# changelog

author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-66
changelog:
  - Release 1.2.11.15-66
  - Resolves: #1270002 - cleanallruv should completely clean changelog (DS 48208)
  - Resolves: #1267405 - many attrlist_replace errors in connection with cleanallruv (DS 48283)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-67
changelog:
  - Release 1.2.11.15-67
  - Resolves: #1234431 - Man pages and help for remove-ds.pl doesn't display "-a" option (DS 48245)
  - Resolves: #1236148 - Slow replication when deleting large  quantities of multi-valued attributes (DS 48195)
  - Resolves: #1236156 - Avoid using regex in ACL if possible (DS 48175)
  - Resolves: #1236656 - Dynamic nsMatchingRule changes had no effect on the attrinfo thus following reindexing, as well. (DS 48212)
  - Resolves: #1240451 - Individual abandoned simple paged results request has no chance to be cleaned up (DS 48192)
  - Resolves: #1244970 - Crash during retro changelog trimming (DS 48206)
  - Resolves: #1245237 - winsync lastlogon attribute not syncing between DS and AD. (DS 48232)
  - Resolves: #1246165 - verify_db.pl doesn't verify DB specified by -a option (DS 48215)
  - Resolves: #1247812 - logconv autobind handling regression caused by 47446 (DS 48231)
  - Resolves: #1253406 - wrong password check if passwordInHistory is decreased. (DS 48228)
  - Resolves: #1255290 - db2index creates index entry from deleted records (DS 48252)
  - Resolves: #1259959 - perl module conditional test is not conditional when checking SELinux policies (DS 48305)
  - Resolves: #1260622 - ns-slapd - LOGINFO:Unable to remove file (DS 48304)
  - Resolves: #1265851 - Double free while adding entries (1.2.11 only) (DS 48287)
  - Resolves: #1273552 - Deadlock between two MODs on the same entry between entry cache and backend lock (DS 47978)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-68
changelog:
  - Release 1.2.11.15-68
  - Resolves: #1278585 - deadlock in mep delete post op (DS 47976) 
  - Resolves: #1247792 - SimplePagedResults -- abandon could happen between the abandon check and sending results (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-69
changelog:
  - Release 1.2.11.15-69
  - Resolves: #1247792 - SimplePagedResults -- abandon could happen between the abandon check and sending results -- Fixing a regression introduced in 1.2.11.15-68 (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-70
changelog:
  - Release 1.2.11.15-70
  - Resolves: #1259959 - perl module conditional test is not conditional when checking SELinux policies - fixing a regression (DS 48305)
  - Resolves: #1282457 - The 'eq' index does not get updated properly when deleting and re-adding attributes in the same ldapmodify operation (DS 48370)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-71
changelog:
  - Release 1.2.11.15-71
  - Resolves: #1284791 - 389-ds-base: ldclt -e randomauthid Segmentation fault. (DS 48289)
  - Resolves: #1290243 - SimplePagedResults -- in the search error case, simple paged results slot was not released (DS 48375)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-72
changelog:
  - Release 1.2.11.15-72
  - Resolves: #1292649 - allow users to specify to relax the FQDN constraint (DS 48332)
  - Resolves: #1294770 - Supplier can skip a failing update, although it should retry (DS 47788)
  - Resolves: #1296694 - ns-slapd crash in ipa context - c_mutex lock memory corruption and self locks (DS 48406, DS 48338 reverted)
  - Resolves: #1297385 - Interpret IPV6 addresses for ACIs, replication, and chaining (DS 196)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-73
changelog:
  - Release 1.2.11.15-73
  - Resolves: #1294770 - Supplier can skip a failing update, although it should retry (DS 47788)
  - Resolves: #1298496 - slapd process crashes on entry modification (DS 47964)
  - Resolves: #1307152 - keep alive entries can break replication (DS 48445)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-74
changelog:
  - Release 1.2.11.15-74
  - Resolves: #1313258 - change severity of some messages related to "keep alive" entries (DS 48420)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-75
changelog:
  - Release 1.2.11.15-75
  - Resolves: #1335108 - Paged results search returns the blank list of entries (DS 48808)
  - Resolves: #1342614 - password history is not updated when an admin resets the password (DS 48813)
  - Resolves: #1342382 - Running db2index with no options breaks replication (DS 48854)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-76
changelog:
  - Release 1.2.11.15-76
  - Resolves: #1354331 - Replication changelog can incorrectly skip over updates (DS 48766)
  - Resolves: #1358390 - replication delay when server is configured with multiple replication agreements. (DS 48636)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-77
changelog:
  - Release 1.2.11.15-77
  - Resolves: #1358390 - replication delay when server is configured with multiple replication agreements. (DS 48636)
                         fixing a backport error


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-78
changelog:
  - Release 1.2.11.15-78
  - Resolves: #1354331 -  Replication changelog can incorrectly skip over updates (DS 48954)
  - Resolves: #1361421 - CVE-2016-5416 389-ds-base: ACI readable by anonymous user (DS 48354)
  - Resolves: #1360974 - CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-79
changelog:
  - Release 1.2.11.15-79
  - Resolves: #1358559 - CVE-2016-4992 389-ds-base: Information disclosure via repeated use of LDAP ADD operation
  - Resolves: #1376676 - Backport AES storage scheme plugin (DS 47462, 48862, 48243, 48777)
  - Resolves: #1354331 - Replication changelog can incorrectly skip over updates
  - Resolves: #1374588 - EASY FIX : dereferencing a NULL sr_candidates pointer in ldbm_back_next_search_entry_ext resulted a segfault (DS 47858)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-80
changelog:
  - Release 1.2.11.15-80
  - Resolves: #1379599 - ns-slapd general protection ip:7f570c56afd5 sp:7f56dc7edce0 error:0 in libc-2.12.so (DS 48944)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-81
changelog:
  - Release 1.2.11.15-81
  - Resolves: #Bug 1381153 - Crash in import_wait_for_space_in_fifo(). (DS 48960)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-85
changelog:
  - Release 1.2.11.15-85
  - Resolves: #1393007 - ds9 backport 47411 - Replace substring search with plain search in referint plugin (DS 47411)


author: Pavel Alexeev <Pahan@Hubbitus.info> - 6.5.4.7-3
changelog:
  - Update to version 6.5.4-7
  - Use lzma-compressed source tarball as sugested by Ville Skyttä (BZ#515319)


author: Olivier Fourdan <ofourdan@redhat.com> - 6.5.4.7-6
changelog:
  - Add fix for CVE-2010-4167
  - Add fix for CVE-2012-0247 CVE-2012-0248 CVE-2012-1185 CVE-2012-1186
  - Add fix for CVE-2012-0259 CVE-2012-0260 CVE-2012-1798


author: Ian Kent <ikent@redhat.com> - 5.0.5-113
changelog:
  - bz1201195 - autofs: MAPFMT_DEFAULT is not macro in lookup_program.c
    - fix macro usage in lookup_program.c.
  - Resolves: rhbz#1201195


author: Ian Kent <ikent@redhat.com> - 5.0.5-115
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - add dependent patch series.
    - add aditional bug fix patches, including updated error handling on ldap bind fail.
    - add reinit method and change lookup to use reinit instead of reopen for its shared
      libraries.
  - Resolves: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-116
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - fix mistake in the updated error handling on ldap bind fail patch.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-117
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - fix error handling on ldap bind fail patch again.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-118
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - fix unbind external mech.
    - fix sasl connection concurrancy problem.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-119
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - rework sasl connection concurrancy problem patch.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-120
changelog:
  - bz1161031 - RFE: autofs MAP_HASH_TABLE_SIZE description
    - update map_hash_table_size description.
  - bz1248798 - Request to add a configuration option to force use of the map entry
    hostname for mounts
    - add configuration option to use fqdn in mounts.
  - also update changelog with patches include from other bugs in rev 115 to support
    changes for bug 1243525.
    - fix left mount count return from umount_multi_triggers() (1227496).
    - fix return handling in sss lookup module (1227496).
    - move query dn calculation from do_bind() to do_connect() (1227496).
    - make do_connect() return a status (1227496).
    - make connect_to_server() return a status (1227496).
    - make find_dc_server() return a status (1227496).
    - make find_server() return a status (1227496).
    - fix return handling of do_reconnect() in ldap module (1227496).
    - fix race accessing qdn in get_query_dn() (1084254).
    - init qdn before use in get_query_dn() (1084254).
    - fix direct mount stale instance flag reset (1232074).
  - bz1263505 - Heavy program map usage can lead to a hang
    - fix out of order call in program map lookup.
  - bz1238605 - On every system boot automount needs a restart to access NIS map
    - fix lsb service name in init script.
  - bz1097864 - Duplicate mounts created or leftovers in mtab
    - revert special case cifs escapes.
  - bz1203139 - Similar but unrelated NFS exports block proper mounting of
    "parent" mount point
    - remove unused offset handling code.
    - fix mount as you go offset selection.
  - bz1222522 - Parent directory in nested mount gets unmounted while the child
    remains mounted
    - guard against incorrect umount return.
  - bz1233057 - Direct map does not expire if map is initially empty
    - fix direct map expire not set for initail empty map.
  - Resolves: rhbz#1161031 rhbz#1248798 rhbz#1227496 rhbz#1084254 rhbz#1232074
  - Resolves: rhbz#1263505 rhbz#1238605 rhbz#1097864 rhbz#1203139 rhbz#1222522
  - Resolves: rhbz#1233057


author: Ian Kent <ikent@redhat.com> - 5.0.5-121
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - Some Coverity identified fixes for recent changes for this bug.
    - fix memory leak in nisplus lookup_reinit().
    - fix memory leak in ldap do_init().
    - fix use after free in sun parser parse_init().
    - fix use after free in open_lookup().
    - fix typo in autofs_sasl_bind().
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-122
changelog:
  - bz1233057 - Direct map does not expire if map is initially empty
    - don't schedule new alarms after readmap.
  - Related: rhbz#1233057


author: Ian Kent <ikent@redhat.com> - 5.0.5-123
changelog:
  - bz1333777 - RHEL6.7: shutdown / reboot hangs with findmnt in a readlink
    system call, doing path_walk and stuck in autofs4_wait
    - always set direct mounts catatonic at exit.
    - fix error handing in do_mount_indirect().
    - check negative cache much earlier.
    - log pipe read errors.
    - fix handle_mounts() termination condition check.
  - Resolves: rhbz#1333777


author: Lennart Poettering <lpoetter@redhat.com> - 0.6.25-7
changelog:
  - Fix for CVE-2010-2244
  - Resolves: #607296
  - Resolves: #594405
  - Related 587761
  - Related 584761
  - Related 584766
  - Related 596151
  - Related 599435


author: Tomas Hozza <thozza@redhat.com> - 32:9.8.2-0.43.rc1
changelog:
  - Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1227189)
  - Added the fixed tarball with configuration to Sources (Related: #1223359)


