# changelog

author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.0
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Kamil Dudka <kdudka@redhat.com> - 1.4.2-3.el6_10.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Robert Kuska <rkuska@redhat.com> - 2.6.6-59
changelog:
  - Let ConfigParse handle options without values
  - Add check phase to specfile, fix and skip relevant failing tests
  Resolves: rhbz#1031709


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-63
changelog:
  - Since -libs now provide python-ordered dict, added ordereddict
    dist-info to site-packages
  Resolves: rhbz#1199997


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346355


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-9
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-3
changelog:
  - fix problems found by qe:
  - AC13: SSL3 "disabled"
  - AC26: Chacha20 and TLS 1.3 ciphers should be prioritized
  -   SHA-384 PRF => *_256_GCM_SHA384 ciphers should be reenabled for consistency
  - AC28: nss-policy-check is missing from packages and $PATH
  - extra: apostrophes in certutil manpage got mangled


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-61
changelog:
  - virsh: Properly display block job type (rhbz#1326653)
  - spec: proper soft static allocation of qemu uid (rhbz#1351792)
  - Revert "qemu: snapshot: Fix modification of vm object without job" (rhbz#1326652)
  - qemu: snapshot: Fix job handling when creating snapshots (rhbz#1326652)
  - tls: remove support for gnutls 1.x.x, require 2.2.0 (rhbz#1333415)
  - configure: allow setting default TLS priority string (rhbz#1333415)
  - rpc: allow priority string to be passed to TLS context (rhbz#1333415)
  - libvirtd: add config option for TLS priority (rhbz#1333415)
  - remote: allow TLS protocol/cipher priority override in URI (rhbz#1333415)
  - Pass config file object through to driver open methods (rhbz#1333415)
  - remote: allow TLS priority to be customized (rhbz#1333415)
  - qemu: -numa doesn't (yet) support disjoint range (rhbz#1310122)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62
changelog:
  - qemu: fix return value of qemuDomainBlockPivot on errors (rhbz#1300159)
  - qemu: Fix virsh freeze when blockcopy storage file is removed (rhbz#1300159)
  - migration: add support for migrateURI configuration (rhbz#1347389)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62.el6_9.1
changelog:
  - util: Implement virFileReadHeaderFD (CVE-2017-5715)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-63
changelog:
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64
changelog:
  - cpu: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64.el6_10.1
changelog:
  - cpu_x86: Do not cache microcode version (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)


author: Petr Pisar <ppisar@redhat.com> - 2.0.4-12
changelog:
  - Fix CVE-2011-2767 (arbitrary Perl code execution in the context of the user
    account via a user-owned .htaccess) (bug #1626272)


author: Adam Tkac <atkac redhat com> - 1.7.1-1
changelog:
  - update to 1.7.1 (#585990)
  - Use %{gitcoredir}/git-daemon as xinetd server (#529682) [Todd Zullinger]
  - Remove long fixed xinetd IPv6 workaround (#557528) [Todd Zullinger]
  - Make %{_var}/lib/git the default gitweb root (#556299) [Todd Zullinger]
  - Include gitweb/INSTALL file as documentation [Todd Zullinger]
  - Ship example gitweb config (%{_sysconfdir}/gitweb.conf) [Todd Zullinger]
  - Install missing gitweb.js (#558740) [Todd Zullinger]
  - Only BR perl(Error) [Todd Zullinger]
  - Use config.mak to set build options [Todd Zullinger]
  - Disable building of unused python remote helper libs [Todd Zullinger]
  - Comply with Emacs add-on packaging guidelines (#573423) [Jonathan Underwood]
    - Place elisp source files in separate emacs-git-el package
    - Place git support files in own directory under site-lisp
    - Use Emacs packaging macros
  - Replace $RPM_BUILD_ROOT with %{buildroot} [Todd Zullinger]


author: Petr Stodulka <pstodulk@redhat.com> - 1.7.1-7
changelog:
  - fixes memory corruption on git shortlog
  - add -f option for "git submodule add" to add files even when
    these are included in .gitignore
  - improve performance of extremly slow http(s)
  - fix cloning using http(s) protocol when redirection is requested
    Resolves: #874659 #1207253 #1237395 #1289984


author: Petr Stodulka <pstodulk@redhat.com> - 1.7.1-8
changelog:
  - fixes previous patch which add -f option for "git submodule add"
    which incorectly used unsupported option --ignore-missing for
    "git add --dry-run"
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1207253 #1368384


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Remi Collet <rcollet@redhat.com> - 5.3.3-47
changelog:
  - fix wrong warning in openssl_encrypt() for missing IV
    when IV is not required #1260315
  - fix segfault's when you try and allocate an SplFixedArray
    with size >= 9999 #1071344
  - segfault in php_pgsql_meta_data CVE-2015-4644  #1234434
  - add options to enable TLS in curl #1255920
  - fix segfault in gc_collect_cycles #1122681


author: Remi Collet <rcollet@redhat.com> - 5.3.3-49
changelog:
  - fix php-soap fails to connect to HTTPS web service sporadically
    as stream_socket_enable_crypto() uses NONBLOCK #1283153


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-55.el6
changelog:
  - Fixed 'clientaddr' option for UDPv6 client messages (#1279501)
  - Increased maximum size of AgentX packets (#1271196).
  - Fixed IP-MIB::ipSystemStatsInOctets and similar counters for IPv4
    (#1250023).
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1246568)
  - Fixed typos in NET-SNMP-AGENT-MIB.txt (#1241865)
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1227640)
  - Restored message about duplicate IP address (#1227374)
  - Fixed fd leak in sctp statistics (#1291054)


author: Josef Ridky <jridky@redhat.com> - 1:5.5-58.el6
changelog:
  - Resolves: #1315481 - An SNMPv3 request with a small max message size can lead to SNMPv1/2c bulk requests timing out


author: Ales Ledvinka <aledvink@redhat.com> - 1.8.11-23
changelog:
  - (#1194420) Fix DDR4 SDR crash.
  - (#1170266) Wrong version reported.
  - (#1162175) Extra dependency.
  - (#1126333) Very slow response from SDR owner type SW ID
  - (#903019)  SDR lists x4600m2 fan units as unspecified


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - add option to set Differentiated Services Code Point (DSCP) (#1228314)
  - extend rawstats log (#1242895)
  - fix resetting of leap status (#1243034)
  - report clock state changes related to leap seconds (#1242937)
  - allow -4/-6 on restrict lines with mask (#1232146)
  - retry joining multicast groups (#1288534)
  - explain synchronised state in ntpstat man page (#1286969)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10
changelog:
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-11
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-23
changelog:
  - Use a static buffer for OpenLDAP callback structure
  - Resolves: rhbz#999472 - nslcd does not reconnect to alternate ldap server
                            when using SSL


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-24
changelog:
  - Apply two patches from upstream
  - Resolves: rhbz#1105382 - nslcd: error reading from client: Success


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-25
changelog:
  - Resolves: rhbz#917876 - [patch] Retry on zero length buffers rather than
                            declaring source unavailable


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-26
changelog:
  - Apply patches in prep
  - Resolves: rhbz#917876 - [patch] Retry on zero length buffers rather than
                            declaring source unavailable


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-27
changelog:
  - Resolves: rhbz#1240388 - nslcd fails to fetch member of group if that
                             members name has 19 or more character in its name


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-30
changelog:
  - Resolves: rhbz#1293564 - Segmentation fault during upstream make check
  - Also fix regressions in the tio.c module revealed by subsequent testing


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-31
changelog:
  - Resolves: rhbz#1293564 - fix doc to describe actual uri format
                             in nslcd.conf


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-32
changelog:
  - Don't double-close the socket
  - Resolves: rhbz#1309364 - Use-after-free in case resolving hosts or
                             networks fail


author: Tomas Mraz <tmraz@redhat.com> - 2.0.13-3
changelog:
  - drop s390 specific ifnarchs as all the previously missing dependencies
    are now there
  - split out gpgsm into a smime subpackage to reduce main package dependencies


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.13-4
changelog:
  - Explicitly BR libassuan-static in accordance with the Packaging
    Guidelines (libassuan-devel is still static-only).


