmail package
  - /var/log/mail now belongs to sendmail (#192850)


author: Miroslav Lichvar <mlichvar@redhat.com> 8.13.8-6.el5
changelog:
  - fix verification of SSL certificate with NUL in name (#553618, CVE-2009-4565)
  - do not accept localhost.localdomain as valid address from smtp (#449391)
  - skip colon separator when parsing service name in ServiceSwitchFile (#512871)
  - exit with non-zero error code when free space is low (#299951)
  - fix -qG description in man page (#250552)
  - fix comments in sendmail.mc to use correct certs path (#244012)
  - add MTA to provides (#494408)
  - fix %dist macro use (#440616)
  - compile with -fno-strict-aliasing
  - skip t-sem test as it doesn't allow parallel testing


author: Jan Horak <jhorak@redhat.com> - 31.3.0-9
changelog:
  - Fixed problems with dictionaries (mozbz#1097550)
  - Fixed rhbz#1164855 - firefox.desktop is missing
    x-scheme-handler MimeType entries


author: Adam Tkac <atkac redhat com> 32:9.7.0-13.P2
changelog:
  - fixed various bind-chroot packaging errors (#829823)
  - generate rndc.key during `service named start` (#829827)
  - nslookup: return non-zero exit code when fail to get answer (#829829)
  - named could fail to send a uncompressable zone


author: <jdennis@redhat.com> - 2.0.2-1
changelog:
  - Resolve bug #428252: Problem with update/remove old version
  	- Add code to validate xml database version, if file is incompatible it is not read,
  	  the next time the database is written it will be in the new version format.
  	  This means the database contents are not preserved across database version upgrades.
  	- Remove postun trigger from spec file used to clear database between incompatible versions
  	  the new database version check during database read will handle this instead
  	- bullet proof exit status in init script and rpm scriptlets
  	- Resolve bug #247302: setroubleshoot's autostart .desktop file fails to start under a KDE session
  	- Resolve bug #376041: Cannot check setroubleshoot service status as non-root
  	- Resolve bug #332281: remove obsolete translation
  	- Resolve bug #344331: No description in gnome-session-properties
  	- Resolve bug #358581: missing libuser-python dependency
  	- Resolve bug #426586: Renaming translation po file from sr@Latn to sr@latin
  	- Resolve bug #427260: German Translation
  	- enhance the sealert man page


author: John Dennis <jdennis@redhat.com> - 2.0.5-2
changelog:
  - Resolve: bug #437857: python error in system shutdown
  	- Resolve: bug #436564: socket.getsockopt() on ppc generates exception


author: John Dennis <jdennis@redhat.com> - 2.0.5-3
changelog:
  - Resolve: bug #436564: socket.getsockopt() on ppc generates exception
  	  Fix typo in original setroubleshoot-get_credentials.patch


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-2
changelog:
  - New upstream release
  - Use the upstream xattr patch instead of mine.  This closes
    bz#190208 CVE-2006-2083 rsync buffer overflow issue


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-3
changelog:
  - Add my xattrs_bug patch to fix a bug where xattrs don't get sent correctly.
  - Add BuildRequires to make sure libattr-devel and libacl-devel are avaliable
  - replace --with... with --enable... so they actually work
  - Add make, autoconf and gcc to BuildRequires


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 3.0.6-1
changelog:
  - Rebase to upstream version 3.0.6
    Resolves: #339971, #471182, #575022, #616093
  - Make "-d, --dirs options" behaviour backward-compatible with 2.6.8
    Resolves: #339971 (comment #5)
  - Truncate a copied sparse file at the end of transaction (-S, --sparse option)
    Resolves: #530866
  - Add -fno-strict-aliasing to CFLAGS
  - Remove obsolete rsync-2.6.8-xattr_bug.patch
  - Switch license to GPLv3+ (upstream change beginning with 3.0.0)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 3.0.6-2
changelog:
  - Remove BuildRequires dependency on popt-devel, until the package
    is being shipped with RHEL-5 (resolve build issues)


author: Vojtech Vitek <vvitek@redhat.com> - 3.0.6-3
changelog:
  - Add upstream patch to fix CVE-2011-1097 - Incremental file-list
    corruption due to temporary file_extra_cnt increments
    Resolves: #688923