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.47.rc1.4
changelog:
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.24-4.20100428git73d775
changelog:
  - update to 20100428git73d775
  - replace initstepslew directive with makestep in default config
  - add NetworkManager dispatcher script
  - add dhclient script
  - retry server/peer name resolution at least once to workaround
    NetworkManager race condition on boot
  - don't verify chrony.keys


author: Miroslav Lichvar <mlichvar@redhat.com> 1.25-1
changelog:
  - update to 1.25
  - link with -Wl,-z,relro,-z,now options
  - use iburst, four pool servers, rtcsync, stratumweight in default config
  - suppress install-info errors


author: Miroslav Lichvar <mlichvar@redhat.com> 1.25-3
changelog:
  - fix buffer overflow when processing crafted command packets (CVE-2012-4502)
  - don't send uninitialized data in command replies (CVE-2012-4503)


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.141-1
changelog:
  - Do not check for suspended devices if scanning for lvmetad update.
  - Fix part. table filter with external_device_info_source="udev" and blkid<2.20.
  - Add metadata/check_pv_device_sizes switch to lvm.conf for device size checks.
  - Warn if device size is less than corresponding PV size in metadata.
  - Cache device sizes internally.
  - Restore support for command breaking in process_each_lv_in_vg() (2.02.118).
  - Use correct mempool when process_each_lv_in_vg() (2.02.118).
  - Fix lvm.8 man to show again prohibited suffixes.
  - Fix configure to set proper use_blkid_wiping if autodetected as disabled.
  - Initialise udev in clvmd for use in device scanning. (2.02.116)
  - Add seg_le_ranges report field for common format when displaying seg devices.
  - Honour report/list_item_separator for seg_metadata_le_ranges report field.
  - Don't mark hidden devs in -o devices,metadata_devices,seg_pe_ranges.(2.02.140)
  - Change LV sizes in seg_pe_ranges report field to match underlying devices.
  - Add kernel_cache_settings report field for cache LV settings used in kernel.
  - Fix man page for dmsetup udevcreatecookie.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-1
changelog:
  - Use uninitilized pool header detection in all cases.
  - Fix read error detection when checking for uninitialized thin-pool header.
  - Fix error path for internal error in lvmetad vg lookup code.
  - Fix error path when sending thin-pool message fails in update_pool_lv().
  - Support reporting CheckNeeded and Fail state for thin-pool and thin LV.
  - For failing thin-pool and thin volume correctly report percentage as INVALID.
  - Report -1, not 'unkown' for lv_{snapshot_invalid,merge_failed} with --binary.
  - If PV belongs to some VG and metadata missing, skip it if system ID is used.
  - Automatically change PV header extension to latest version if writing PV/VG.
  - Identify used PVs in pv_attr field by new 'u' character.
  - Add pv_in_use reporting field to report if PV is used or not.
  - Add pv_ext_vsn reporting field to report PV header extension version.
  - Add protective flag marking PVs as used even if no metadata available.
  - Fix memory pool corruption in pvmove (2.02.141).
  - Support control of spare metadata creation when repairing thin-pool.
  - Fix config type of 'log/verbose' from bool to int (2.02.99).
  - Fix inverted data LV thinp watermark calc for dmeventd response (2.02.133).
  - Use use_blkid_wiping=0 if not defined in lvm.conf and support not compiled in.
  - Clear cached bootloader areas when PV format changed.
  - Fix string boundary check in _get_canonical_field_name().
  - Always initialized hist struct in _stats_parse_histogram().
  - Improve status parsing for thin-pool and thin devices.
  - Use fully aligned allocations for dm_pool_strdup/strndup() (1.02.64).
  - Fix thin-pool table parameter feature order to match kernel output.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-2
changelog:
  - Fix resize of stacked raid thin data volume (2.02.141).
  - Allow for raid leg replacement if not both data and metadata image are on pvs.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-3
changelog:
  - Detect and warn about mismatch between devices used and assumed for an LV.
  - If available, use /proc/self/mountinfo to detect mounted volume in fsadm.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-4
changelog:
  - Remove spurious error about no value in /sys/dev/block/major:minor/dm/uuid.
  - Fix device mismatch detection for LV if persistent .cache file is used.
  - Fix holder device not being found in /dev while sysfs has it during dev scan.
  - Document that lvmlockd and lvmpolld features are available only if compiled in
    (RHEL6 lvm2 doesn't have lvmlockd and lvmpolld compiled in).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-7
changelog:
  - Workaround for raid leg allocation failure after not-in-sync raid leg failure.
  - Fix flushing of outstanding IO for mirror target (2.02.133).


author: Jens Petersen <petersen@redhat.com> - 1.0.6-1
changelog:
  - add de_DE.ISO-8859-1@Solaris and en_US.ISO-8859-1@Solaris
    (Pravin Satpute, #677352)
  - add de_DE.ISO-8859-1@HPUX and en_US.ISO-8859-1@HPUX
    (Pravin Satpute, #677354)


author: Jens Petersen <petersen@redhat.com> - 1.0.8-4
changelog:
  - change ja_JP.SAPSJIS locale from SAP SHIFT_JIS to SAP SHIFT_JISX0213
    (Takao Fujiwara, #888856)
  - previous ja_JP.SAPSJIS locale is still available as ja_JP.oldsapsjis
  - fix install and uninstall scripts to setup the Shift JIS gconv modules
    correctly when upgrading


author: Mike Fabian <mfabian@redhat.com> - 1.0.10-1
changelog:
  - [RHEL6] the locales from compat-locales-sap should be preserved on
    glibc-common updates (#1381707)
  - [RHEL6] the locales from compat-locales-sap should be preserved on
    glibc-common updates (#1283502)


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.4-7
changelog:
  - switch off --enable-pie, because it's overloaded with flags in spec
  - added RPM_OPT_FLAGS into CFLAGS
  - Related: rhbz#676040


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.4-9
changelog:
  - during spring DST change are jobs executed 61 times if they are set
    for 2:00 or 3:00 am.
  - 995089 - incorrectly running jobs when time difference is negative
  - cronie doesn't drop privileges before popen
  - adoptions at the crontab orphanage needed
  - config file permissions are world readable
  - 733697 - Service restart needlessly reports failure
  - 743473 - Confusing comments in /etc/cron.hourly/0anacron
  - 887859 - Incorrect example in anacrontab manpage
  - 990710 - cron disallows setting PATH via PAM
  - 985893 - do not use putenv
  - 985888 - cronie drops $LANG and never passes it on to jobs run
  - 829910 - random prefix in crontables for running jobs
  - 922829 - crond generating invalid emails 
  - 919440 - prevent new crond process when already running 
  - Resolves: rhbz#821046, rhbz#697485, rhbz#738232, rhbz#706979, rhbz#733697
  - Resolves: rhbz#743473, rhbz#887859, rhbz#990710, rhbz#985893, rhbz#985888
  - Resolves: rhbz#829910, rhbz#922829, rhbz#995089, rhbz#919440


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.4-14
changelog:
  - fix segfault on null dereference in anacron (#1031383)
  - do not remove daemon pid file in the child process
  - add log message about crond shutdown (#1108384)
  - add log message when getpwnam fails


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-15
changelog:
  - apply backported patch from 4.8.26 to fix dbverify (#563610, #472131)
    (patch backported by Noriko Hosoi)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.47-1
changelog:
  - rc.sysinit: be more verbose
  - init.d/functions: rc.debug option to debug initscripts
  - ifup-aliases: inherit ARPCHECK from parent device
  - netfs: don't race NFS umount to network shutdown
  - network: report that we can't shut down network for root on netfs
  - Fix tcsh + grep-2.7. (#636552)
  - sysctl.conf: move bridge setting to module-init-tools
  - rc.sysinit: set affinity also for current shell
  - ifdown-eth: use scope host for lo
  - improve_check_for_bond_master_in_install_bonding_driver
  - network-functions: fix check in install_bonding_driver
  - ifdown-post: remove resolv.conf only in specific cases
  - netconsole: lets run earlier
  - ipcalc: support RFC3021 (#997271)
  - halt: add delay after upsdrvctl shutdown
  - ifup: also set multicast_snooping after the bridge is up


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.50-1
changelog:
  - functions: improve killing loops
  - netfs: tweak nfs umount
  - sysctl.conf: mention sysctl -a
  - sysconfig.txt: document PPPOE_EXTRA and PPPD_EXTRA
  - spec: require plymouth
  - fix mangled sysconfig/init.s390
  - rc.sysinit: don't perform fsck twice with /.autorelabel
  - ifdown-eth: fix comparison
  - ifup-eth: if arping fails, output responding MAC
  - network-functions: fix change_resolv_conf after grep update
  - spec: add sysctl.d dir
  - rc.sysinit: fix typo in fs
  - rename_devices: comments need to have a blank before them
  - rename_device: remove comments and trailing whitespaces
  - bonding: warn if the ifup for slave device failed
  - clarify daemon() usage message
  - ifdown: clean ipv4 localhost addresses
  - ifup-post: check resolve.conf also with DNS2
  - ifup: add missing quotes
  - ifup-eth: some bridge options are applied later
  - init.d/halt: give init some time to reexecute
  - network-scripts: DEVICE and HWADRR could be quoted by apostrophe
  - ifup-wireless: fix calling of phy_wireless_device
  - rc.sysinit: apply quotas after system is relabeled


author: Joe Orton <jorton@redhat.com> - 2.0.1-8
changelog:
  - add security fix for CVE-2009-3560 (#533174)
  - add security fix for CVE-2009-3720 (#531697)
  - run the test suite


author: Tim Waugh <twaugh@redhat.com> - 8.70-13
changelog:
  - Applied patch to prevent null pointer dereference (CVE-2010-4054,
    bug #646086).
  - Applied patch to prevent integer underflow in TrueType bytecode
    interpreter (CVE-2009-3743, bug #627902).
  - Applied patch to avoid reading initialization and library files from
    CWD (CVE-2010-2055, bug #599564; CVE-2010-4820, bug #771853).


author: Tim Waugh <twaugh@redhat.com> - 8.70-14
changelog:
  - Fixed character spacing problems using backported patch (bug #695766).
  - Apply some fixes from upstream to avoid gdevcups segfaults (bug #643105).


author: Tim Waugh <twaugh@redhat.com> - 8.70-20
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1105520).
  - Improved support for PDF/A from upstream (bug #1060026).
  - Back-ported patch to process embedded files as a portable collection
    only if there is a /Collection attribute (bug #1027534).
  - Back-ported patch to preserve invisible PDF text in pdfwrite (bug #994452).