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-3
changelog:
  - initialize small amount of secmem for list of algorithms in help (#598847)
    (necessary in the FIPS mode of libgcrypt)


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-5
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.14-8
changelog:
  - fix aborts and default algorithms when running in FIPS mode (#1078957, #966493)
  - add missing initialization of libgcrypt in gpgv
  - properly encode s2k iteration count in gpg-agent (#638635)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.17.4-18
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872388), CVE-2020-14346 (#1872392),
    CVE-2020-14361 (#1872399), CVE-2020-14362 (#1872406)


author: Jan Rybar <jrybar@redhat.com> - 3.2.8-43
changelog:
  - Rework of patch 91 from 3.2.8-37, stripping removed permanently, no new option
  - Resolves: rhbz#1322111


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.2
changelog:
  - fix integer overflows leading to heap overflow in file2strvec()
  - Resolves: CVE-2018-1124 CVE-2018-1126


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.3
changelog:
  - drop leftover assignment in fix for CVE-2018-1124 causing a severe regression
  - Resolves: CVE-2018-1124


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-97
changelog:
  - Resolves: rhbz#1367052 CVE-2015-5174 tomcat6: tomcat: URL Normalization issue
  - Resolves: rhbz#1367057 CVE-2016-0706 tomcat6: tomcat: directory disclosure
  - Resolves: rhbz#1367059 CVE-2016-0714 Security Manager bypass via persistence mechanisms
  - Resolves: rhbz#1367055 CVE-2015-5345 Directory disclosure


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-98
changelog:
  - Resolves: rhbz#1362211 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368120 CVE-2016-6325 tomcat6: tomcat: tomcat writable config files allow privilege escalation


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-100
changelog:
  - Resolves: rhbz#1413588 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402665 CVE-2016-6816 tomcat6: tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
  - Resolves: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update


author: Tomas Hoger <thoger@redhat.com> 0:6.0.24-105
changelog:
  - Sync with 6.8 - add CVE-2016-6816 follow-up patches and revert unreleased fixes.
  - Related: rhbz#1397484 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-encoded characters
  - Related: rhbz#1397484 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816
  - Reverts: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update
  - Reverts: rhbz#1347778 The security manager doesn't work correctly


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-111
changelog:
  * Sync with 6.9
  - Resolves: rhbz#1498342 CVE-2017-12615 CVE-2017-12617 tomcat6: various flaws
  - Resolves: rhbz#1461291 CVE-2017-5664 tomcat6: tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441479 CVE-2017-5647 tomcat6: tomcat: Incorrect handling of pipelined requests when send file was used
  - Resolves: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-112
changelog:
  - Resolves: rhbz#1806803 CVE-2020-1938 tomcat6: tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-115
changelog:
  - Resolves: CVE-2020-9484 tomcat6: tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-55.P1
changelog:
  - Resolves: #1527995 - allow static route with a 0.0.0.0 next-hop address
  - Related: #1527995 -  install link-local static routes with correct scope


author: Tim Waugh <twaugh@redhat.com> - 8.70-20
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1105520).
  - Improved support for PDF/A from upstream (bug #1060026).
  - Back-ported patch to process embedded files as a portable collection
    only if there is a /Collection attribute (bug #1027534).
  - Back-ported patch to preserve invisible PDF text in pdfwrite (bug #994452).


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 8.70-22
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: Martin Osvald <mosvald@redhat.com> - 8.70-24.el6_10.2
changelog:
  - It was found that the fix for CVE-2018-16509 was not complete, the missing
    pieces added into ghostscript-CVE-2018-16509.patch


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.504.el6
changelog:
  - kvm-vns-tls-don-t-use-depricated-gnutls-functions.patch [bz#1428750]
  - kvm-vnc-apply-display-size-limits.patch [bz#1430616 bz#1430617]
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1443448 bz#1443450]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1443448 bz#1443450 bz#1447542 bz#1447545]
  - kvm-cirrus-avoid-write-only-variables.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-PUTPIXEL-macro.patch [bz#1444378 bz#1444380]
  - Resolves: bz#1428750
    (Fails to build in brew)
  - Resolves: bz#1430616
    (CVE-2017-2633 qemu-kvm: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1430617
    (CVE-2017-2633 qemu-kvm-rhev: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1443448
    (CVE-2017-7718 qemu-kvm: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1443450
    (CVE-2017-7718 qemu-kvm-rhev: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1444378
    (CVE-2017-7980 qemu-kvm: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1444380
    (CVE-2017-7980 qemu-kvm-rhev: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1447542
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])
  - Resolves: bz#1447545
    (CVE-2016-9603 qemu-kvm-rhev: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.505.el6
changelog:
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501298]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1486641]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534692]
  - Resolves: bz#1486641
    (CVE-2017-13672 qemu-kvm-rhev: Qemu: vga: OOB read access during display update [rhel-6.10])
  - Resolves: bz#1501298
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-6.10])
  - Resolves: bz#1525939
    (CVE-2017-5715 qemu-kvm: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1528024
    (CVE-2017-5715 qemu-kvm-rhev: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1534692
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-6.10])
  - Resolves: bz#1549152
    (qemu-kvm-rhev: remove unused patch file [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6
changelog:
  - kvm-vga-add-share_surface-flag.patch [bz#1553674]
  - kvm-vga-add-sanity-checks.patch [bz#1553674]
  - Resolves: bz#1553674
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.1
changelog:
  - qemu-kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574074]
  - qemu-kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1574074]
  - qemu-kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1574074]
  - Resolves: bz#1574074
    (CVE-2018-3639 qemu-kvm: hw: cpu: speculative store bypass [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.3
changelog:
  - kvm-target-i386-define-md-clear-bit.patch [bz#1698996]
  - Resolves: bz#1698996
    (CVE-2018-12130 qemu-kvm: hardware: MFBDS)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.4
changelog:
  - kvm-target-i386-Sanitize-the-XSAVE-related-feature-bits.patch [bz#1673779]
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1689790]
  - Resolves: bz#1673779
    (RHEL8 VM's do not install on RHEL6 KVM hypervisor)
  - Resolves: bz#1689790
    (CVE-2019-9824 qemu-kvm: QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.5
changelog:
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669066]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669066]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669066]
  - kvm-qxl-check-release-info-object.patch [bz#1712728]
  - kvm-net-Use-iov-helper-functions.patch [bz#1636415]
  - kvm-net-increase-buffer-size-to-accommodate-Jumbo-frame-.patch [bz#1636415]
  - kvm-net-ignore-packet-size-greater-than-INT_MAX.patch [bz#1636415]
  - kvm-net-drop-too-large-packet-early.patch [bz#1636415]
  - kvm-PATCH-slirp-fix-buffer-overrun.patch [bz#1586251]
  - kvm-Fix-build-from-previous-commit.patch [bz#1586251]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586251]
  - kvm-slirp-Convert-mbufs-to-use-g_malloc-and-g_free.patch [bz#1586251]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586251]
  - kvm-pcnet-fix-possible-buffer-overflow.patch [bz#1636774]
  - Resolves: bz#1586251
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-6.10.z])
  - Resolves: bz#1636415
    (CVE-2018-10839 qemu-kvm: Qemu: ne2000: integer overflow leads to buffer overflow issue [rhel-6])
  - Resolves: bz#1636774
    (CVE-2018-17962 qemu-kvm: Qemu: pcnet: integer overflow leads to buffer overflow [rhel-6])
  - Resolves: bz#1669066
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-6.10.z])
  - Resolves: bz#1712728
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.6
changelog:
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734747]
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749731]
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791558]
  - Resolves: bz#1734747
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-6.10.z])
  - Resolves: bz#1749731
    (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-6])
  - Resolves: bz#1791558
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-6.10.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.7
changelog:
  - kvm-slirp-disable-tcp_emu.patch [bz#1791680]
  - kvm-slirp-add-slirp_fmt-helpers.patch [bz#1798966]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798966]
  - Resolves: bz#1791680
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-6])
  - Resolves: bz#1798966
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.8
changelog:
  - kvm-qemu-kvm-QEMU-usb-check-RNDIS-message-length.patch [bz#1869684]
  - kvm-qemu-kvm-QEMU-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869684]
  - Resolves: bz#1869684
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-6.10.z])