author: Deepak Bhole <dbhole@redhat.com> - 1:3.0-6jpp_1fc
changelog:
  - Added conditional native compilation.
  - Disable certain ssl related tests that are known to fail with libgcj.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-21
changelog:
  - add known answer test for SHA2 algorithms (#740866)
  - make default private key length in certificate Makefile 2048 bits
    (can be changed with PRIVATE_KEY_BITS setting) (#745410)
  - fix incorrect return value in parse_yesno() (#726593)
  - added DigiCert CA certificates to ca-bundle (#735819)
  - added a new section about error states to README.FIPS (#628976)


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-34.el5
changelog:
  - Avoid double free of nested loop variable (RT#70660). Back-ported from
    perl-5.10.1. Reverts code of perl-5.8.8-bug24254.patch as it provides better
    solution. (Resolves: rhbz#625746)


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-35.el5
changelog:
  - Define number of tests in ext/threads/t/libc.t (Related: rhbz#676050)
  - Redirect CGI::Cookie->bake test output to error output not to pollute TAP
    protocol (Related: rhbz#702389)
  - Reenable tests for s390x and ia64 (Related: rhbz#675863)


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.8.8-37.el5
changelog:
  - 527275 remove h2ph patch, which didn't work
  - 702389 change rebase of CGI into upstream patch
  - 593752 NDBM_File needs change in Configure to be able find ndbm.h
  - Related: rhbz#702389, rhbz#593752


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-40
changelog:
  - Fix CVE-2012-5195 heap buffer overrun at repeatcpy (Resolves: rhbz#915691)
  - Fix CVE-2012-5526 newline injection due to improper CRLF escaping in
    Set-Cookie and P3P headers (Resolves: rhbz#915691)
  - Fix CVE-2012-6329 possible arbitrary code execution via Locale::Maketext
    (Resolves: rhbz#915691)
  - Fix CVE-2013-1667 DoS in rehashing code (Resolves: rhbz#915691)


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-42
changelog:
  - Fix perl segfaults with custom signal handle (Resolves: rhbz#991854)
  - Reorder AnyDBM_File back-end preference (Resolves: rhbz#1018721)
  - Fix backslash interpolation in Locale::Maketext (Resolves: rhbz#1029016)
  - Enable year 2038 for Time::Local on 64-bit platforms (Resolves: rhbz#1057047)


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-43
changelog:
  - Do not extend allowable epoch values in Time::Local::timelocal to remove
    useless warning on 64-bit platforms (Resolves: rhbz#1149375)


author: Roman Rakus <rrakus@redhat.com> - 3.2-28
changelog:
  - Fix the memory leak in read builtin
    Resolves: #618393
  - Don't append slash to non-directories
    Resolves: #583919


author: Roman Rakus <rrakus@redhat.com> - 3.2-33
changelog:
  - Fixed a bug that caused trap handlers to be executed recursively,
    corrupting internal data structures.
    Resolves: #964753


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.18.el5
changelog:
  - Fix parser local buffers size problems (rhbz#843740)
  - Fix entities local buffers size problems (rhbz#843740)
  - Fix an error in previous commit (rhbz#843740)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.20.el5
changelog:
  - Implement some default limits in the XPath module (CVE-2011-1944)
  - Change the XPath code to percolate allocation errors (CVE-2011-1944)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.22.el5
changelog:
  - fix validation issues with some XSD (rhbz#877348)
  - xmlDOMWrapCloneNode discards namespace of the node parameter (rhbz#884707)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.24.el5
changelog:
  - fixed one regexp bug and added a (rhbz#922450)
  - Another small change on the algorithm for the elimination of epsilon (rhbz#922450)


author: Martin Stransky <stransky@redhat.com> - 24.4.0-3
changelog:
  - Added a workaround for Bug 1054242 - RHEVM: Extremely high memory
    usage in Firefox 24 ESR on RHEL 6.5


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-1
changelog:
  - upgrade to 1.0.15
  - http://www.wireshark.org/docs/relnotes/wireshark-1.0.15.html
  - fixes CVE-2010-2287 CVE-2010-2284
  - Related: #612239