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 8.70-21_1
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: Olivier Fourdan <ofourdan@redhat.com> 2.28.2-29
changelog:
  - wacom: Update input transformation matrix on monitor changes (#861890)
    wacom: Re-fix LED as per latest discussions on linuxwacom-devel (#805064)
    Resolves: #805064 #861890


author: Ray Strode <rstrode@redhat.com> - 2.28.2-35.2
changelog:
  - Another smartcard update to support drivers that don't
    announce already inserted smartcards at startup
    Related: #1299992


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-2
changelog:
  - Added dfa-optimize-period patch (speedup for . patterns in UTF-8)
  - Added glibc-matcher-fallback patch (speedup for [a-z] patterns in UTF-8)
  - Added mmap-option-fix patch
  - Added dfa-convert-to-wide-char patch (speedup for -m and remove quadratic
    complexity when going to glibc)
  - Added dfa-speedup-digit-xdigit patch (speedup for [[:digit:]] [:xdigit:]])


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-4
changelog:
  - Fixed crash on grep -Fif /dev/null (fif-null-fix patch)
    Resolves: rhbz#797934
  - Fixed heap overrun on specific REs (dfa-heap-overrun-fix patch)
    Resolves: rhbz#715295
  - Fixed -i (case insensitive matching)
    Resolves: rhbz#826997


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-1
changelog:
  - New version
    Resolves: rhbz#1064668
    Resolves: rhbz#982215
    Resolves: rhbz#1126757
    Resolves: rhbz#1167766
    Resolves: rhbz#1171806
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#799863
  - Documented --fixed-regexp option
    Resolves: rhbz#1103270


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1193030
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed bogus date in the changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-5
changelog:
  - Added support for environmental variable GREP_LEGACY_R to enhance
    backward compatibility of -r switch behavior
    Resolves: rhbz#1367309


author: Bastien Nocera <bnocera@redhat.com> 0.10.17-2
changelog:
  - Update Farsight plugins to 0.10.17
  - Disable LADSPA plugins, they should be in -bad (#540198)
  - Add support for authenticating RTSP sources
  Related: rhbz#543948


author: Wim Taymans <wtaymans@redhat.com> 0.10.23-2
changelog:
  - add patch to post provide-clock message to fix a major regression
    in 0.10.23
  - bump version to rebuild for fastrack
  Resolves: rhbz#622776


author: Tim Waugh <twaugh@redhat.com> - 3.12.4-4
changelog:
  - Applied patch to fix CVE-2013-0200, temporary file vulnerability
    (bug #902163).
  - Fixed hpijs-marker-supply patch.


author: Tim Waugh <twaugh@redhat.com> - 3.12.4-5
changelog:
  - Applied patch to avoid unix-process authorization subject when using
    polkit as it is racy (CVE-2013-4325).


author: Tim Waugh <twugh@redhat.com> 3.14.6-3
changelog:
  - Fixes from Fedora:
    - Fixed incorrect name in function call in makeURI when a parallel
      port device is used (bug #1159161).
    - Fixed uses of strncpy throughout.


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-48
changelog:
  - core: backport NoDecode option of AllowEncodedSlashes (#1002658)
  - mod_authz_host: disallow the '#' character in allow, deny (#1179911)
  - mod_ssl: fix memory leak on httpd reloads (#1236515)
  - mod_proxy: fix regression caused inherited workers to use a different
    scoreboard slot then the original one (#1252574)
  - mod_rewrite: allow running external mapping program as non-root (#1035230)
  - mod_reqtimeout: fix a timed out connection going into the keep-alive state
    after a timeout when discarding a request body (#1213967)
  - core: fix possible crash in SIGINT handling (#1233109)
  - mod_ssl: extend SSLSessionCacheTimeout to sessions resumed by TLS (#1190509)
  - initscript: do not print error when stopping stopped httpd (#1189941)
  - mod_ssl: fail for colons in credentials with FakeBasicAuth (#1027442)
  - mod_proxy: add "proxy-flushall" env variable which reduces the impact
    of caching 16K of the request body. (#952395)
  - mod_ssl: Do not send SSL warning when SNI hostname is not found as per
    RFC 6066 (#1289096)


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-53
changelog:
  - core: fix possible long graceful restart caused by race condition between
    httpd children processes (#1301758)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-54.1
changelog:
  - Resolves: #1374729 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-54.2
changelog:
  - Resolves: #1391517 - when ProxyErrorOverride is On, modcluster
    return 503 status code on subsequent requests


author: Petr Vobornik <pvoborni@redhat.com> - 3.0.0-43.el6
changelog:
  - Release 3.0.0-43
  - Resolves: #1191040 - ipa-client-automount: failing with error LDAP server
                         returned UNWILLING_TO_PERFORM. This likely means that
                         minssf is enabled.
  - Resolves: #1185207 - ipa-client dont end new line character in
                         /etc/nsswitch.conf
  - Resolves: #1166241 - CVE-2010-5312 CVE-2012-6662 ipa: various flaws
  - Resolves: #1161722 - IDM client registration failure in a high load
                         environment
  - Resolves: #1154687 - POODLE: force using safe ciphers (non-SSLv3) in IPA
                         client and server
  - Resolves: #1146870 - ipa-client-install fails with "KerbTransport instance
                         has no attribute '__conn'" traceback
  - Resolves: #1132261 - ipa-client-install failing produces a traceback
                         instead of useful error message
  - Resolves: #1131571 - Do not allow IdM server/replica/client installation
                         in a FIPS-140 mode
  - Resolves: #1198160 - /usr/sbin/ipa-server-install --uninstall does not
                         clean /var/lib/ipa/pki-ca
  - Resolves: #1198339 - ipa-client-install adds extra sss to sudoers in
                         nsswitch.conf
  - Require: 389-ds-base >= 1.2.11.15-51
  - Require: mod_nss >= 1.0.10
  - Require: pki-ca >= 9.0.3-40
  - Require: python-nss >= 0.16


author: Petr Vobornik <pvoborni@redhat.com> - 3.0.0-46.el6
changelog:
  - Use tls version range in NSSHTTPS initialization
  - Resolves: #1154687 - POODLE: force using safe ciphers (non-SSLv3) in IPA
                         client and server
  - Resolves: #1012224 - host certificate not issued to client during
                         ipa-client-install


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-48.el6
changelog:
  - Resolves: #1263703 ipa-server-install with externally signed CA fails with
    NSS error (SEC_ERROR_BUSY)
    - Free NSS objects in --external-ca scenario
  - Resolves: #1263262 Unable to resolve group memberships for AD users when
    using sssd-1.12.2-58.el7_1.6.x86_64 client in combination with
    ipa-server-3.0.0-42.el6.x86_64 with AD Trust
    - Do not lookup up the domain too early if only the SID is known
    - Do not store SID string in a local buffer
    - Allow ID-to-SID mappings in the extdom plugin


author: Martin Basti <mbasti@redhat.com> - 3.0.0-49.el6
changelog:
  - Resolves: #1127211 ipa-server-install --uninstall produces avc
    - sysrestore: copy files instead of moving them to avoind SELinux issues
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1222999 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in parentheses
  - Resolves: #1225868 display browser config options that apply to the browser -
    Chrome
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
    - WebUI: fix ipa_error.css
  - Resolves: #1232468 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
    - Simplify adding options in ipachangeconf
    - ipachangeconf: Add ability to preserve section case
    - ipa-client-automount: Leverage IPAChangeConf to configure the domain for
      idmapd
  - Resolves: #1232899 ipa-client-install does not respect --realm option
    - Allow user to force Kerberos realm during installation.
  - Resolves: #1276358 Remove /usr/share/ipa/updates/50-lockout-policy.update
    file from IPA 3.0 releases
    - Remove 50-lockout-policy.update file


author: Jan Cholasta <mbasti@redhat.com> - 3.0.0-50.el6
changelog:
  - Resolves: #1225868 display browser config options that apply to the browser -
    Chrome
    - Remove ico files from Makefile
  - Resolves: #1232843 ipa-client-install errors out if client and server time
    are not in sync or unreachable
    - Skip time sync during client install when using --no-ntp
  - Resolves: #1288495 Add userCertificate index used in Smart Card
    authentication
    - add DS index for userCertificate attribute
  - Resolves: #1293588 JavaScript error in ssbrowser.html - TypeError: Cannot
    read property 'mozilla' of undefined
    - webui: fix browser detection in browserconfig.html and ssbrowser.html
  - Resolves: #1296124 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Remove binary patching from patch 0140


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-50.el6.2
changelog:
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-50.el6.3
changelog:
  - Resolves: #1369470 IPA Replica-Install from RHEL6 to RHEL7 Fails
    - Modififed NSSConnection not to shutdown existing database.
    - Do not erroneously reinit NSS in Dogtag interface
    - Make sure replication works after DM password is changed


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-15
changelog:
  - 1125984 iscsistart vlan support
  - 906242 fix segfault from unexpected netlink event during driver load
  - 1181463 iscsiuio update


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-21
changelog:
  - 1294965 iscsiuio match based on driver to support new hardware without
    adding PCI IDs (still need IDs added to kernel)
  - bnx2i pass through ping support


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.0
changelog:
  - Update to IcedTea 1.13.12 & OpenJDK 6 b40.
  - Separate SystemTap option from bootstrap options.
  - Use configure macro and disable long-running JTreg & SystemTap tests from make check
  - Remove redundant patch-ecj target invocation for bootstrap build.
  - Add check section to run the new tests introduced in 1.13.12.
  - Fix context for rpath patch following PR3140.
  - Add RHEL version of b40 tarball.
  - Require mailcap at build time as well, so configure finds /etc/mime.types (PR2800)
  - Remove unneeded dependency on jakarta-commons-logging, as VisualVM is no longer included.
  - Resolves: rhbz#1350044


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.2
changelog:
  - Separate bootstrap option as it should not be tied to the JDK used.
  - Enable bootstrapping on JIT architectures going forward.
  - Temporarily enable bootstrapping on all architectures to work around RH1334465/PR2956.
  - Resolves: rhbz#1350044


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.4
changelog:
  - Non-JIT architectures have not been bootstrapping, due to RPM reading commented macros
  - Resolves: rhbz#1350044


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Set install directories in configure so that @prefix@ is substituted correctly in tapset
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Require a JDK with RH1334465/PR2956 fixed and turn off bootstrapping for Zero architectures.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Update to IcedTea 1.13.13 & OpenJDK 6 b41.
  - Fix context for rpath patch following PR3213.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.1
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Remove patches added for RH1183014 which are now upstream in 2.6.5/7u99.
  - Resolves: rhbz#1320657


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.1
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop a leading zero from the priority as the update version is now three digits
  - Update PR2809 patch to apply against 2.6.6.
  - Resolves: rhbz#1325426


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.0
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938 (ttable_match_7) and PR2939 (fontpath)) applied upstream.
  - Resolves: rhbz#1350039


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350039


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Require at least the build-time version of NSS at run-time due to static linking.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.1
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Remove unneeded AArch64 environment variable setting.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.0
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-0.b14
changelog:
  - Update to u92b14.
  - Remove upstreamed patches for Zero build failures 8087120 & 8143855.
  - Add 8132051 Zero fix upstreamed as 8154210 in 8u112.
  - Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
  - Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
  - Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
  - Resolves: rhbz#1350034


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-0.b13
changelog:
  - Update to u101b13.
  - Backport REPOS option in generate_source_tarball.sh
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1350034


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-2.b13
changelog:
  - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
  - Resolves: rhbz#1350034


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b13
changelog:
  - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
  - Resolves: rhbz#1350034


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-4.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Drop the CORBA typo fix, which appears upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-1.b15
changelog:
  - Remove method reference from java.io.ObjectInputStream to allow compilation on old ECJ.
  - Resolves: rhbz#1393047


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-2.b18
changelog:
  - Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
  - Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-2.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-0.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-0.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Re-generate RH1393047 ObjectInputStream patch against u121.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - Update to u77b03.
  - Drop 8146566 which is applied upstream.
  - Replace s390 Java options patch with general version from IcedTea.
  - Apply s390 patches unconditionally to avoid arch-specific patch failures.
  - Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
  - Remove aarch64-specific suffix as update/build version are now the same as for other archs.
  - Only use z format specifier on s390, not s390x.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Correct spelling mistakes in tarball generation script.
  - Synchronise minor changes from Fedora.
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - Remove patches to generated configure script, which we re-generate anyway.
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - RHEL 6 adds -fasynchronous-unwind-tables which leads to libjvm.so being too big on x86
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - Revert previous change to CFLAGS/LDFLAGS as issue is not us, but rhbz#1320961
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - Avoid WithSeed versions of NSS functions as they do not fully process the seed
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Use basename of test file to avoid misinterpretation of full path as a package
  - Resolves: rhbz#1325421