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.67.rc1
changelog:
  - Change EDNS flags only after successful query (#1416035)
  - Fix crash in ldap driver at bind-sdb stop (#1426626)


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.68.rc1.4
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Fix invalid tsig request (CVE-2020-8617)


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-33
changelog:
  - Fix yum-security manpage.
  - Resolves: bug#865694
  - Resolves: bug#1208155
  - Add libxml2-python to Requires for repo-rss.
  - Resolves: bug#1155093
  - yumdownloader: fix description of --archlist in the manpage.
  - Resolves: bug#1165661
  - Add missing options to reposync manpage.
  - Resolves: bug#1189033
  - Exclude dups from the list of security updates.
  - Resolves: bug#1209212
  - yum-config-manager: update config file specified using -c option.
  - Resolves: bug#1225753
  - yum-config-manager: require \* syntax to disable all repos.
  - Resolves: bug#1225754
  - Remove -v from repoquery man page.
  - Resolves: bug#1285748


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-34
changelog:
  - Fix 'updateinfo list available' logic and make 'updates' the default.
  - Resolves: bug#1144887
  - Fix updateinfo to exclude wrong arch updates.
  - Resolves: bug#1191313


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-36
changelog:
  - Fix performance issue when excluding dups from the list of security updates.
  - Related: bug#1209212


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-38
changelog:
  - Fix count of applicable security updates.
  - Resolves: bug#1347813
  - auto-update-debuginfo: fix check for repos in opts.
  - Resolves: bug#1293982
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1313574
  - repoquery: fix --pkgnarrow=installed.
  - Resolves: bug#1280453


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-39
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1272025
  - Update yum-verify man page.
  - Related: bug#1347813


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b09.
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860462


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b09 (EA).
  - Switch to EA mode.
  - Add debugging output for build.
  - JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
  - Update tarball generation script to use PR3795, following inclusion of JDK-8177334
  - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Remove the 64-bit siphash test which fails to compile on x86-32 debug builds with gcc 4.4.7 in RHEL 6
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u275-b01 (GA)
  - Update release notes for 8u275.
  - Resolves: rhbz#1895064


author: Marek Kasik <mkasik@redhat.com> - 0.12.4-4
changelog:
  - Add poppler-0.12.4-CVE-2010-3702.patch
      (Properly initialize parser)
  - Add poppler-0.12.4-CVE-2010-3703.patch
      (Properly initialize stack)
  - Add poppler-0.12.4-CVE-2010-3704.patch
      (Fix crash in broken pdf (code < 0))
  - Resolves: #639860


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-54
changelog:
  - Apply several more smartcard-related patches.
  - Related: rhbz#1300421 - Screen locks and smart card is removed - must
                            show a message to insert the correct smartcard


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-55
changelog:
  - Resolves: rhbz#1415785 - ldap_child does not remove temporary files
                             when it's killed with  SIGTERM


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-56
changelog:
  - Resolves: rhbz#1404697 - SSSD does not skip GPO if no gpcFunctionalityVersion present
  - Resolves: rhbz#1374813 - SSSD fails to process GPO from Active Directory


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-57
changelog:
  - Resolves: rhbz#1438360 - The originalMemberOf attribute disappears from
                             the cache, causing intermittent HBAC issues


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.13.3-58
changelog:
  - Resolves: rhbz#1421057 - pam_sss crashes in do_pam_conversation if no conversation
                             function is provided by the client app
  - Resolves: rhbz#1487040 - sssd does not evaluate AD UPN suffixes which results ini
                             failed user logins
  - Resolves: rhbz#1487944 - ABRT crash - /usr/libexec/sssd/sssd_nss
  - Resolves: rhbz#1489485 - sssd is not pulling groups in a trusted domain, with the
                             Global scope


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.13.3-59
changelog:
  - Resolves: rhbz#1326007 - Memory cache corruption when rsync and/or tar to copy owner and group info from LDAP
  - Resolves: rhbz#1442703 - Smart Cards: Certificate in the ID View
  - Resolves: rhbz#1507435 - CVE-2017-12173 sssd: unsanitized input when searching in local cache database [rhel-6.10]
  - Resolves: rhbz#1487040 - sssd does not evaluate AD UPN suffixes which results in failed user logins


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.13.3-60
changelog:
  - Related: rhbz#1442703 - Smart Cards: Certificate in the ID View
  - Related: rhbz# 1401546 - Please back-port fast failover from sssd 1.14 on RHEL 7 into sssd 1.13 on RHEL 6


author: Harald Hoyer <harald@redhat.com> 147-2.65
changelog:
  - 80-drivers.rules: only make an exception for ipmi for
                      modprobe with DRIVER set
  Resolves: rhbz#1268251


author: Michal Sekletar <msekleta@redhat.com> - 147-2.66
changelog:
  - prevent creation of duplicate udev rules by write_net_rules helper (#652499)
  - fix memory leak in scsi_id (#891669)
  - introduce SECLABEL{selinux} for setting explicit SELinux labels on device nodes (#1015300)
  - for ATA disks udev will now also create by-id/wwn-* symlinks when appropriate (#1220617)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-27.1
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-28.1
changelog:
  - Fix unbound-1.4.20-amplifying-an-incoming-query.patch patch so it won't produce compiler warnings
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-29.1
changelog:
  - Fix segfault in unbound-1.4.20-amplifying-an-incoming-query.patch
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Ian Kent <ikent@redhat.com> - 5.0.5-132
changelog:
  - bz1277033 - RHEL6.7: shutdown / reboot hangs with findmnt in a readlink
    system call, doing path_walk and stuck in autofs4_wait
    - make set_direct_mount_catatonic() more general.
    - set autofs mounts catatonic at exit
  - Related: rhbz#1277033


author: Ian Kent <ikent@redhat.com> - 5.0.5-133
changelog:
  - bz1496901 - Autofs processes hung while waiting for the release of an
    entry master_lock that is held by another thread waiting on a bind mount
    - only take master map mutex for master map update.
  - Resolves: rhbz#1496901