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-1.4
changelog:
  - fix few security issues
  - Resolves: CVE -2011-0024 CVE-2011-0538 CVE-2011-1139 CVE-2011-1140
    CVE-2011-1141 CVE-2011-1143 #612240


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-2
changelog:
  - fixed tshark -s option (#580513)
  - fixed tshark exit code when dumpcap fails (#580510)
  - fixed editing of columns in Wireshark preferences (#493693)
  - added netdump protocol dissector (#484999)
  - fixed tshark / Wireshark automatic filter when started in ssh connection
    over IPv6 (#438473)


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-3
changelog:
  - fixed various flaws: CVE-2011-1959 CVE-2011-2175 CVE-2011-1958 
    CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066
    CVE-2012-0067


author: Peter Hatina <phatina@redhat.com> 1.0.15-6
changelog:
  - security patches
  - Resolves: CVE-2012-6056
              CVE-2012-6060
              CVE-2012-6061
              CVE-2012-6062
              CVE-2013-3557
              CVE-2013-3559
              CVE-2013-4081
              CVE-2013-4083
              CVE-2013-4927
              CVE-2013-4931
              CVE-2013-4932
              CVE-2013-4933
              CVE-2013-4934
              CVE-2013-4935
              CVE-2013-5721
              CVE-2013-7112
              CVE-2014-2281
              CVE-2014-2299


author: Peter Hatina <phatina@redhat.com> 1.0.15-7
changelog:
  - security patches
  - Resolves: CVE-2014-6421
              CVE-2014-6423
              CVE-2014-6425
              CVE-2014-6428
              CVE-2014-6429


author: Dave Anderson <anderson@redhat.com> - 4.1.2-3.el5
changelog:
  - Fix for the "bt" command on an ia64 "INIT" process that interrupted
    a task that was running in user space, but was unable to modify the
    original (interrupted) task's stack.  Without the patch, the "INIT"
    task's backtrace would not display the task that was interrupted,
    and would display the error message "bt: unwind: failed to locate
    return link (ip=<user-virtual-address>)!".  With the patch, the
    interrupted task information is displayed in the same manner as if
    the original stack had been modified.
  - Resolves: rhbz#553353


author: Dave Anderson <anderson@redhat.com> - 4.1.2-4.el5
changelog:
  - Fix for very large xendump core files whose ELF sections are located
    beyond a file offset of 4GB.
  - Resolves: rhbz#561767


author: Dave Anderson <anderson@redhat.com> - 4.1.2-5.el5
changelog:
  - Fix for backtrace of x86 NMI-interrupted task with a user exception frame
    from a syscall exception that had not called the requested system call 
    function.
    Fix for backtrace when a newly-forked x86 task's resumption EIP address 
    value is set to the "ret_from_fork" entry point by copy_thread().
    Resolves: rhbz#572605
  - Fix for segmentation violation with the "mach -m" command option on x86 
    or x86_64 systems whose BIOS-provided e820 map contains EFI-related memory
    type value that has not been mapped to an E820 type.
    Resolves: rhbz#569164
  - Fix for the "kmem -s list" command option to prevent it from attempting
    to gather a slab cache name string from the "cache_chain" list_head.
    Resolves: rhbz#580589
  - Change the ppc64 cpu count displayed by the initial system banner
    and by the "sys" and "mach" commands to be the number of cpus online.
    Resolves: rhbz#580599
  - Fix for backtrace of an x86_64 NMI-interrupted task which had not 
    swapped its RSP from the user-space stack to the kernel stack.
    Resolves: rhbz#593066


author: Dave Anderson <anderson@redhat.com> - 4.1.2-6.el5
changelog:
  - Support for "__rhel5" marker device in KVM dumpfile header.
    Resolves: rhbz#603027
  - Fix for the x86 "bt" command to generically recognize the end of trace
    condition for user-space tasks without having to hardwire any more 
    kernel entry point function names.
    Resolves: rhbz#608714
  - Fix for the x86_64 "bt" command if the kdump-generated NMI interrupts
    a multi-threaded task that has just entered kernel space but has not
    changed the RSP stack pointer register from its user-space per-thread
    stack location to the kernel stack.
    Resolves: rhbz#608171