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-634.el6]
changelog:
  - [scsi] cxgbi: Convert over to dst_neigh_lookup (Sai Vemuri) [1296461]
  - [netdrv] cxgb4: For T4, don't read the Firmware Mailbox Control register (Sai Vemuri) [1296469]
  - [netdrv] cxgb4: Use ACCES_ONCE macro to read queue's consumer index (Sai Vemuri) [1296484]
  - [netdrv] cxgb4: prevent simultaneous execution of service_ofldq (Sai Vemuri) [1296483]
  - [netdrv] cxgb4: Adds PCI device id for new T5 adapters (Sai Vemuri) [1296481]
  - [netdrv] cxgb4: Don't disallow turning off auto-negotiation (Sai Vemuri) [1296476]
  - [mm] check if section present during memory block registering (Xunlei Pang) [1297840]
  - [tty] ldisc: Close/Reopen race prevention should check tty->ldisc (Denys Vlasenko) [1312383]
  - [fs] proc-vmcore: wrong data type casting fix (Baoquan He) [1312206]
  - [infiniband] iw_cxgb3: Ignore positive return values from the ofld send functions (Sai Vemuri) [1296999]
  - [netdrv] cxgb4: Deal with wrap-around of queue for Work request (Sai Vemuri) [1296482]
  - [infiniband] iw_cxgb4: detect fatal errors while creating listening filters (Sai Vemuri) [1296480]
  - [md] dm snapshot: suspend merging snapshot when doing exception handover (Mike Snitzer) [1177389]
  - [md] dm snapshot: suspend origin when doing exception handover (Mike Snitzer) [1177389]
  - [md] dm snapshot: allocate a per-target structure for snapshot-origin target (Mike Snitzer) [1177389]
  - [md] dm: fix a race condition in dm_get_md (Mike Snitzer) [1177389]
  - [infiniband] iw_cxgb4: pass the ord/ird in connect reply events (Sai Vemuri) [1296478]
  - [infiniband] iw_cxgb4: fix misuse of ep->ord for minimum ird calculation (Sai Vemuri) [1296478]
  - [infiniband] iw_cxgb4: reverse the ord/ird in the ESTABLISHED upcall (Sai Vemuri) [1296478]
  - [usb] Revert "Revert 'Update USB default wakeup settings'" (Torez Smith) [1319081]
  - [netdrv] ibmveth: add support for TSO6 (Gustavo Duarte) [1318412]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-635.el6]
changelog:
  - [mm] backing-dev: ensure wakeup_timer is deleted (Jeff Moyer) [1318930]
  - [hv] vss: run only on supported host versions (Vitaly Kuznetsov) [1319813]
  - [sound] hda: Fix internal speaker for HP Z240 (Jaroslav Kysela) [1316673]
  - [perf] trace: Fix race condition at the end of started workloads (Jiri Olsa) [1302928]
  - [fs] nfsd: Combine decode operations for v4 and v4.1 (J. Bruce Fields) [1314536]
  - [hv] revert "vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: don't loose HVMSG_TIMER_EXPIRED messages" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: avoid unneeded compiler optimizations in vmbus_wait_for_unload" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: remove code duplication in message handling" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: avoid wait_for_completion on crash" (Vitaly Kuznetsov) [1318882]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-636.el6]
changelog:
  - [netdrv] mlx4_en: Choose time-stamping shift value according to HW frequency (Kamal Heib) [1320448]
  - [fs] anon_inodes implement dname (Aristeu Rozanski) [1296019]
  - [net] packet: set transport header before doing xmit (John Greene) [1309526]
  - [net] tuntap: set transport header before passing it to kernel (John Greene) [1309526]
  - [netdrv] macvtap: set transport header before passing skb to lower device (John Greene) [1309526]
  - [net] ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Jakub Sitnicki) [1312740]
  - [net] ipv6: sctp: add rcu protection around np->opt (Jakub Sitnicki) [1312740]
  - [net] ipv6: add complete rcu protection around np->opt (Jakub Sitnicki) [1312740]
  - [net] dccp: remove unnecessary codes in ipv6.c (Jakub Sitnicki) [1312740]
  - [net] ipv6: remove unnecessary codes in tcp_ipv6.c (Jakub Sitnicki) [1312740]
  - [net] ipv6: Refactor update of IPv6 flowi destination address for srcrt (RH) option (Jakub Sitnicki) [1312740]
  - [net] ipv6: protect flow label renew against GC (Sabrina Dubroca) [1313231]
  - [net] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc (Sabrina Dubroca) [1313231]
  - [perf] annotate: Support full source file paths for srcline fix (Jiri Olsa) [1304472 1304479]
  - [perf] tools: Support full source file paths for srcline (Jiri Olsa) [1304472 1304479]
  - [perf] annotate: Fix -i option, which is currently ignored (Jiri Olsa) [1304472 1304479]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-637.el6]
changelog:
  - [netdrv] mlx4-en: add missing patch to init rss_rings in get_profile (Don Dutile) [1321164]
  - [netdrv] mlx4-en: disable traffic class queueing by default (Don Dutile) [1321164]
  - [netdrv] mlx4_core: Fix mailbox leak in error flow when performing update qp (Don Dutile) [1321164]
  - [x86] nmi/64: Fix a paravirt stack-clobbering bug in the NMI code (Denys Vlasenko) [1259581] {CVE-2015-5157}
  - [x86] nmi/64: Switch stacks on userspace NMI entry (Denys Vlasenko) [1259581] {CVE-2015-5157}


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-638.el6]
changelog:
  - [mm] hugetlb: prevent BUG_ON in hugetlb_fault -> hugetlb_cow (Dave Anderson) [1303495]
  - [mm] hugetlb: fix race condition in hugetlb_fault (Dave Anderson) [1303495]
  - [s390] kdump: fix wrong BUG_ON statement (Hendrik Brueckner) [1321316]
  - [scsi] cxgb4i: Increased the value of MAX_IMM_TX_PKT_LEN from 128 to 256 bytes (Sai Vemuri) [1320193]
  - [fs] nfs: fix a regression causing deadlock in nfs_wb_page_cancel() (Benjamin Coddington) [1135601]
  - [netdrv] cxgb4/ethtool: Get/set rx checksum (Sai Vemuri) [1225167]
  - [netdrv] cxgb4vf:The RX checksum feature was not completely ported to cxgb4vf driver (Sai Vemuri) [1225167]
  - [netdrv] cxgb4/cxgb4vf: Enable GRO (Sai Vemuri) [1225167]
  - [netdrv] cxgb4: Enable RX checksum offload flag (Sai Vemuri) [1225167]
  - [netdrv] cxgb4: Report correct link speed for unsupported ones (Sai Vemuri) [1296467]
  - [netdrv] cxgb4: Use vmalloc, if kmalloc fails (Sai Vemuri) [1296473]
  - [netdrv] cxgb4: Enhance driver to update FW, when FW is too old (Sai Vemuri) [1296472]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-639.el6]
changelog:
  - [input] wacom: fix ExpressKeys remote events (Aristeu Rozanski) [1318027]
  - [fs] revert "writeback: remove wb_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: bdi_writeback_task must set task state before calling schedule" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: merge bdi_writeback_task and bdi_start_fn" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: harmonize writeback threads naming" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix possible race when creating bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 1" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 2" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: simplify bdi code a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not remove bdi from bdi_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move last_active to bdi" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: restructure bdi forker loop a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move bdi threads exiting logic to the forker thread" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: prevent unnecessary bdi threads wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: optimize periodic bdi thread wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: remove unnecessary init_timer call" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: cleanup bdi_register" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix bad _bh spinlock nesting" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wakeup events when forking bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: Fix lost wake-up shutting down writeback thread" (Jeff Moyer) [1322297]
  - [mm] revert "backing-dev: ensure wakeup_timer is deleted" (Jeff Moyer) [1322297]
  - [perf] revert: perf changes out of "sched, perf: Fix periodic timers" (Jiri Olsa) [1322488]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-640.el6]
changelog:
  - [net] use GFP_ATOMIC in dst_ops_extend_register (Sabrina Dubroca) [1323252]
  - [kernel] revert "sched: core: Use hrtimer_start_expires" (Jiri Olsa) [1324318]
  - [kernel] Revert "Cleanup bandwidth timers" (Jiri Olsa) [1324318]
  - [kernel] revert "fair: Test list head instead of list entry in throttle_cfs_rq" (Jiri Olsa) [1324318]
  - [kernel] revert "sched, perf: Fix periodic timers" (Jiri Olsa) [1324318]
  - [kernel] Revert "fix KABI break" (Jiri Olsa) [1324318]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-641.el6]
changelog:
  - [netdrv] ixgbe: restore proper CHECKSUM_UNNECESSARY behavior for LRO packets (Neil Horman) [1318426]
  - [netdrv] revert " net/mlx5_core: Add pci error handlers to mlx5_core driver" (Don Dutile) [1324599]
  - [x86] kernel: espfix not working for 32-bit KVM paravirt guests (Jacob Tanenbaum) [1172767] {CVE-2014-8134}