author: Ian Kent <ikent@redhat.com> - 5.0.5-134
changelog:
  - bz1496901 - Autofs processes hung while waiting for the release of an
    entry master_lock that is held by another thread waiting on a bind mount
    - fix incorrect patch specification in spec file.
  - Related: rhbz#1496901


author: Ian Kent <ikent@redhat.com> - 5.0.5-135
changelog:
  - bz1463004 - Server availability probe broke tunneling nfs via localhost
    - remove some redundant rpc library code.
    - add port parameter to rpc_ping().
    - dont probe NFSv2 by default.
    - add version parameter to rpc_ping().
  - Resolves: rhbz#1463004


author: Ian Kent <ikent@redhat.com> - 5.0.5-136
changelog:
  - bz1495442 - automount crashes due to segfault
    - fix create_client() RPC client handling
  - Resolves: rhbz#1495442


author: Ian Kent <ikent@redhat.com> - 5.0.5-137
changelog:
  - bz1463004 - Server availability probe broke tunneling nfs via localhost
    - update "add version parameter to rpc_ping()" patch to current updtream
      version which fixes 2 covarity warnings.
  - Resolves: rhbz#1463004


author: Ian Kent <ikent@redhat.com> - 5.0.5-138
changelog:
  - bz1559295 - autofs: can't mount nfs vers=2
    - fix NFS version mask usage.
  - Resolves: rhbz#1559295


author: Ian Kent <ikent@redhat.com> - 5.0.5-139
changelog:
  - bz1495442 - automount crashes due to segfault
    - fix fd leak in rpc_do_create_client().
  - Related: rhbz#1495442


author: Ian Kent <ikent@redhat.com> - 5.0.5-140
changelog:
  - bz1627004 - yum update hanging while restarting autofs
    - fix incorrect locking in sss lookup.
  -Resolves: rhbz#1627004


author: Ian Kent <ikent@redhat.com> - 5.0.5-140.el_6_10.1
changelog:
  - bz1197622 - automount segfaults in error code path (reproducible
    PRErrorTableList corruption)
    - nss workaround.
  - Resolves: rhbz#1197622


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.22
changelog:
  - Update Intel CPU microcode to microcode-20191115 release:
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4
      up to 0xd6;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision
      0xc6 up to 0xca;
    - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6
      up to 0xca;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0b/0x02 (CFL-S B0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0c/0x22 (CFL-S/Xeon E P0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0d/0x22 (CFL-H/S R0) from revision 0xc6 up to 0xca;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) from revision 0xc6 up to 0xca.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.25
changelog:
  - Update Intel CPU microcode to microcode-20200520 release (#1839193):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.26
changelog:
  - Update Intel CPU microcode to microcode-20200602 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795353, #1795357, #1827186):
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.27
changelog:
  - Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision
    0xdc, use 0xd6 by default (#1846134).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.28
changelog:
  - Enable 06-55-04 (SKL-X/W) caveat by default.
  - Enable 06-2d-07 (SNB-E/EN/EP) caveat by default (#1846024).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.29
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826590):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.30
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.31
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893243, #1893238):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode (in microcode.dat)
      at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      microcode.dat) at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode (in
      microcode.dat) at revision 0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      microcode-06-4e-03.dat) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      microcode-06-55-04.dat) from revision 0x2006906 up to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      microcode-06-5e-03.dat) from revision 0xdc up to 0xe2;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      (in microcode.dat) from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode (in microcode.dat)
      from revision 0x1000157 up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode (in microcode.dat)
      from revision 0x4002f01 up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode (in
      microcode.dat) from revision 0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode (in microcode.dat) from
      revision 0x38 up to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode (in microcode.dat)
      from revision 0x16 up to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode (in microcode.dat)
      from revision 0x16 up to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode (in microcode.dat)
      from revision 0x78 up to 0xa0;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode (in microcode.dat)
      from revision 0xca up to 0xe0.


author: Caolan McNamara <caolanm@redhat.com> - 4.2.1-9
changelog:
  - Resolves: rhbz#596171 drop icu.icu6284.strictalias.patch and use
    -fno-strict-aliasig as upstream has added a pile more and doesn't look
    interested in proposed patchs


author: Peng Wu <pwu@redhat.com> - 4.2.1-15
changelog:
  - Apply icu.13634.integer.overflow.patch
  - Apply icu.20958.segv.mapper.patch
  - Resolves: rhbz#1809876


author: Miloslav Trmač <mitr@redhat.com> - 0.96-6
changelog:
  - Use real --help text and error messages instead of showing a man page in
    pkaction and pkcheck.  Fix description of (pkaction --action-id) in the man 
    page.
    Resolves: #628862
  - Add support for Identity=default in .pkla files
    Resolves: #812684
  - Use a consistent order for .pkla files within a directory.  Based on a patch
    by Jared Jennings <jared.jennings.ctr@eglin.af.mil>.
    Resolves: #864613
  - Build using PIE and relro
    Resolves: #927406


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.26.1.el6]
changelog:
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1764544]
  - [drm] vmwgfx: refuse to hibernate if we have any resources v2 (Kenneth Yin) [1748195]
  - [fs] CIFS: avoid using MID 0xFFFF (Leif Sahlberg) [1739948]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.27.1.el6]
changelog:
  - [mm] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() (Waiman Long) [1785321]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.28.1.el6]
changelog:
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1795404]
  - [isdn] mISDN: enforce CAP_NET_RAW for raw sockets (Andrea Claudi) [1779473] {CVE-2019-17055}
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778625] {CVE-2019-17133}
  - [netdrv] bonding: speed/duplex update at NETDEV_UP event (Patrick Talbert) [1772779]
  - [netdrv] bonding: make speed, duplex setting consistent with link state (Patrick Talbert) [1772779]
  - [netdrv] bonding: simplify / unify event handling code for 3ad mode (Patrick Talbert) [1772779]
  - [netdrv] bonding: unify all places where actor-oper key needs to be updated (Patrick Talbert) [1772779]
  - [netdrv] bonding: simple code refactor (Patrick Talbert) [1772779]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.29.1.el6]
changelog:
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775226] {CVE-2019-17666}
  - [x86] mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB (Denys Vlasenko) [1485759]
  - binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: Use generic PIE randomization (Denys Vlasenko) [1485759]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.1.el6]
changelog:
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827226] {CVE-2020-10711}
  - [netdrv] bonding: don't set slave->link in bond_update_speed_duplex() (Patrick Talbert) [1828604]
  - [security] KEYS: prevent KEYCTL_READ on negative key (Patrick Talbert) [1498368] {CVE-2017-12192}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.31.1.el6]
changelog:
  - [x86] x86/speculation: Provide SRBDS late microcode loading support (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Patrick Talbert) [1841819]
  - [mm] mm: migration: add migrate_entry_wait_huge() (Waiman Long) [1839653]
  - [powerpc] powerpc/book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Update Spectre v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make stf barrier PPC_BOOK3S_64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Gustavo Duarte) [1796810]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enhance the information in cpu_show_spectre_v1() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Use barrier_nospec in syscall entry (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enable barrier_nospec based on firmware settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Patch barrier_nospec in modules (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for ori barrier_nospec patching (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add barrier_nospec (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Add helper to check if offset is within relative branch range (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Have patch_instruction detect faults (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Introduce asm-prototypes.h (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Move local setup.h declarations to arch includes (Gustavo Duarte) [1796810]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.32.1.el6]
changelog:
  - [wireless] libertas: make lbs_ibss_join_existing() return error code on rates overflow (Jarod Wilson) [1776569]
  - [wireless] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held (Jarod Wilson) [1776569]
  - [wireless] libertas: Fix two buffer overflows at parsing bss descriptor (Jarod Wilson) [1776569]
  - [security] keys: Protect request_key() against a type with no match function (Patrick Talbert) [1433220] {CVE-2017-2647}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.34.1.el6]
changelog:
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705003]
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705003]