author: Dave Anderson <anderson@redhat.com> - 4.1.2-7.el5
changelog:
  - Fix for the x86 "bt" command for potential backtrace error of a
    NMI-interrupted idle task.
    Resolves: rhbz#653288
  - Fix for the x86 "bt" command to fix Xen hypervisor backtrace errors 
    generated when a NMI-interrupted VCPU is running within the hypercall
    entry point, and when a NMI-interrupted VCPU is running within an
    interrupt handler entry point.
    Resolves: rhbz#653823


author: Dave Anderson <anderson@redhat.com> - 4.1.2-8.el5
changelog:
  - Fix for potential segmentation violation in glibc malloc/free when 
    running "kmem -s" on a large, active, live system.
    Resolves: rhbz#659593


author: Dave Anderson <anderson@redhat.com> - 5.1.8-1.el5
changelog:
  - Rebase to upstream version 5.1.8.
    Resolves: rhbz#715072

  - Fix for the x86_64 "bt" command if the shutdown NMI is issued to a
    32-bit task that has executed a "sysenter" instruction and the RSP
    still contains the zero value loaded from the MSR_IA32_SYSENTER_ESP
    register.  The backtrace issued a warning message indicating 
    "WARNING: possibly bogus exception frame", and was unable to make a 
    transition from the NMI exception stack back to the process stack. 
    Resolves: rhbz#676408

  - Fix for the x86 "bt" command for several backtraces of non-crashing
    active tasks that fail with "bt: cannot resolve stack trace" errors
    due to the failure to properly transition from the shutdown NMI stack 
    back to the process stack.
    Resolves: rhbz#713050

  - Fix to more correctly determine the KVM I/O hole size and location.
    The I/O hole size to this point in time is either 1GB or 512MB, but
    its setting is hardwired into the Qemu code that was used to create 
    the dumpfile.  The dumpfile is a "savevm" file that is designed to be
    used for guest migration, and since inter-version save/load is not 
    supported, the I/O hole information does not have to be encoded into the
    dumpfile.  Without the patch, the I/O hole for dumpfiles created by 
    older Qemu version was not being set to 1GB, so if the KVM guest was 
    configured with more than 3GB of memory, the crash session would 
    typically display numerous "read error" messages during session 
    initialization.
    Resolves: rhbz#715070

  - Fix for KVM dumpfiles from guests that were provisioned with more
    than 3.5GB of RAM.  KVM virtual systems contain an I/O hole in the
    physical memory region from 0xe0000000 to 0x100000000 (3.5GB to 4GB).
    If a guest is provisioned with more than 3.5GB of RAM, then the
    memory above 3.5GB is "pushed up" to start at 0x100000000 (4GB).
    But the "ram" device headers in the KVM dumpfiles do not reflect
    that, and so without the patch, numerous error messages would be
    displayed during invocation, and in all probability, the session
    would fail.
    Resolves: rhbz#716327


author: Dave Anderson <anderson@redhat.com> - 5.1.8-2.el5
changelog:
  - Fix to handle xen dom0 dumpfiles created with "makedumpfile -d1" on very
    large systems, where the ELF vmcore may be mistakenly determined to be
    an old-style netdump vmcore.  
    Resolves: rhbz#876046


author: Milan Broz <mbroz@redhat.com> - 1.02.55-2
changelog:
  - Allocate buffer for reporting functions dynamically to support long outputs.
  - Fix regex optimiser not to ignore RHS of OR nodes in _find_leftmost_common.
    Resolves: #649710 #651349


author: Milan Broz <mbroz@redhat.com> - 1.02.67-1
changelog:
  - Update to latest upstream release, see WHATS_NEW_DM for detailed changelog.
    Resolves: #746300 #454618