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-642.el6]
changelog:
  - [scsi] fc: revert - ensure scan_work isn't active when freeing fc_rport (Ewan Milne) [1326447]
  - [netdrv] ixgbe: Update ixgbe driver to use __netdev_pick_tx in ixgbe_select_queue (John Greene) [1310749]
  - [netdrv] mlx5e: Fix adding vlan rule with vid zero twice (Kamal Heib) [1322809]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.1.1.el6]
changelog:
  - [net] tcp/dccp: warn user for preferred ip_local_port_range (Florian Westphal) [1333571 1314774]
  - [net] tcp/dccp: try to not exhaust ip_local_port_range in connect() (Florian Westphal) [1333571 1314774]
  - [net] tcp: improve REUSEADDR/NOREUSEADDR cohabitation (Florian Westphal) [1333571 1314774]
  - [base] firmware: Add lock for firmware devices (Lyude Paul) [1333572 1309875]
  - [net] netlabel: fix a problem with netlbl_secattr_catmap_setrng (Paul Moore) [1333579 1321174]
  - [md] dm: only initialize the request_queue once (Mike Snitzer) [1333575 1328329]
  - [md] raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang (Jes Sorensen) [1333576 1320595]
  - [md] raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang (Jes Sorensen) [1333576 1320595]
  - [md] raid5: Compare apples to apples (or sectors to sectors) (Jes Sorensen) [1333581 1295969]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.4.1.el6]
changelog:
  - [ipmi] Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() (David Arcari) [1355980 1347189]
  - [fs] ext4: Remove useless spinlock in ext4_getattr() (Lukas Czerner) [1355981 1315933]
  - [net] tcp: increase size at which tcp_bound_to_half_wnd bounds to > TCP_MSS_DEFAULT (Davide Caratti) [1354446 1349776]
  - [net] tcp: Prevent overzealous packetization by SWS logic (Davide Caratti) [1354446 1349776]
  - [fs] configfs: fix race between dentry put and lookup (Robert S Peterson) [1353828 1333448]
  - [drm] move idr2 implementation to lib (Milos Vyletel) [1353827 1316790]
  - [fs] cifs: Create dedicated keyring for spnego operations (Scott Mayhew) [1351670 1267754]
  - [infiniband] srp: Fix backport error in ib_srp::srp_queuecommand (Don Dutile) [1348062 1321094]
  - [fs] gfs2: don't set rgrp gl_object until it's inserted into rgrp tree (Robert S Peterson) [1347539 1344740]
  - [sched] avoid kernel panic during power off (Frank Ramsay) [1343894 1313035]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.5.1.el6]
changelog:
  - [scsi] megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do not support it (Tomas Henzl) [1359039 1352826]
  - [scsi] libfc: sanity check cpu number extracted from xid (Chris Leech) [1359036 1351356]
  - [security] keys: potential uninitialized variable (Mateusz Guzik) [1345945 1345946] {CVE-2016-4470}
  - [fs] gfs2: Lock holder cleanup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Large-filesystem fix for 32-bit systems (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Get rid of gfs2_ilookup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Fix gfs2_lookup_by_inum lock inversion (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Initialize iopen glock holder for new inodes (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Release iopen glock in gfs2_create_inode error cases (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Wait for iopen glock dequeues (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Re-add an omission from upstream (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Eliminate parameter non_block on gfs2_inode_lookup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Don't filter out I_FREEING inodes anymore (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Check if iopen is held when deleting inode (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Don't do glock put when inode creation fails (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Prevent delete work from occurring on glocks used for create (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Always use iopen glock for gl_deletes (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Update master statfs buffer with sd_statfs_spin locked (Robert S Peterson) [1359037 1173286]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.6.1.el6]
changelog:
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355606 1355607] {CVE-2016-5696}
  - [fs] sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags (Scott Mayhew) [1366962 1294939]
  - [usbhid] hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Yauheni Kaliuta) [1359999 1360008] {CVE-2016-5829}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-642.7.1.el6]
changelog:
  - [net] netfilter: ip(6)t_REJECT: fix wrong transport header pointer in TCP reset (William Townsend) [1372266 1343816]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.8.1.el6]
changelog:
  - [fs] lockd: unregister notifier blocks if the service fails to come up completely (Scott Mayhew) [1375637 1346317]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.9.1.el6]
changelog:
  - [net] vlan: Fix FCOE_MTU support (Maurizio Lombardi) [1381592 1367250]
  - [s390] mm: fix asce_bits handling with dynamic pagetable levels (Steve Best) [1377472 1341758]
  - [powerpc] eeh: Block PCI configuration space access during EEH (Gustavo Duarte) [1379596 1216944]
  - [fs] ecryptfs: prevent mounts backed by procfs (Mateusz Guzik) [1347101 1347102] {CVE-2016-1583}
  - [s390] mm: four page table levels vs. fork (Hendrik Brueckner) [1341546 1316461] {CVE-2016-2143}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.10.1.el6]
changelog:
  - [scsi] fnic: Fix to cleanup aborted IO to avoid device being offlined by mid-layer (Maurizio Lombardi) [1382620 1341298]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.12.1.el6]
changelog:
  - [netdrv] mlx5: Fix RC transport send queue overhead computation (Slava Shwartsman) [1392799 1384212]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.13.1.el6]
changelog:
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390805 1390046] {CVE-2016-7117}
  - [net] vlan: Propagate MAC address to VLANs (Jarod Wilson) [1396479 1381585]
  - [net] tcp: fix use after free in tcp_xmit_retransmit_queue() (Mateusz Guzik) [1379527 1379529] {CVE-2016-6828}
  - [net] netfilter: x_tables: check for bogus target offset (Mateusz Guzik) [1351421 1351422] {CVE-2016-4998}
  - [net] netfilter: x_tables: validate e->target_offset early (Mateusz Guzik) [1351421 1351422] {CVE-2016-4998}
  - [net] netfilter: x_tables: make sure e->next_offset covers remaining blob size (Mateusz Guzik) [1351421 1351422] {CVE-2016-4998}
  - [net] ipv6: Don't change dst->flags using assignments (Marcelo Leitner) [1391974 1389478]
  - [scsi] libfc: Revert: use offload EM instance again (Chris Leech) [1392818 1383078]
  - [netdrv] sfc: report supported link speeds on SFP connections (Jarod Wilson) [1388168 1384621]
  - [drm] vmwgfx: respect 'nomodeset' (Rob Clark) [1392875 1342114]
  - [hv] avoid vfree() on crash (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: handle various crash scenarios (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: Support kexec on ws2012 r2 and above (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: Support handling messages on multiple CPUs (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: remove code duplication in message handling (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: avoid unneeded compiler optimizations in vmbus_wait_for_unload() (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: avoid wait_for_completion() on crash (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload() (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: don't loose HVMSG_TIMER_EXPIRED messages (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: Force all channel messages to be delivered on CPU 0 (Vitaly Kuznetsov) [1385482 1333167]
  - [scsi] mpt3sas: Fix panic when aer correct error occurred (Frank Ramsay) [1396272 1374743]
  - [fs] nfs4.1: Remove a bogus BUG_ON() in nfs4_layoutreturn_done (Steve Dickson) [1385480 1376467]
  - [firmware] dmi_scan: DMI information in sysfs is missing on SMBIOS 3.0 based systems (Steve Best) [1393464 1353807]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-642.13.2.el6]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424626 1424628] {CVE-2017-6074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.14.1.el6]
changelog:
  - [net] sctp: validate chunk len before actually using it (Hangbin Liu) [1399456 1399457] {CVE-2016-9555}
  - [netdrv] qlcnic: add wmb() call in transmit data path (Harish Patil) [1403143 1342659]
  - [kernel] audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore) [1359302 1359304] {CVE-2016-6136}
  - [fs] nfs: Kill fscache warnings when mounting without -ofsc (David Howells) [1399172 1353844]
  - [fs] nfs: Fix a compile issue when CONFIG_NFS_FSCACHE was undefined (David Howells) [1399172 1353844]
  - [fs] nfs: Don't pass mount data to nfs_fscache_get_super_cookie() (David Howells) [1399172 1353844]
  - [fs] nfsd: handle fileid wraparound (Dave Wysochanski) [1399174 1397552]
  - [scsi] hpsa: correct logical resets (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: generate a controller NMI (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: update driver version to 3.4.10-0-RH3 (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: Check for null devices in ioaccel submission patch (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: check for null device pointers (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: correct skipping masked peripherals (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: generalize external arrays (Joseph Szczypek) [1399175 1083110]
  - [fs] ext4: fix extent tree corruption caused by hole punch (Lukas Czerner) [1397808 1351798]
  - [hv] do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1397739 1378614]
  - [powerpc] ppc64: Fix incorrect return value from __copy_tofrom_user (Gustavo Duarte) [1398185 1387243]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.2.1.el6]
changelog:
  - [sched] Revert "kernel: sched: Cure load average vs NO_HZ woes" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Cure more NO_HZ load average woes" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Move sched_avg_update to update_cpu_load" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Fix nohz load accounting -- again" (Rafael Aquini) [1343015 1326373]
  - [fs] lockd: Don't try to register/unregister callbacks on the inet6addr_chain if the ipv6 module isn't loaded (Scott Mayhew) [1341496 1336483]
  - [fs] nfsd: Don't try to register/unregister callbacks on the inet6addr_chain if the ipv6 module isn't loaded (Scott Mayhew) [1341496 1336483]
  - [isdn] avoid calling tty_ldisc_flush() in atomic context (Sabrina Dubroca) [1337443 1328115]
  - [redhat] Update dracut dependency to pull in ecb module (Herbert Xu) [1334431 1315832]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.3.1.el6]
changelog:
  - [infiniband] security: Restrict use of the write interface (Don Dutile) [1332547 1332548] {CVE-2016-4565}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.4.2.el6]
changelog:
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355606 1355607] {CVE-2016-5696}


author: Baoquan He <bhe@redhat.com> - 2.0.0-292
changelog:
  - mkdumprd: Enhance kdump to handle multiport network card properly resolves bug 1284605
  - mkdumprd: Create special partition name for NVME device resolves bug 1235374
  - Don't handle vnet<n> used by VMs on RHEV host resolves bug 1283191
  - mkdumprd: hush does not support parenthesis in ko parameter directly resolves bug 1028298
  - kdump.init: fix a typo resolves bug 1295283


author: Baoquan He <bhe@redhat.com> - 2.0.0-293
changelog:
  - mkdumprd: Remove partition seperater as well while dropping partition number in device name, resolves bug 1228799


author: Baoquan He <bhe@redhat.com> - 2.0.0-298
changelog:
  - b0e4c65 Use file offset in initialize_mmap(), resolves bug 1314158
  - 85f20f9 mkdumprd: redirect stderr of bmc-watchdog to /dev/null resolves bug 1315270


author: Baoquan He <bhe@redhat.com> - 2.0.0-299
changelog:
  - mkdumprd: Use a flexible way to create rtc device, resolves bug 1315148
  - hyper-v: do not exclude hv_utils module, resolves bug 1228774


author: Baoquan He <bhe@redhat.com> - 2.0.0-300.2
changelog:
  mkdumprd: Allow findmodule() to add dependency for lsmod output, resolves bug 1403699
  mkdumprd: Kill useless code in moduledep(), resolves bug 1403699


author: Jiri Skala <jskala@redhat.com> - 4.0.9-1
changelog:
  - Resolves: #602838 - CVE-2010-2251 lftp: multiple HTTP client download filename vulnerability
  - re-base to latest upstream version


author: Tomas Hozza <thozza@redhat.com> - 4.0.9-3
changelog:
  - Fix lftp to try also other addresses if connecting to first fails (#732863)
  - Fix lftp hang when using ascii mode with sftp (#842322)
  - Fix lftp to overwrite filename when auto-rename and clobber are enabled (#619777)
  - Add description of xfer:auto-rename into man page (#674875)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-3
changelog:
  - New upstream release 0.1.2
  - Fixes a serious issue with libdhash where hash_enter() would never update
  - existing entries for a key.