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-75
changelog:
  - libfence: Remove fencedevice params from fence_node -S so that asking for
    status does not shut down a node if action= is set
    Resolves: rhbz#1252991
  - schema: add RRP attributes for <token> section
    Resolves: rhbz#1221728


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-80
changelog:
  - cman_tool: prevent segv in cman_tool nodes -F addr crash of qdisk is present
    Resolves: rhbz#1384968


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12.1-84.1
changelog:
  - fenced: make sure that a node that leaves and rejoins with a different
    membership is fenced.
    Resolves: rhbz#1510500


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-76
changelog:
  - Remove "username" and "password" options from yum.conf man page.
  - Resolves: bug#1367861
  - Fix reget problems with simple md filenames.
  - Resolves: bug#1155687


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-77
changelog:
  - Filter duplicate packages from different repos in doPackageLists(pkgnarrow='obsoletes').
  - Resolves: bug#1272828


author: Andreas Schneider <asn@redhat.com> - 3.6.24-44
changelog:
  - resolves: #1451105 - Fix trusted domain handling in winbind
  - resolves: #1431000 - Fix crash while trying to authenticate with a disabled
                         account
  - resolves: #1467395 - Add 'winbind request timeout' option


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.212
changelog:
  - CVE-2017-15670: glob: Fix one-byte overflow with GLOB_TILDE (#1504810)
  - CVE-2017-15804: glob: Fix buffer overflow in GLOB_TILDE unescaping (#1504810)


author: Nikola Forró <nforro@redhat.com> - 0.40.rc1-19
changelog:
  - fix loading config files from /etc/cgconfig.d to make it work with libcgroup-pam
    resolves: #1345762


author: Milind Changire <mchangir@redhat.com> - 3.12.2-9
changelog:
  - fixes bugs bz#1546717 bz#1557551 bz#1558948 bz#1561999 bz#1563804 
    bz#1565015 bz#1565119 bz#1565399 bz#1565577 bz#1567100 bz#1567899 bz#1568374 
    bz#1568969 bz#1569490 bz#1570514 bz#1570541 bz#1570582 bz#1571645 bz#1572087 
    bz#1572585 bz#1575895


author: Milind Changire <mchangir@redhat.com> - 3.12.2-10
changelog:
  - fixes bugs bz#1488120 bz#1565577 bz#1568297 bz#1570586 bz#1572043 
    bz#1572075 bz#1575840 bz#1575877


author: Milind Changire <mchangir@redhat.com> - 3.12.2-13
changelog:
  - fixes bugs bz#1493085 bz#1518710 bz#1554255 bz#1558948 bz#1558989 
    bz#1559452 bz#1567001 bz#1569312 bz#1569951 bz#1575539 bz#1575557 bz#1577051 
    bz#1580120 bz#1581184 bz#1581553 bz#1581647 bz#1582119 bz#1582129 bz#1582417 
    bz#1583047 bz#1588408 bz#1592666 bz#1594658


author: Milind Changire <mchangir@redhat.com> - 3.12.2-14
changelog:
  - fixes bugs bz#1547903 bz#1566336 bz#1568896 bz#1578716 bz#1581047 
    bz#1581231 bz#1582066 bz#1593865 bz#1597506 bz#1597511 bz#1597654 bz#1597768 
    bz#1598105 bz#1598356 bz#1599037 bz#1599823 bz#1600057 bz#1601314


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
  - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
    bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-46
changelog:
  - require credentials to match for NTLM re-use (CVE-2015-3143)
  - close Negotiate connections when done (CVE-2015-3148)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-49
changelog:
  - prevent NSS from incorrectly re-using a session (#1269660)
  - prevent test46 from failing due to expired cookie (#1277551)


author: Jiri Popelka <jpopelka@redhat.com> - 1:1.4.2-73
changelog:
  - Fix failover backend options parsing (bug #1231322).
  - The socket backend could go into an infinite loop with certain printers
    (bug #1276772, STR #3622)
  - dnssd backend: don't crash if avahi gives a callback with no TXT record
    (bug #1269305)
  - Don't unload jobs that couldn't be saved (bug #1283003, STR #4742).


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.4.2-76
changelog:
  - 1344782 - Banner pages do not show time-at-creation or time-at-processing
  - 1219571 - Invalid memory accesses lead to crash when configured class has implicit class as first member


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.4.2-77
changelog:
  - 1099617 - Using "lp -o orientation-requested=6" with a PDF file has no effect.
  - 1268131 - Printing PDF with fit-to-page doesn't take printer HW margins into account


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-4
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1788447


author: Kalev Lember <kalev@smartlink.ee> 3.0.1-16
changelog:
  - Reintroduce a patch for CVE-2009-1885
  - Don't build static library
  - Use parallel make
  - Spec file clean up


author: Filip Krska <fkrska@redhat.com> = 3.2-63
changelog:
  [archive] compress tarball without a timeout
    Resolves: bz1439943
    [policies] stop execution on Ctrl+C during user input
    Resolves: bz1567054


author: Filip Krska <fkrska@redhat.com> = 3.2-63.1
changelog:
  [archive] Force decoding if content is bytes
    [reporting] deal with UTF-8 characters
    Resolves: bz1599234


author: Filip Krska <fkrska@redhat.com> = 3.2-63.3
changelog:
  [smartcard] Stop collecting pkcs11_inspect debug
    Resolves: bz1567063
    [satellite] don't collect /root/ssl-build
    Resolves: bz1667018


author: Steve Dickson <steved@redhat.com> 1.2.3-71
changelog:
  - rpc.mountd: set libtirpc nonblocking mode to avoid DO (bz 1301581)
  - nfsidmap: Clean up other exit status cases (bz 1313603)
  - gssd: Fix inner-loop variable reuse (bz 1313090)
  - mount.nfs manpage: Add nfsmount.conf (bz 1302981)
  - nfs.init: Set exit code on restarts (bz 1205055)


author: Steve Dickson <steved@redhat.com> 1.2.3-73
changelog:
  - mountd: fix is_subdirectory to understand '/' (bz 1331207)
  - mount.nfs: Fix for the bug in v1.2.4 that breaks mount.nfs (bz 1208385)
  - mount.nfs: Removed supported flag from usage string (bz 1000990)
  - mountd.man: Update to change -P option as an alias for -p (bz 1037926)
  - exportfs: Deal with path's trailing "/" in unexportfs_parsed() (bz 1276538)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1352856)


author: Matthias Saou <http://freshrpms.net/> 8.1.0-2
changelog:
  - Update to 8.1.0.
  - Merge back changes from Paul Howarth.
  - Make sure the scriplets never return a non-zero exit status.


author: Lumír Balhar <lbalhar@redhat.com> - 8.2.0-7
changelog:
  - Fix CVE-2020-10108 HTTP request smuggling when presented with two Content-Length headers
  Resolves: rhbz#1813439
  - Remove useless macros definitions


