# changelog

author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-567.el6]
changelog:
  - [serial] add ability to set IRQ via module parameter (Prarit Bhargava) [1210848]
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1185166] {CVE-2015-1805}
  - [netdrv] macvlan: add VLAN filters to lowerdev (Ivan Vecera) [1213846]
  - [x86] Mark Intel Broadwell-DE processor as unsupported (Steve Best) [1226904]
  - [net] ipv6: reallocate addrconf router for ipv6 address when lo device up (Hannes Frederic Sowa) [1223610]
  - [mm] memory-failure: move refcount only in !MF_COUNT_INCREASED (Rafael Aquini) [1222832]
  - [mm] memory-failure: shift page lock from head page to tail page after thp split (Rafael Aquini) [1222832]
  - [mm] memory-failure: transfer page count from head page to tail page after split thp (Rafael Aquini) [1222832]
  - [scsi] lpfc: Correct loss of target discovery after cable swap (Rob Evers) [1226779]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-568.el6]
changelog:
  - [base] reduce boot delay on large memory systems (Seth Jennings) [1221389]
  - [md] dm: run queue on re-queue (Mike Snitzer) [1225158]
  - [fs] take i_mutex during prepare_binprm for set<u,g>id executables (Mateusz Guzik) [1216269] {CVE-2015-3339}
  - [netdrv] i40e: Make sure to be in VEB mode if SRIOV is enabled at probe (Stefan Assmann) [1206000]
  - [netdrv] i40e: start up in VEPA mode by default (Stefan Assmann) [1206000]
  - [netdrv] e1000e: Bump the version to 3.2.5 (John Greene) [1211531]
  - [netdrv] e1000e: fix unit hang during loopback test (John Greene) [1211531]
  - [netdrv] e1000e: fix systim issues (John Greene) [1211531]
  - [netdrv] e1000e: fix legacy interrupt handling in i219 (John Greene) [1211531]
  - [netdrv] e1000e: fix flush_desc_ring implementation (John Greene) [1211531]
  - [netdrv] e1000e: fix logical error in flush_desc_rings (John Greene) [1211531]
  - [netdrv] e1000e: remove call to do_div and sign mismatch warning (John Greene) [1211531]
  - [netdrv] e1000e: i219 execute unit hang fix on every reset or power state transition (John Greene) [1211531]
  - [netdrv] e1000e: i219 fix unit hang on reset and runtime D3 (John Greene) [1211531]
  - [netdrv] e1000e: fix call to do_div to use u64 arg (John Greene) [1211531]
  - [netdrv] e1000e: Cleanup handling of VLAN_HLEN as a part of max frame size (John Greene) [1211531]
  - [netdrv] e1000e: Correctly include VLAN_HLEN when changing interface MTU (John Greene) [1211531]
  - [netdrv] e1000e: call netif_carrier_off early on down (John Greene) [1211531]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-569.el6]
changelog:
  - [gpu] drm/radeon: fix freeze for laptop with Turks/Thames GPU (Jerome Glisse) [1213297]
  - [md] dm: fix casting bug in dm_merge_bvec (Mike Snitzer) [1226453]
  - [fs] nfs: Send the size attribute on open(O_TRUNC) (Benjamin Coddington) [1208065]
  - [net] inet: fix processing of ICMP frag_needed messages (Sabrina Dubroca) [1210321]
  - [net] tcp: double default TSQ output bytes limit (Hannes Frederic Sowa) [1140590]
  - [hv] hv_balloon: correctly handle num_pages>INT_MAX case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: correctly handle val.freeram<num_pages case (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: survive ballooning request with num_pages=0 (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: eliminate jumps in piecewiese linear floor function (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: do not online pages in offline blocks (Vitaly Kuznetsov) [1006234]
  - [hv] hv_balloon: don't lose memory when onlining order is not natural (Vitaly Kuznetsov) [1006234]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-570.el6]
changelog:
  - [block] fix ext_dev_lock lockdep report (Jeff Moyer) [1230927]
  - [md] Revert "md dm: run queue on re-queue" (Mike Snitzer) [1232007]
  - [firmware] another cxgb4 firmware load fixup (Sai Vemuri) [1189255]
  - [char] tty: Don't protect atomic operation with mutex (Aristeu Rozanski) [1184182]
  - [edac] i5100 add 6 ranks per channel (Aristeu Rozanski) [1171333]
  - [edac] i5100 clean controller to channel terms (Aristeu Rozanski) [1171333]
  - [crypto] rng - Remove krng (Herbert Xu) [1226418]
  - [crypto] drbg - Add stdrng alias and increase priority (Herbert Xu) [1226418]
  - [crypto] seqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] eseqiv - Move IV seeding into init function (Herbert Xu) [1226418]
  - [crypto] chainiv - Move IV seeding into init function (Herbert Xu) [1226418]