author: Jiri Skala <jskala@redhat.com> 7:2.6.STABLE21-1
changelog:
  - Resolves: #297521 update to the latest upstream STABLE21
  - Resolves: #245304 changed init script to be LSB compliant
  - Resolves: #250572 using refresh_stale_hit don't cause "clock going backwards"
  - Resolves: #436135 ported init script bug fixign of RHEL-4 to RHEL-5
  - Resolves: #442108 added define -D_FORTIFY_SOURCE=2
  - Resolves: #454255 fixed -g parameter handling of unix_group helper
  - Resolves: #448086 changed security context of /usr/local/squid to squid ownership:w
  - Resolves: #451923 solved repeated SIGABRTs


author: Jiri Skala <jskala@redhat.com> 7:2.6.STABLE21-4
changelog:
  - Resolves: #521926 - squid 'stop after stop' is not LSB compliant
  - Resolves: #496170 - Add arp filter option
  - Resolves: #516245 - negotiate support not enabled in squid
  - Resolves: #538738 - Squid accelerator mode works only if port 80 is opened
  - Resolves: #470843 - Squid 'error_map' does not work when used 'Accep-Encoding: gzip'


author: Michal Luscon <mluscon@redhat.com> 7:2.6.STABLE21-7
changelog:
  - Resolves: #1134976 - CVE-2013-4115 buffer overflow when processing overly long DNS names
  - Resolves: #1134976 - CVE-2014-3609 assertion failure in header processing


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-11.el5
changelog:
  - fix buffer overflow when parsing Autokey association message 
    (#500784, CVE-2009-1252)
  - fix buffer overflow in ntpq (#500784, CVE-2009-0159)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-13.el5
changelog:
  - don't crash with more than 512 local addresses (#661934)
  - add -I option (#528799)
  - fix -L option to not require argument (#460434)
  - move ntpd and ntpdate to /sbin and start earlier on boot (#470945, #689636)
  - increase memlock limit (#575874)
  - ignore tentative addresses (#489835)
  - print synchronization distance instead of dispersion in ntpstat (#679034)
  - fix typos in ntpq and ntp-keygen man pages (#664524, #664525)
  - clarify ntpd -q description (#591838)
  - don't verify ntp.conf (#481151)
  - replace Prereq tag


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-15.el5
changelog:
  - revert init script priority (#470945, #689636)
  - drop tentative patch (#489835)
  - move restorecon call to %posttrans


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-18.el5
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)


author: Miloslav Trmač <mitr@redhat.com> - 4.15-2.el5.1
changelog:
  - Fix "protocol = smtp"
    Resolves: #284801
  - Use a clearer error message if an unknown port is specified
    Resolves: #450344


author: Tomas Smetana <tsmetana@redhat.com> - 3:2.1.9-4
changelog:
  - fix #252185 init script prevents proper SELinux domain transitions
  - fix #242672 wrong init script return value


author: Jan Kaluza <jkaluza@redhat.com> - 3:2.1.9-5
changelog:
  - fix #290661 - use relative symlink in /etc/smrsh
  - fix #461707 - break CC field correctly
  - fix #453377 - don't parse problematic mails many times, but isolate them
  - fix #521888 - fix instances of #!/usr/bin/env python in mailman
  - fix #515157 - fixed traceback when changing email address globally


author: Roman Rakus <rrakus@redhat.com> - 3.2-25
changelog:
  - Don't abort source builtin
    Resolves: #448508
  - Correctly place cursor
    Resolves: #463880
  - Minor man page clarification for trap builtin
    Resolves: #504904


author: Roman Rakus <rrakus@redhat.com> - 3.2-26
changelog:
  - vi mode redo insert fixed
    Resolves: #575076
  - Don't show broken pipe messages for builtins
    Resolves: #546529
  - Don't include loadables in doc dir
    Resolves: #663656
  - Enable system-wide .bash_logout for login shells
    Resolves: #592979


author: Roman Rakus <rrakus@redhat.com> - 3.2-27
changelog:
  - Test .dynamic section if has PROGBITS or NOBITS
    Resolves: #484809
  - Better random number generator
    Resolves: #492908
  - Allow to source scripts with embeded NULL chars
    Resolves: #503701


author: Peter Vrabec <pvrabec@redhat.com> 3.22-17
changelog:
  - fix truncation of mailbox when running into a disk quota or a
    full partition. Patch from Solar Designer.