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-85
changelog:
  - Release 1.2.11.15-85
  - Resolves: #1372420 - DES to AES backport issues (DS 47462)
  - Resolves: #1391324 - ds9 backport 47411 - Replace substring search with plain search in referint plugin (DS 47411)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-86
changelog:
  - Release 1.2.11.15-86
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 49049)
  - Resolves: #1400997 - ldif2db.pl script shows wrong usage for -n as instance, instead of database (DS 49070)
  - Resolves: #1403754 - ns-slapd crashes during tickets/ticket48665_test.py (DS 48665)
  - Resolves: #1410645 - The "repl-monitor" web page does not display "year" in date. (DS 48220)
  - Resolves: #1399600 - ns-slapd segfaults during execution of tickets/ticket47966_test.py (DS 47966, DS 48987)
  - Resolves: #1402012 - Importing big ldif file with duplicate DNs throwing "unable to flush" error
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-87
changelog:
  - Release 1.2.11.15-87
  - Resolves: #1391701 - do not treat missing csn as fatal (DS 49020)
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-88
changelog:
  - Release 1.2.11.15-88
  - Resolves: #1413692 - custom schema is registered in small caps after schema reload (DS 47973)
  - Resolves: #1408976 - dbscan-bin crashing due to a segmentation fault. (DS 49104)


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-89
changelog:
  - Release 1.2.11.15-89
  - Resolves: #1421512 - ns-slapd crashes in ldif_sput due to the output buf size is less than the real size.


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-90
changelog:
  - Release 1.2.11.15-90
  - Resovles: #1435365 - Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax


author: Mark Reynolds <mreynolds@redhat,com> - 1.2.11.15-91
changelog:
  - Release 1.2.11.15-91
  - Resolves: bug 1437776 - EMBARGOED CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-95
changelog:
  - Release 1.2.11.15-95
  - Resolves: Bug 1562152 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch
  - Resolves: Bug 1544415 - CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (fix cherry-pick error)
  - Resolves: Bug 1543798 - EMBARGOED CVE-2018-1054 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-97
changelog:
  - Bump version to 1.2.11.15-97
  - Resolves: Bug 1563539 - acl_copyEval_context double free (fix spec file patch)


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-5
changelog:
  - Add support for TIMESTAMP/STRING selection types, this fixes copy and paste
    issues with some applications (vncviewer for example).
    Resolves: rhbz#1117764


author: Fabiano Fidêncio <fidencio@redhat.com> 0.14.0-6
changelog:
  - randr: Make resolution changing more robust
    Resolves: rhbz#1206117, rhbz#1130080 and rhbz#1209550


author: Fabiano Fidêncio <fidencio@redhat.com> 0.14.0-8
changelog:
  - Cannot get same result enablng second monitor after it was disabled using
    Guest's "Display Preference"
    Resolves: rhbz#1086657


author: Victor Toso <victortoso@redhat.com> 0.14.0-12
changelog:
  - Do not allow file-transfer on locked session
    Resolves: rhbz#1323630
  - Do not allow file-transfer on login screen
    Resolves: rhbz#1323640


author: Karsten Hopp <karsten@redhat.com> 1.1.6-15
changelog:
  - disable sane subpackage and sane requirements for mainframes, we don't have
    sane on s390 and s390x


author: Joel Granados <jgranado@redhat.com> - 1.1.6-17
changelog:
  - Fix the shebang issue.  See https://fedoraproject.org/wiki/Features/SystemPythonExecutablesUseSystemPython


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-116
changelog:
  - Restore functionallity of pam_ssh_agent_auth in FIPS mode (#1278315)
  - Initialize devices_done variable for challenge response (#1281468)
  - Update behaviour of X11 forwarding to match upstream (#1299048)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-119
changelog:
  - Resolve sftp force permission colision with umask (#1341747)
  - Relax bits needed check to allow hmac-sha2-512 with gss-group1-sha1- (#1353359)
  - close ControlPersist background process stderr when not in debug mode (#1335539)
  - Do not add a message "The agent has no identities." in ~/.ssh/authorized_keys (#1353410)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-120
changelog:
  - Prevent infinite loop when Ctrl+Z pressed at password prompt (#1218424)
  - Remove RC4 cipher and MD5 based MAC from the default client proposal (#1373836)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-122
changelog:
  - Allow to use ibmca crypto hardware (#1397547)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (1405374)


author: Stef Walter <stefw@redhat.com> - 0.7.4-1
changelog:
  - Update to upstream point release 0.7.4
  - Correctly handle truncating long host names [#1001667]
  - Try to contact all available addresses for discovery [#1004442]
  - Build fixes [#1004823]


author: Stef Walter <stefw@redhat.com> - 0.7.5-1
changelog:
  - Update to upstream point release 0.7.5
  - Workaround for discovery via IPv6 address [#1004442]
  - Correctly put IPv6 addresses in temporary krb5.conf


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-22
changelog:
  - RHEL-6.8 erratum
    - fixed potential getcwd failure, resulting in Null pointer exception 
    Resolves: rhbz#1284886


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-23
changelog:
  - RHEL-6.8 erratum
    - fixed handling of closefrom_override defaults option
    Resolves: rhbz#1309976


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-24
changelog:
  - RHEL-6.8 erratum
    - fixed a bug causing that non-root users can list privileges of
      other users
    Resolves: rhbz#1312481


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-25
changelog:
  - RHEL-6.9 erratum
    - Fix "sudo -l command" in the LDAP and SSS backends when the command
      is not allowed.
    Resolves: rhbz#1374410
    - Fix sudo log file wrong group ownership
    Resolves: rhbz#1330001
    - Fix sudo parsing sudoers with user's locale
    Resolves: rhbz#1318374


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-26
changelog:
  - RHEL-6.9 erratum
    - Fix race condition when creating /var/log/sudo-io direcotry
    Resolves: rhbz#1365156


author: Soren Sandmann <ssp@redhat.com>
changelog:
  - Add two patches for the man page:
    - 0001-xfreerdp.1.xml-Don-t-claim-to-support-multiple-conne.patch
      Don't claim to support multiple connections, #988272
    - 0002-Replace-itemizedlist-s-with-variablelist-s.patch
      Work around a bug in RHEL 6 docbook, that causes <itemizedlist>
      to be mangled. This patch replaces them with <variablelist>s.


author: Soren Sandmann <ssp@redhat.com> - 1.0.2-2
changelog:
  - Add patch listing the plugins available in RHEL 6
    - 0003-List-plugins-available-in-RHEL-6.patch
    Related: #988272


author: Adam Tkac <atkac redhat com> 1:0.17-46
changelog:
  - changes related package review (#226484)
  - remove unused patches
    - telnet-0.17-linemode.patch
    - telnet-0.17-env-5x.patch


author: Michal Sekletar <msekleta@redhat.com> 1:0.17-48
changelog:
  - reuse utmp entries correctly
  - break out from infinite loop if we tried to bind to non-existing address (#772912)
  - mitigate possibility of self-deadlock while updating utmp or wtmp (#832059)