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-6
changelog:
  - Resolves: rhbz#668586 - ding-libs subpackages should have explicit version
  -                         requirements


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-7
changelog:
  - Resolves: rhbz#736074 - dhash can corrupt memory if initial table size is
                            large


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-8
changelog:
  - Fix bad patch
  - Related:  rhbz#736074 - dhash can corrupt memory if initial table size is
                            large


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.0-11
changelog:
  - Do not package built objects in dhash-devel
  - Fix NVR in the previous changelog entry
  - Related: rhbz#1069287 - Rebase ding-libs to latest version in 6.6


author: Karel Zak <kzak@redhat.com> 2.17.2-12.19
changelog:
  - fix #1088411 - lsblk does not list dm-multipath and partitioned devices
  - fix #1215840 - slogins segfault and failure to allocate memory
  - fix #1023655 - 'pppd' hangs (uninterruptable) when run on tty
  - fix #1168390 - lscpu doesn't show all nodes on a discontinuous NUMA setup
  - fix #1191236 - 'umount -f' calls readlink on dead NFS mounts and hangs
  - fix #1172297 - umount --fake fails to edit mtab for NFS mounts which are already gone
  - fix #961148  - RHEL6: swapon: add "discard" support
  - fix #1150302 - ionice support class names
  - fix #1085062 - fdisk -l fails to fully process /proc/partitions when multipath device
  - fix #1122839 - fallocate and findmnt have wrong options according to man pages
  - fix #1089663 - Not all xfs mount options are described in mount(8)
  - fix #1295737 - man page for hwclock doesn't include --compare option
  - fix #1140594 - mount --move badly documented
  - fix #1296894 - RHEL6: update audit event in hwclock
  - fix #1266191 - fdisk does not handle >2TB disks correctly


author: jchaloup <jchaloup@redhat.com> - 0.40.rc1-16
changelog:
  - extending cgroup names with default
    resolves: #1139205
  - fixing libcgroup-0.40.rc1-reading-config-files-from-etc-cgconfig.d.patch not to modify patch backup file
    resolves: #1162220


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-3
changelog:
  - drop the S390 build workaround as it is no longer needed
  - additional spec file cleanups for merge review (#226008)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-5
changelog:
  - use /dev/urandom for seeding in the FIPS mode
  - make the tests to pass in the FIPS mode also fixing
    the FIPS-186-3 DSA keygen


author: Harald Hoyer <harald@redhat.com> 147-2.65
changelog:
  - 80-drivers.rules: only make an exception for ipmi for
                      modprobe with DRIVER set
  Resolves: rhbz#1268251


author: Michal Sekletar <msekleta@redhat.com> - 147-2.66
changelog:
  - prevent creation of duplicate udev rules by write_net_rules helper (#652499)
  - fix memory leak in scsi_id (#891669)
  - introduce SECLABEL{selinux} for setting explicit SELinux labels on device nodes (#1015300)
  - for ATA disks udev will now also create by-id/wwn-* symlinks when appropriate (#1220617)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-17
changelog:
  - Backport of a more minimal dependency patch to avoid changes to AD
    provider behaviour
  - Related: rhbz#1264705 - Allow SSSD to notify user of denial due to AD
                            account lockout


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-18
changelog:
  - Resolves: rhbz#1209600 - Getting ERROR (getpwnam() failed): Broken pipe
                             with 1.11.6


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-20
changelog:
  - Actually apply patches from previous build
  - Resolves: rhbz#1313940 - sudorule not working with ipa sudo_provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-21
changelog:
  - Resolves: rhbz#1313940 - SSSD PAM module does not support multiple
                             password prompts (e.g. Password + Token) with sudo


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-22.2
changelog:
  - Resolves: rhbz#1342058 - In IPA-AD trust environment access is granted
                             to AD user even if the user is disabled on AD.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-22.6
changelog:
  - Explicitly Require the matching version of ding-libs
  - Related: rhbz#1379580 - SSSD fails to process GPO from Active Directory.


author: Andreas Schneider <asn@redhat.com> - 3.6.23-29
changelog:
  - resolves: #1322687 - Fix CVE-2015-5370
  - resolves: #1322687 - Fix CVE-2016-2110
  - resolves: #1322687 - Fix CVE-2016-2111
  - resolves: #1322687 - Fix CVE-2016-2112
  - resolves: #1322687 - Fix CVE-2016-2115
  - resolves: #1322687 - Fix CVE-2016-2118 (Known as Badlock)


author: Andreas Schneider <asn@redhat.com> - 3.6.23-34
changelog:
  - resolves: #1329967 - Fix netlogon credential checks
  - resolves: #1329975 - Fix dcerpc trailer verificaton


author: Petr Hracek <phracek@redhat.com> - 3.9.4-10
changelog:
  - This resolves several CVEs
  - CVE-2014-8127, CVE-2014-8129, CVE-2014-8130
  - CVE-2014-9330, CVE-2014-9655, CVE-2015-8781
  - CVE-2015-8784, CVE-2015-1547, CVE-2015-8683
  - CVE-2015-8665, CVE-2015-7554, CVE-2015-8668
  - Resolves: #1299919


author: Nikola Forró <nforro@redhat.com> - 3.9.4-14
changelog:
  - Merge previously released fixes for CVEs:
  - CVE-2013-1960 CVE-2013-1961 CVE-2013-4231
  - CVE-2013-4232 CVE-2013-4243 CVE-2013-4244
  - Resolves: #1335099


author: Nikola Forró <nforro@redhat.com> - 3.9.4-16
changelog:
  - Add patches for CVEs:
  - CVE-2016-3632 CVE-2016-3945 CVE-2016-3990
  - CVE-2016-3991 CVE-2016-5320
  - Related: #1335099


author: Nikola Forró <nforro@redhat.com> - 3.9.4-19
changelog:
  - Add patches for CVEs:
  - CVE-2016-9533 CVE-2016-9534 CVE-2016-9535
  - CVE-2016-9536 CVE-2016-9537 CVE-2016-9540
  - CVE-2016-5652
  - Resolves: #1412078


author: Steve Dickson <steved@redhat.com> 0.2.1-7
changelog:
  - Fixed some races in getnetconfig code (bz 1031498)
  - Remove the installation of libtirpc.a and libtirpc.la (bz 869397)


author: Steve Dickson <steved@redhat.com> 0.2.1-11
changelog:
  - Backported upstream debugging (bz 1273158)
  - Fixed memory leak in svc_vc_create (bz 1276687)
  - Fixed memory leak in svc_tli_create (bz 1276855)
  - Fixed memory leak in __svc_vc_dodestroy (bz 1276856)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-18.el6
changelog:
  - CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1149086)
  - Fix html serialization error and htmlSetMetaEncoding (rhbz#1004513)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-19.el6
changelog:
  - Stop parsing on entities boundaries errors
  - Fix missing entities after CVE-2014-3660 fix (rhbz#1149086)


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-20.1
changelog:
  - Fix a series of CVEs (rhbz#1286495)
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - Libxml violates the zlib interface and crashes


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-21.el6.8.1
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-4
changelog:
  - The devel subpackage now properly requires the base package to avoid
    multilib conflicts (#869633)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-6
changelog:
  - Willing SUT retains PFC operational state from peer after peer
    stops transmitting TLV (#870578)
  - Unable to query configured PFC priorities under IEEE DCBX (#870576)


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.2-4
changelog:
  - Fix problem where mdadm allowed the creation of more arrays than
    supported by the BIOS.
  - Resolves bz1211564


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.3
changelog:
  - Retry reading sync_completed state to avoid a reshape not continuing after
    restarting a reshape
    This is an additional patch to resolve this bug.
  - Resolves bz1331331


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.4
changelog:
  - Fix problem with mdadm large device names overflowing an internal buffer,
    potentially leading to segfaults.
  - Resolves bz1347808


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.5
changelog:
  - Fix problem with reshaping IMSM arrays, where a new reshape could be
    launched before the first reshape had fully completed, leading to
    unpected results.
  - Resolves bz1348544


author: Paul Lindner <lindner@inuus.com> - 1.4.3-1
changelog:
  - Add explicit require on memcached for memcached-devel (resolves 537046)
  - enable-threads option no longer needed
  - Update web site address


author: Paul Lindner <lindner@inuus.com> - 0:1.4.4-1
changelog:
  - Upgraded to upstream memcached-1.4.4 (http://code.google.com/p/memcached/wiki/ReleaseNotes144)
  - Add explicit Epoch to fix issue with broken devel dependencies (resolves 542001)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.4-3.el6_8.1
changelog:
  - fix vulnerabilities allowing remote code execution (CVE-2016-8704,
    CVE-2016-8705, CVE-2016-8706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-55.el6
changelog:
  - Fixed 'clientaddr' option for UDPv6 client messages (#1279501)
  - Increased maximum size of AgentX packets (#1271196).
  - Fixed IP-MIB::ipSystemStatsInOctets and similar counters for IPv4
    (#1250023).
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1246568)
  - Fixed typos in NET-SNMP-AGENT-MIB.txt (#1241865)
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1227640)
  - Restored message about duplicate IP address (#1227374)
  - Fixed fd leak in sctp statistics (#1291054)


author: Josef Ridky <jridky@redhat.com> - 1:5.5-57.el6_8.1
changelog:
  - Resolves: #1363606 - An SNMPv3 request with a small max message size can lead to SNMPv1/2c bulk requests timing out


author: Steve Dickson <steved@redhat.com> 1.2.3-65
changelog:
  - nfsidmap: make sure give arguments are valid (bz 1230600)
  - nfsidmap: Display the effective NFSv4 domain name (bz 948680)
  - gssd: allow gssd and svcgssd to set the libtirpc debug level (bz 1273161)
  - gssd: select non-conventional principal (bz 1268031)
  - gssd:  Don't assume the machine account will be in uppercase (bz 1273166)
  - sm-notify: delete files in sm.bak after a NOTIFY reply (bz 1278921)


author: Steve Dickson <steved@redhat.com> 1.2.3-66
changelog:
  - svc_create: Make sure errors are logged (bz 1156647)
  - gssd: suppress error message if rpc_pipefs dir disappears (bz 1220156)
  - gssd: set $HOME to prevent recursion (bz 1223661)
  - statd: Update existing record if we receive SM_MON... (bz 1280024)
  - mountstats.man: fixed typo in man page (bz 1263968)


author: Steve Dickson <steved@redhat.com> 1.2.3-67
changelog:
  - mount.nfs: Fix fallback from tcp to udp (bz 1287894)
  - exportfs: escape path for function test_export (bz 735696)
  - nfs-utils.spec: No verification on runtime configuration files (bz 1118176)
  - idmapd: added usage statement (bz 1001439)
  - mountd: fix netgroup lookup for short hostnames (bz 1231998)
  - mountd: fix bug affecting exports of dirs with 64bit inode number (bz 994564)


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-2
changelog:
  - Enable two additional ciphers and keep another one disabled
  - Prevent enabling extended masker key derive


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-6
changelog:
  - Fix syntax errors in patch that disables sslv2 tests
  - Resolves: Bug 1297888 - Rebase RHEL 6.8 to NSS 3.21 for Firefox 45


author: Kai Engert <kaie@redhat.com> - 3.21.3-2
changelog:
  - Mozilla #1314604 / Red Hat CVE-2016-8635
  - remove disable_hw_gcm.patch which hasn't been used since 3.16.1


author: Bob Relyea <rrelyea@redhat.com> - 3.14.3-21
changelog:
  - Require nss-softokn-freebl of at least the same version and release
  - Resolves: Bug 1182662 - nss-softokn-3.14.3-19.el6_6 breaking yum and rpm