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-2
changelog:
  - Add -Wl,-z,relro to the linker flags in order to fix a rpmdiff
    error. These flags used to be provided indirectly by openssl, and after
    openssl stopped exporting them, they were added by
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch
    which was dropped during the rebase
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-3
changelog:
  - Add -Wl,-z,now as well to the link flags.  This flag was present in
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch, and
    pkgwrangler still complains about:
    File /usr/lib/libspice-client-glib-2.0.so.8.5.0 lost GNU_RELRO security
    protection on i686
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-4
changelog:
  - Fix smartcard issues after VM restart (virsh destroy/virsh start)
    Resolves: rhbz#1205171
  - Remove obsolete patches
    Related: rhbz#1185434


author: Fabiano Fidêncio <fidencio@redhat.com> 0.26-5
changelog:
  - Connecting to VM changes its resolution
    Resolves: rhbz#1242605
  - Cannot enable display 1 when it was disabled in previous session
    Resolves: rhbz#1247920
  - Windows needs to send complete monitors_config message to client
    Resolves: rhbz#1265361
  - Add Client capability for windows monitor_config messsage
    Resolves: rhbz#1265359
  - High Resolution Multi-Monitor Windows Guest freeze
    Resolves: rhbz#1247749
  - Drop isoc packages on low bandwith
    Resolves: rhbz#1276707


author: Pavel Grunt <pgrunt@redhat.com> 0.26-8
changelog:
  - Make grab session related
    Resolves: rhbz#1330652
  - Improve messages in usb redirection dialog
    Resolves: rhbz#1298772
  - Use proxy only when needed
    Resolves: rhbz#1306311


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-17
changelog:
  - fix race condition when creating INBOX (#1184865)
  - close stderr if it's not used for logging (#730746)
  - login proxy should not fail connection if CRL isn't found for some certificate (#813957)
  - fix crash in list-status (#961466)
  - installation of dovecot hangs if there is no /dev/urandom (#1026790)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-22
changelog:
  - allow larger DH parameters length(#1230258)
  - don't check client PID in non-login auth sockets (#1281670)
  - messages containing a CP932 character were not shown in a search result (#1275233)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-22.1
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1752708)


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.98
changelog:
  - Add 0266-RHBZ-1401391-fix-prio-put.patch
    * don't try to drop a nonexistant prio handler
  - Add 0267-RHBZ-1401769-orphan-status.patch
    * don't print out checker and device status for orphan paths
  - Resolves: bz #1401391, #1401769


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.100
changelog:
  - Modify 0261-RHBZ-1377532-disable-changed-paths.patch
    * add man page information
  - Refresh 0265-RHBZ-1355669-max-sectors-kb.patch
  - Related: #1377532


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.101
changelog:
  - Add 0268-RHBZ-1447328-fix-reserve.patch
    * stop waiting for threads that weren't successfully created
  - Resolves: #1447328


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.102
changelog:
  - Add 0269-RHBZ-1442369-fix-check-partitions.patch
    * fix crash when partition minor starts with all the digits of the
      multipath device number
  - Add 0270-RHBZ-1408287-remove-long-def-timeout.patch
    * make all timeouts use checker_timeout if set and default to 60 sec.
  - Add 0271-RHBZ-1444193-fix-hang-on-resume.patch
    * resume again if an invalid table left the device suspended
  - Add 0272-RHBZ-1525217-3PAR-config.patch
  - Resolves: #1408287, #1442369, #1444193, #1525217


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.104
changelog:
  - Add 0273-RHBZ-1550069-fix-messages.patch
    * change error messages to warning messages, if adding or updating a
      multipath device fails because the device is missing from sysfs
  - Resolves: #1550069


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.105
changelog:
  - Add 0274-RHBZ-1573463-uevent-socket.patch
    * retry binding socket and close it immediately when cancelled.
  - Resolves: #1573463


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.106
changelog:
  - Modify 0272-RHBZ-1525217-3PAR-config.patch
    * revert path selector to round-robin
  - Resolves: #1578515


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.106.1
changelog:
  - Add 0275-RHBZ-1589741-fix-crash.patch
    * revert crashing code from 0274-RHBZ-1573463-uevent-socket.patch
  - Resolves: #1589741


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Marek Kasik <mkasik@redhat.com> 2.3.11-13
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Properly initialize array "result" in
    FT_Outline_Get_Orientation()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806269


author: Marek Kasik <mkasik@redhat.com> - 2.3.11-16
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197738


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.26.0
  - Remove upstreamed patch for CVE-2016-1950
  - Remove p-disable-md5-590364-reversed.patch for bug 1335915


author: Petr Šabata <contyk@redhat.com> - 0.9.45-4
changelog:
  - The devel subpackage now properly requires the base package to avoid
    multilib conflicts (#869633)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-6
changelog:
  - Willing SUT retains PFC operational state from peer after peer
    stops transmitting TLV (#870578)
  - Unable to query configured PFC priorities under IEEE DCBX (#870576)


author: Kamil Dudka <kdudka@redhat.com> - 4.3.11-7
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-6
changelog:
  - don't require logrotate (#922769)
  - move pppd database to /var/run/ppp to prevent SELinux AVCs (#968398)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-7
changelog:
  - ignore unrecognised radiusclient configuration directives (#906912)
  - add missing l2tp support (#815128)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-8
changelog:
  - prevent running into issues caused by undefined behavior (pointers of incompatible types aliasing the same object)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-49
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-50
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength
  - replace expired testing certificates


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-52
changelog:
  - deprecate and disable verification of insecure hash algorithms
  - disallow DH keys with less than 1024 bits in TLS client
  - remove support for weak and export ciphersuites
  - use correct digest when exporting keying material in TLS1.2 (#1376741)


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-5.2
changelog:
  - 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline
  - fix spec warnings about expanding macros


author: Richard Hughes <rhughes@redhat.com> - 0.6.21-5
changelog:
  - Update to version 0.6.21 fixing many bugs and CVEs
  - Remove upstreamed patches
  - Resolves: #839916


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.5-1
changelog:
  - v1.7.5 (Ernest) 19jul09
  - -----------------------
  -  * added support for ARC4 cipher and CTR block chaining (Denis Bernard)
  -  * made transport threads daemonize, to fix python 2.6 atexit behavior
  -  * support unicode hostnames, and IP6 addresses (Maxime Ripard, Shikhar
  -    Bhushan)
  -  * various small bug fixes


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server mode
    (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 1.10: https://gist.github.com/stevebeattie/0eb190004e10ba0926ad8782f89676ad
    Resolves #1557140


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-4
changelog:
  - Fix and enable tests (%check).
  - Backport a change which makes tests exit with nonzero status when they fail.
  - Add a fix for upstream tests for CVE-2018-7750 (broken in previous).


author: Honza Horak <hhorak@redhat.com> - 2.19-23
changelog:
  - fix memory leak when malformed request is received
    Resolves: #845283
  - Fixed returned value when all entries requested and no such
    map exists
    Resolves: #790812


author: Matej Muzila <mmuzila@redhat.com> - 2.19-29
changelog:
  - Make mknetid to handle properly files with either
    empty lines or unexpected format
    Resolves: #1071962


author: Matej Muzila <mmuzila@redhat.com> - 2.19-30
changelog:
  - Make server return YP_NOMAP when NIS client asks for non-existing map
    using yp_first/yp_next RPC calls
    Resolves: #988203


author: Matej Muzila <mmuzila@redhat.com> - 2.19-31
changelog:
  - Return failure if yppassw cannot write to /etc/shadow or /etc/passwd.adjunct
    because of wrong SELinux context
  - Move domainname check from ypserv to yppasswdd
  - Resolves: #747334, #456249


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-32
changelog:
  - fix: in a login shell "( cmd & )" does nothing (#1217236)
  - multibyte character string after $1-9 was not expanded correctly (#1256495)
  - case in a for loop inside a subshell caused syntax error (#1241013)


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-36
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1454804


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200920 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269361 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297891 - Rebase RHEL 6.8 to NSPR 4.11 in preparation for Firefox 45


author: Paul Wouters <pwouters@redhat.com> - 3.15-5.1
changelog:
  - Resolves: rhbz#1284966 add libreswan to RHEL6 (core)
  - Resolves: rhbz#1288086 /var/run/pluto should have 755 and should have 700


author: Paul Wouters <pwouters@redhat.com> - 3.15-5.2
changelog:
  - Resolves: rhbz#1289498 keyingtries=0 is broken
  - Resolves: rhbz#1166151 Pluto crashes on during 'service ipsec stop'
  - Resolves: rhbz#1216946 IPv6 in RHEL6 fails after reboot
  - Resolves: rhbz#1144462 ikev2 status shows "no tunnels up" while tunnel is up


author: Paul Wouters <pwouters@redhat.com> - 3.15-6
changelog:
  - Resolves: rhbz#1345959 openswan - libreswan migration issues
  - Resolves: rhbz#1360134 libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails
  - Resolves: rhbz#1313709 ipsec pluto returns zero even if it fails [doc change only]
  - Resolves: rhbz#1315415 ipsec.conf manpage does not contain any mention about crl-strict option


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.1
changelog:
  - Resolves: rhbz#1375741 Pluto (libreswan) intermittent abort when ' auto --up --asynchronous' is used
  - Resolves: rhbz#1335896 ipsec initnss/checknss custom directory not recognized


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.2
changelog:
  - Resolves: rhbz#1313843 Prescript warning: Missing control file /var/run/pluto/pluto.ctl
  - Resolves: rhbz#1375741 Pluto (libreswan) intermittent abort [extended patch]
  - Resolves: rhbz#1369990 Libreswan connection sometimes does not get re-established after one side restarts


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.3
changelog:
  - Resolves: rhbz#1403201 pluto uses up available memory and fails with 'unable to popen'
  - Resolves: rhbz#1311360 When IKE rekeys [...] (updated for IKEv1 responder side)


author: Paul Wouters <pwouters@redhat.com> - 3.15-9
changelog:
  - Resolves: rhbz#1781903 ipsec newhostkey fails with ipsec rsasigkey: key pair generation failed: -8187


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2
changelog:
  - krshd: don't limit user names to 16 chars when utmp can handle names
    at least a bit longer than that (#632442, RT#6773)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2.1
changelog:
  - ftpd: add candidate patch to detect setegid/setregid/setresgid and check
    for errors when calling them (MITKRB5-SA-2011-005, CVE-2011-1526, #713342)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-3
changelog:
  - drop calls to pam_selinux from the gssftp PAM configuration (#713459)
  - reference password-auth instead of system-auth in the gssftp and kshell
    PAM configurations


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-4
changelog:
  - increase the size of the ftp client's command line input buffer (#665834)
  - incorporate patch to correct parsing errors with "restrict" lines in
    ftpusers (#713521, RT#6889)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-7
changelog:
  - add Siddhesh Poyarekar's patch to ensure that when performing an "mdir"
    or "mls" operation, that the FTP client always passes an actually-terminated
    string as the open mode for fopen() (#773538, RT#7079)


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - Update description
  - Remove other distros from SPEC
  - Changed license
  - Change Source0 to Sourceforge
  - Resolves: #981637


author: Kai Engert <kaie@redhat.com> - 2017.2.20-65.1
changelog:
  - Update to CKBI 2.20 from NSS 3.34.1 with legacy modifications.
    In the original upstream release, Mozilla.org removed all trust for
    the code signing usage. As part of the default legacy configuration,
    this package retains code signing trust for all CAs that are still
    trusted for the server authentication usage.
    The ca-legacy disable configuration disables all code signing trust.


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-60.0
changelog:
  -Update to CKBI 2.32 from NSS 3.44
  -   Removing:
  -    # Certificate "Visa eCommerce Root"
  -    # Certificate "AC Raiz Certicamara S.A."
  -    # Certificate "TC TrustCenter Class 3 CA II"
  -    # Certificate "ComSign CA"
  -    # Certificate "S-TRUST Universal Root CA"
  -    # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5"
  -    # Certificate "Certplus Root CA G1"
  -    # Certificate "Certplus Root CA G2"
  -    # Certificate "OpenTrust Root CA G1"
  -    # Certificate "OpenTrust Root CA G2"
  -    # Certificate "OpenTrust Root CA G3"
  -   Adding:
  -    # Certificate "GlobalSign Root CA - R6"
  -    # Certificate "OISTE WISeKey Global Root GC CA"
  -    # Certificate "GTS Root R1"
  -    # Certificate "GTS Root R2"
  -    # Certificate "GTS Root R3"
  -    # Certificate "GTS Root R4"
  -    # Certificate "UCA Global G2 Root"
  -    # Certificate "UCA Extended Validation Root"
  -    # Certificate "Certigna Root CA"
  -    # Certificate "emSign Root CA - G1"
  -    # Certificate "emSign ECC Root CA - G3"
  -    # Certificate "emSign Root CA - C1"
  -    # Certificate "emSign ECC Root CA - C3"
  -    # Certificate "Hongkong Post Root CA 3"


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-65.1
changelog:
  - Remove expired 1024 bit roots
  -    Removing:
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure CA"
  -     # Certificate "ValiCert Class 1 VA"
  -     # Certificate "ValiCert Class 2 VA"
  -     # Certificate "RSA Root Certificate 1"
  -     # Certificate "Entrust.net Secure Server CA"
  -     # Certificate "NetLock Business (Class B) Root"
  -     # Certificate "NetLock Express (Class C) Root"


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-60.0
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"


author: Peter Schiffer <pschiffe@redhat.com> - 12.4-7
changelog:
  - resolves: #857120
    fixed incorrect return code when TMPDIR points to invalid path
  - resolves: #845098
    added support for alternatives


author: Tom Lane <tgl@redhat.com> 8.4.701-4
changelog:
  - Add patch to provide some stub functions for JDBC 4.1 compatibility
  Resolves: #816731
  - Minor modernization of specfile, eg use maven directory macros,
    remove long-obsolete minimum versions from BuildRequires


author: Tom Lane <tgl@redhat.com> 8.4.701-5
changelog:
  - Switch to noarch (non-GCJ) build so that we can BuildRequire JDK >= 1.6;
    without this we don't get a JDBC4 driver at all, let alone 4.1.
  Related: #816731


author: Tom Lane <tgl@redhat.com> 8.4.701-8
changelog:
  - Add explicit Obsoletes to get rid of old arch-specific packages,
    per discussions in bugs 821892 and 822206
  Related: #816731


author: Jan Pacner <jpacner@redhat.com> - 5:1.5.20-5.20091214hg736b6a
changelog:
  - Resolves: #1083524 (segmentation fault when sending an e-mail from a command
    line)
  - Resolves: #750929 (SIGSEGV Crash while parsing certificates file)
  - Resolves: #690409 (mutt crash; seg fault in mx_update_context)
  - Resolves: #674271 (SIGSEGV when browsing pop account)


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.20-8.20091214hg736b6a
changelog:
  - Resolves #1196787 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1212646 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Marek Kasik <mkasik@redhat.com> - 2.3-3
changelog:
  - Add -fno-strict-aliasing to pass "Testsuite regressions" test
  - Make docs subpackage "noarch"
  - Resolves: #605103