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-1
changelog:
  - update to 4.2.6p5 (#654004, #641800, #714079, #714084, #716968, #819781,
    - bind broadcast client to new interfaces (#973807)
  - allow selection of cipher for private key files (#749530)
  - retry few times in ntpdate init script before giving up (#673198)
  - print synchronization distance instead of dispersion in ntpstat (#830821)
  - ignore duplicate servers from dhclient (#862983)
  - add fourth server to default ntp.conf and use iburst (#667524, #623616)
  - drop comment enabling local driver in default config (#816645)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - add option to set Differentiated Services Code Point (DSCP) (#1228314)
  - extend rawstats log (#1242895)
  - fix resetting of leap status (#1243034)
  - report clock state changes related to leap seconds (#1242937)
  - allow -4/-6 on restrict lines with mask (#1232146)
  - retry joining multicast groups (#1288534)
  - explain synchronised state in ntpstat man page (#1286969)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10
changelog:
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10.el6_8.1
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10.el6_8.2
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Tom Lane <tgl@redhat.com> 1.3-7
changelog:
  - Apply two upstream fixes for crasher bugs
  Resolves: #609389
  - Fix FTBFS: ImplicitDSOLinking (see Fedora bug 564783)


author: Tom Lane <tgl@redhat.com> 1.3-8
changelog:
  - Apply patches for CVE-2009-5030, CVE-2012-3358
  Resolves: #831562
  - Include -DCMAKE_INSTALL_LIBDIR in cmake call; fixes FTBFS with recent
    versions of cmake


author: Petr Hracek <phracek@redhat.com> 1.3-10
changelog:
  - Apply patch for CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052 
  Resolves: #1038987 CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052


author: Nikola Forró <nforro@redhat.com> - 1.3-16
changelog:
  - Revert previous changes in patch for CVE-2016-5159
  - Fix double free in patch for CVE-2016-5139
  - Fix memory leaks and invalid read in cio_bytein
    Related: #1419775


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1229871)
  - document some options of the speed command (#1197095)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.1
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.3
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength
  - replace expired testing certificates


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.4
changelog:
  - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher
  - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts


author: Klaus Wenninger <kwenning@redhat.com> - 1.1.14-1.0
changelog:
  - Update to upstream release 1.1.14
   - added README_RGManager_porting to document replacement of
       ccs2cib, ccs_flatten & disable_rgmanager
   - added patchset (0100-0111) from master to implement graceful
       stop of pacemaker_remote
   - require minimum-version 0.17.0 of libqb

    Resolves: rhbz#1193499
    Resolves: rhbz#1195500
    Resolves: rhbz#1200853
    Resolves: rhbz#1215809
    Resolves: rhbz#1219103
    Resolves: rhbz#1235316
    Resolves: rhbz#1246490
    Resolves: rhbz#1246563
    Resolves: rhbz#1252206
    Resolves: rhbz#1257333
    Resolves: rhbz#1275223
    Resolves: rhbz#1287535
    Resolves: rhbz#1297564


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.14-3
changelog:
  - prevent crmd crash after unexpected Pacemaker Remote connection takeover
   - ensure package URL is displayed correctly

    Resolves: rhbz#1252206


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.146-1
changelog:
  - Rebased to latest upstream packages
  - Rubygems built with RELRO
  - Resolves: rhbz#1260021 rhbz#1242158


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.148-1
changelog:
  - Rebased to latest upstream packages
  - Fixed crashes on one-node clusters
  - Resolves: rhbz#1260021 rhbz#1283627


author: Ivan Devat <idevat@redhat.com> - 0.9.148-2
changelog:
  - Moved DISABLED_GUI option to /etc/sysconfig/pcsd
  - Added backend support for new cluster properties form in web UI
  - Fixed multilib .pyc/.pyo issue
  - Resolves: rhbz#1297782 rhbz#1298163


author: Ivan Devat <idevat@redhat.com> - 0.9.148-3
changelog:
  - Fixed updating cluster properties from older version of web UI
  - Fixed syntax error in utilization attributes functions
  - Resolves: rhbz#1298163
  - Related: rhbz#1260021


author: Paul Howarth <paul@city-fan.org> - 1.35-7
changelog:
  - update to svn trunk (rev 252), needed due to omission of MD2 functionality
    from OpenSSL 1.0.0 (CPAN RT#48916)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-39
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Remi Collet <rcollet@redhat.com> - 5.3.3-47
changelog:
  - fix wrong warning in openssl_encrypt() for missing IV
    when IV is not required #1260315
  - fix segfault's when you try and allocate an SplFixedArray
    with size >= 9999 #1071344
  - segfault in php_pgsql_meta_data CVE-2015-4644  #1234434
  - add options to enable TLS in curl #1255920
  - fix segfault in gc_collect_cycles #1122681


author: Jack Magne <jmagne@redhat.com> 9.0.3-42
changelog:
  - Resolves #1221900 - pki-core: cross-site scripting flaw in the dogtag administration page (port 9180, port 9444) [rhel-6.7]


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-43
changelog:
  - Resolves #1225589 - unable to create rhel 7.1 replica from rhel 6 replica CA because subsystem user does not exist


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-44
changelog:
  - Resolves #1256039 - Fixed missing subsystem user on external CA case.
  - Removed unused backup files (.p*) generated by the patches.


author: Ade Lee <alee@redhat.com> 9.0.3-48
changelog:
  - Resolves #1306989 - Crash seen with pki-common pkg during IPA server install
  - Resolves #1290535 - Check for incompatible Java at startup
  - Resolves #1313207 - ca.subsystem.certreq missing from CS.cfg


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-21
changelog:
  - fixfiles verify: do not relabel /tmp and /var/tmp dirs
  Resolves: rhbz#1113083
  - Fix semanage -S <store> -o <output>
  Resolves: rhbz#1122850


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-23
changelog:
  - Move python scripts in /usr/share/system-config-selinux to policycoreutils-python
  Resolves: rhbz#995778


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-26
changelog:
  - restorecond: treat root as a regular user
  Resolves: rhbz#1281877
  - semanage: don't skip reserver_port_t
  Resolves: rhbz#1225806
  - semanage: check if a store exists
  Resolves: rhbz#1208801
  - fixfiles: check the SELinux status
  Resolves: rhbz#1240788


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-27
changelog:
  - sandbox: Improve comments in sysconfig file
  Resolves: rhbz#1159336
  - secon, newrole: fix inconsistence between --help and man page
  Resolves: rhbz#1278811, rhbz#1278913


author: Robert Kuska <rkuska@redhat.com> - 2.6.6-59
changelog:
  - Let ConfigParse handle options without values
  - Add check phase to specfile, fix and skip relevant failing tests
  Resolves: rhbz#1031709


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-63
changelog:
  - Since -libs now provide python-ordered dict, added ordereddict
    dist-info to site-packages
  Resolves: rhbz#1199997


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346354


author: Matthias Saou <http://freshrpms.net/> 8.1.0-2
changelog:
  - Update to 8.1.0.
  - Merge back changes from Paul Howarth.
  - Make sure the scriplets never return a non-zero exit status.


author: Doug Ledford <dledford@redhat.com> - 3.10-2
changelog:
  - Somehow during editing I accidentally deleted a single character from
    the post scriptlet.  rpmdiff caught it, now I'm fixing it.
  - Resolves: bz990288


author: Doug Ledford <dledford@redhat.com> - 6.6_3.15-1
changelog:
  - Change numbering scheme to be clearer: first number is redhat
    release this package is for (aka rhel6.6), second number is the
    upstream kernel that our kernel code comes from, aka 3.15.
  - Minor fix to init script to support cxgb4 and ocrdma and mlx5
    drivers properly
  - Add a dracut module to make sure all the needed InfiniBand
    kernel modules and support files make it on to the initrd
  - Resolves: 1064308


author: Doug Ledford <dledford@redhat.com> - 6.7_3.15-2
changelog:
  - Fix ipoib MTU issue
  - Fix shutdown ordering of NFSoRDMA code
  - Absorb mlx4/cxgb3/cxgb4 setup/module init code into our package
  - Resolves: bz1186498, bz1163527


author: Doug Ledford <dledford@redhat.com> - 6.7_3.15-4
changelog:
  - Fix modprobe file so command line opts passed to modprobe mlx4_core will
    work again
  - Resolves: bz1215857


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-26
changelog:
  - Match exact Oracle SID to avoid waiting for 90 seconds and killing other databases if their names include the name of the database you're trying to stop
  - Use DAD to check for address collision instead of ping for IPv6 in rgmanager
  - MySQL wait up to "startup_wait" seconds for mysqld to create PID
  - Handle failure state during stop in orainstance.sh
  - Add Oracle resource agents for Pacemaker

    Resolves: rhbz#1200639
    Resolves: rhbz#1191247
    Resolves: rhbz#1207285
    Resolves: rhbz#1234777
    Resolves: rhbz#1070479


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-27
changelog:
  - SAP HANA add Multiple Components One System (MCOS) support
  - sap_redhat_cluster_connector add support for "-" in hostnames

    Resolves: rhbz#1200903
    Resolves: rhbz#1269897


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-28
changelog:
  - Use IPv6 DAD for collision detection in IPaddr2
  - Add RAID segment type support for HA LVM
  - Fix Tomcat SELinux failed in enforcing mode
  - Add migrate_options parameter to VirtualDomain
  - Remove not-working tmpfs "support" from fs.sh
  - Fix tmpfile leak in mysql resource agent

    Resolves: rhbz#1276698
    Resolves: rhbz#1266173
    Resolves: rhbz#1280319
    Resolves: rhbz#1286650
    Resolves: rhbz#1024505
    Resolves: rhbz#1292054


author: Jan Pokorny <jpokorny@redhat.com> - 3.9.5-31
changelog:
  - Fix up for wrongly generated RNG schema for cluster configuration
    wrt. "action" tag

    Related: rhbz#1272587


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-32
changelog:
  - Add portblock resource agent for Pacemaker
  - Add Oracle Data Guard resource agent for rgmanager

    Resolves: rhbz#1302545
    Resolves: rhbz#1086838


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-20
changelog:
  - rgmanager: clusvcadm: If service doesn't exist, try
    Resolves: rhbz#952729
  - rgmanager: Don't crash if a resource agent does not
    Resolves: rhbz#1018079
  - rgmanager: Fix rg_test exit status on failures
    Resolves: rhbz#1033162
  - rgmanager: resrules: make expand_time buffer-less
    Resolves: rhbz#1036652
  - rgmanager: Fix error logging when building the resource
    Resolves: rhbz#1053739


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-22
changelog:
  - rgmanager: Fix potential NULL ptr deref in clustat
    Resolves: rhbz#1079207
  - rgmanager: Log a warning when the non-critical flag is
    Resolves: rhbz#1128877
  - rgmanager: Don't restart locally if failover domain
    Resolves: rhbz#1151199


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-25
changelog:
  - rgmanager: Fix bash syntax error in clunfslock
    rgmanager: clunfslock: copy state info if it exists
    Resolves: rhbz#1278943


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.1
changelog:
  - rgmanager: Reload the resource tree after quorum is regained
    if central processing is enabled.
    Resolves: rhbz#1335412


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.2
changelog:
  - rgmanager: Forget that we were transition master if quorum is dissolved
    rgmanager: Re-init the vf key callbacks after losing and recovering quorum
    Resolves: rhbz#bz1335412
  - rgmanager: Check for NULL when attempting to access the member list
    Resolves: rhbz#bz1343345


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.3
changelog:
  - rgmanager: Exit more gracefully if cman stops first when cpg locks are used
    Resolves: rhbz#1344640


author: Andreas Schneider <asn@redhat.com> - 4.0.0-67.rc4
changelog:
  - resolves: #1290709 - CVE-2015-7540
  - related: #1290709 - CVE-2015-5299
  - related: #1290709 - CVE-2015-5296
  - related: #1290709 - CVE-2015-5252
  - related: #1290709 - CVE-2015-5330


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-286
changelog:
  - arping running as netutils_t sys_module capability for removing tap devices. Dontaudit this access.
  - Allow hv_vss_daemon to write access on all mount point directories to make VSS live backup if working if there is home partition.
  - Add support for squid to be able to create temoporary files. 
  Resolves:#1291164
  - Allow usbhid-ups to access /proc/bus/usb to have it working on ppc64 machines. 
  Resolves:#1290693
  - Add support for /var/run/chronyd.sock. 
  Resolves:#1290310
  - Update apache_content_template() inteface to allow "shutdown" permissions for apache scripts on unix_stream_socket. 
  Resolves:#1286052
  - Fix label for /var/lib/graphite-web 
  Resolves:#1221934
  - Dontaudit rpm write access for prelink_mask_t Resolves:#1216907
  - Allow apcupsd_t to communicate with sssd Add default label for /var/lock/subsys/apcupsd and /var/lock/LCK.
  Resolves:#1286030
  - Allow shorewall_t to create netlink_socket 
  Resolves:#1290705


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-287
changelog:
  - Allow sssd-ifp to dbus chat with all users. 
  Resolves:#1296693
  - Allow keepalived to connect to 3306/tcp port - mysqld_port_t.
  Resolves:#1296854
  - Add support for stunnel custom log files, allow transition and label /log/stunnel* log files. 
  Resolves:#1296238
  - Provide conman_unconfined_script_exec_t/conman_unconfined_script_t SELinux types used for conman scripts.
  - Resolves:#1290565
  - Allow ctdbd trasition to smbcontrol_t when "ctdb disablescript 50.samba" is executed.
  - Resolves:#1293787
  - Label ctdbd event scripts as ctdbd_exec_t instead of bin_t. 
  Resolves:#1293787
  - Allow watchdog to read localization files. It wants to access localtime. 
  Resolves:#1267974
  - Backport rules allowing sssd_t to be able to request the kernel to load a module.
  Resolves:#1246634


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-288
changelog:
  - Allow netutils_t domain to chown capability.
  Resolves:#1298514
  - Allow all jabber domain to access SSL certs.
  Resolves:#1261145
  - Allow shorewall request kernel load module
  Resolves:#1290705
  - Allow passwd to create temporary files to support ssh logins if gnome-keyring-daemon is called by passwd and runs in passwd_t.
  Resolves:#1131531
  - Allow stunnel to write log outputs on users pty.
  Resolves:#1296238
  - Allow polkit-1/actions to get attributes for all filesytems.
  Resolves:#1301561
  - Allow p11-child to connect to apache ports. Allow p11-child  to manage authentication cache.


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  Related: #1326621


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.1
changelog:
  - Allow ipc_lock capability for glusterd.
  - GlusterFS volumes of RDMA transport proceed fuse mount and requires ipc_lock capability.
  Resolves: #1388582


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.2
changelog:
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1393267
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs
  Resolves: rhbz#1393253


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.3
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1409482


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-1
changelog:
  - new version 8.14.4 (#552078)
  - RPM attributes S, 5, T not recorded for statistics file
  - adapted patches: makemapman, dynamic, switchfile (#552078)
  - movefiles patch incorporated into aliases_dir patch
  - dropped patches (fixed upstream): exitpanic, certcnnul


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-5
changelog:
  - used noreplace for sasl config
  - used ghost instead of explicit provides
  - deffattr changed to (-,root,root,-)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-9
changelog:
  - fixed MAXHOSTNAMELEN for FQDN
    resolves: rhbz#640234
  - fixed assertion if server connection is lost while making LDAP query
    resolves: rhbz#837007
  - fixed milterfdleaks patch to check socket before using fcntl on it
    resolves: rhbz#845821
  - fixed ldap_routing macro
    resolves: rhbz#890227
  - properly set {client_port} value on little endian machines,
    patch by Kelsey Cumminngs <kgc@corp.sonic.net>
    resolves: rhbz#1106852


author: <dwalsh@redhat.com> - 3.0.47-3
changelog:
  - Sedispatch is not handling audit messages correctly, 
    this fix allows setroubleshoot to process alerts.
  Resolves: #575686


author: Miroslav Grepl <mgrepl@redhat.com> - 3.0.47-4
changelog:
  - Make sealert working if description contains parenthesis
  - Remove -H from man page
  Resolves:#788196


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-11
changelog:
  - Resolves: #1248855 - After updating to squid-3.1.23-9.el6,
    service squid {reload,restart} fails with "Operation not permitted"


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-13
changelog:
  - Resolves: #1230753 - insufficient check for running service in condrestart
    and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-14
changelog:
  - Related: #1248855 - After updating to squid-3.1.23-9.el6,
    service squid {reload,restart} fails with "Operation not permitted"
  - Related: #1230753 - insufficient check for running service in condrestart 
    and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.1
changelog:
  - Resolves: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.2
changelog:
  - Related: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.3
changelog:
  - Resolved: #1334489 - CVE-2016-4554 CVE-2016-4556 squid: various flaws
  - Related: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-4
changelog:
  - Resolves: #1301005 - insufficient check for running service
    in condrestart and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.1
changelog:
  - Resolves: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid34: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.2
changelog:
  - Related: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid34: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.3
changelog:
  - Resolves: #1334499 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556
    squid34: various flaws
  - Resolves: #1334506 - CVE-2016-4553 squid34: squid: Cache poisoning
    issue in HTTP Request handling


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.4
changelog:
  - Resolves: #1412733 - CVE-2016-10002 squid34: squid: Information disclosure
    in HTTP request processing


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-19
changelog:
  - RHEL-6.7 erratum
    - modified the authlogicfix patch to fix #1144448
    - fixed a bug in the ldapusermatchfix patch
    Resolves: rhbz#1144448
    Resolves: rhbz#1142122


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - removed defaults option requiretty from /etc/sudoers
    - backported pam_service and pam_login_service defaults options
    - implemented a new defaults option for changing netgroup processing
      semantics
    - fixed visudo's quiet cli option
    Resolves: rhbz#1248695
    Resolves: rhbz#1247231
    Resolves: rhbz#1241896
    Resolves: rhbz#1197885
    Resolves: rhbz#1233205


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - fixed ldap's and sssd's sudoOption value and remove quotes
    - fixed ldap's and sssd's sudoOption whitespaces parse problem
    Resolves: rhbz#1144422
    Resolves: rhbz#1279447


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - search also by user id when fetching rules from LDAP
    Resolves: rhbz#1135531


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-22
changelog:
  - RHEL-6.8 erratum
    - fixed potential getcwd failure, resulting in Null pointer exception 
    Resolves: rhbz#1284886


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-23
changelog:
  - RHEL-6.8 erratum
    - fixed handling of closefrom_override defaults option
    Resolves: rhbz#1309976


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-24
changelog:
  - RHEL-6.8 erratum
    - fixed a bug causing that non-root users can list privileges of
      other users
    Resolves: rhbz#1312481


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-6
changelog:
  - fix for uninit defect (revealed by Coverity) added with %patch11.
  - recovered traditional behaviour of '--keep-old-files' option and added new
    option '--skip-old-files' (#799252)


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-7
changelog:
  - disable tests/remfiles01.at for running as a privileged user (#687972)
  - fix undesired error exit on receiving SIGPIPE during performing --list
    operation (#807728) and related fix for test suite -- skip SIGPIPE-dependent
    tests in environments ignoring SIGPIPE


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-8
changelog:
  - fix for bad file matching during extracting concrete files from an archive
    (backported fix from fedora 14) (#841308)
  - typo - better separate comments in spec file


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-9
changelog:
  - backport also --listed-incremental crash fix, this patch is in upstream and in
    fedora from f14 (related to #841308)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.23-10
changelog:
  - backport upstream patch to make sure that file matching is done before file
    file-name transformation (#875727)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.23-11
changelog:
  - avoid crash by backporting upstream patch for internal construction of
    file-name hash table (#877769).


author: Pavel Raiskup <praiskup@redhat.com> - 1.23-12
changelog:
  - better auto-recognize xz compressed archives (#1056672)
  - fix --verify option (#923359)
  - fnmatch fixes (#1034360)


author: Pavel Raiskup <praiskup@redhat.com> - 1.23-14
changelog:
  - fix error while storing UID > 2^21 into posix format archive (rhbz#1247788)
  - don't mistakenly set default ACLs (#1220891)


author: Petr Kubat <pkubat@redhat.com> - 1.23-15
changelog:
  - fix error when compressing/listing large sparse files (#1334559)
  - improve sparse mode in genfile for build-time-testsuite purposes


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.17-35.el6_8.1
changelog:
  - fix regression with 'jobs' builtin output not going to stdout (bug #1357127)
  - fix several regressions in tcsh-6.17.00-quote-backslashes-properly.patch (bug #1357126)


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-95
changelog:
  - Related: rhbz#1084426 Reverting to prevent Satellite installation issues mentioned in rhbz-1302761


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-97
changelog:
  - Resolves: rhbz#1367051 CVE-2015-5174 URL Normalization issue
  - Resolves: rhbz#1367054 CVE-2016-0706 Security Manager bypass via StatusManagerServlet
  - Resolves: rhbz#1367058 CVE-2016-0714 Security Manager bypass via persistence mechanisms
  - Resolves: rhbz#1367054 CVE-2015-5345 Directory disclosure


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-98
changelog:
  - Resolves: rhbz#1362210 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368119


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-102
changelog:
  - Resolves: rhbz#1413589 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402664 CVE-2016-6816 tomcat6: tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-105
changelog:
  - Related: rhbz#1402664 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-encoded characters
  - Related: rhbz#1402664 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-3
changelog:
  - Synchronize javazic tool for OpenJDK 6 & 7 with upstream. (#1212549)
  - Fix Africa/Casablanca transitions from 2027 forward. (#1217109)


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST. (BZ #1425222)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1427694)


author: Olivier Fourdan <ofourdan@redhat.com> 1.17.4-3
changelog:
  - Add missing hw/xfree86/Xorg.sh.in to xorg-x11-server-source package.
    This is needed to build packages depending on xorg-x11-server-source
    (e.g. tigervnc), otherwise the build will fail.


author: Adam Jackson <ajax@redhat.com> 1.17.4-7
changelog:
  - Add bug-compatibility for exposure event generation for backing store's
    Always mode, and re-enable the feature


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-65
changelog:
  - Add query_install_excludes conf./docs and use it for list/info/search/provides.
  - Resolves: bug#1154076
  - Add --assumeno option.
  - Resolves: bug#1174612
  - Fix Obsoletes and Conflicts for yum-plugin-downloadonly.
  - Related: bug#1144503


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-70
changelog:
  - Add links to knowledge base articles.
  - Resolves: bug#1248686
  - Resolves: bug#1248687
  - Resolves: bug#1248690
  - Backport missing_requires to API.
  - Resolves: bug#1197245
  - Get correct rpmdb path from rpm configuration.
  - Resolves: bug#1271584


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-71
changelog:
  - Fix manpage for query_install_excludes option.
  - Resolves: bug#1248715
  - Don't traceback on xml parsing.
  - Resolves: bug#1225481
  - Respect epoch in package names.
  - Resolves: bug#1211390


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-72
changelog:
  - Add ftp_disable_epsv config option.
  - Resolves: bug#1293363
  - Honor proxy=_none_ set in yum.conf.
  - Resolves: bug#1293385