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-571.el6]
changelog:
  - [netdrv] bnx2x: Move statistics implementation into semaphores (Michal Schmidt) [1231348]
  - [scsi] storvsc: Set the SRB flags correctly when no data transfer is needed (Vitaly Kuznetsov) [1221404]


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-253
changelog:
  - Add additional dontaudits for prelink_mask_t
  Resolves:#1103674
  - Allow local_login_t and xdm_t to manage shadow_t because of PAM


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-254
changelog:
  - Dontaudit to read/write all dev nodes for prelink_mask_t.
  - Add label for path /var/lib/ctdb
  - Allow escd access to /var/run/pcscd.events directory
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-255
changelog:
  - Allow couriertcpd to read /var/spool/courier dir.
  - Allow prelink domain to rea /dev/mem.
  - ALlow transition to prelink_t instead of prelink_mask_t to ABRT domains/rpm.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-257
changelog:
  - Add fixes for sblim_sfcbd to make libvirt-cim working.
  - Allow keepalived stream connect to snmpd
  - Allow local_login_t and xdm_t to manage etc_t if authlogin_can_shadow boolean.
  - Allow prelink_transition_domain to send signal to prelink_mask_t.
  Resolves:#1103674


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-258
changelog:
  - Allow unlink lib_t located in /tmp for prelink_mask_t.
  Resolves:#1103674
  - Add support for pnp4nagios
  - Allow mysql to read all domain state
  - Allow sblim_sfcbd_t to search virt images
  - Revert "Remove shadow_t label from /etc/security/opasswd "


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260
changelog:
  - Add virt_getattr_images and call it for sblim_sfcbd_t.
  - We also need to call virt_search_images for sblim.
  Resolves:#1140614


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260.el6_6.1
changelog:
  - Allow osad to execute rhn_check
  - Make osad_t as unconfined domain
  - Allow osad connect to jabber client port
  Resolves:#1169688
  - Allow rhev-agentd to access /dev/.udev/db/block:sr0


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.3
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Require softokn build 22 to ensure runtime compatibility.
  - Relax the requirement from pkcs11-devel to nss-softokn-freebl-devel
    to allow same or newer.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: David Knox <dknox@redhat.com> 0:6.0.24-84
changelog:
  - Resolves: rhbz#1022061 Tomcat init script needs to be adjusted to kill tomcat
  - if stop is unsuccessful


author: David Knox <dknox@redhat.com> 0:6.0.24-88
changelog:
  - Related: rhbz#1022061 changed in init file. Remove test
  - in function stop for result after initial command to
  - stop.


author: Michel Dänzer <mdaenzer@redhat.com> - 1.17.4-18
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872388), CVE-2020-14346 (#1872392),
    CVE-2020-14361 (#1872399), CVE-2020-14362 (#1872406)


author: Marek Kasik <mkasik@redhat.com> 2.3.11-13
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Properly initialize array "result" in
    FT_Outline_Get_Orientation()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806269


author: Marek Kasik <mkasik@redhat.com> - 2.3.11-16
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197738


author: Petr Vobornik <pvoborni@redhat.com> - 3.0.0-46.el6
changelog:
  - Use tls version range in NSSHTTPS initialization
  - Resolves: #1154687 - POODLE: force using safe ciphers (non-SSLv3) in IPA
                         client and server
  - Resolves: #1012224 - host certificate not issued to client during
                         ipa-client-install


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-48.el6
changelog:
  - Resolves: #1263703 ipa-server-install with externally signed CA fails with
    NSS error (SEC_ERROR_BUSY)
    - Free NSS objects in --external-ca scenario
  - Resolves: #1263262 Unable to resolve group memberships for AD users when
    using sssd-1.12.2-58.el7_1.6.x86_64 client in combination with
    ipa-server-3.0.0-42.el6.x86_64 with AD Trust
    - Do not lookup up the domain too early if only the SID is known
    - Do not store SID string in a local buffer
    - Allow ID-to-SID mappings in the extdom plugin


author: Martin Basti <mbasti@redhat.com> - 3.0.0-49.el6
changelog:
  - Resolves: #1127211 ipa-server-install --uninstall produces avc
    - sysrestore: copy files instead of moving them to avoind SELinux issues
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1222999 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in parentheses
  - Resolves: #1225868 display browser config options that apply to the browser -
    Chrome
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
    - WebUI: fix ipa_error.css
  - Resolves: #1232468 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
    - Simplify adding options in ipachangeconf
    - ipachangeconf: Add ability to preserve section case
    - ipa-client-automount: Leverage IPAChangeConf to configure the domain for
      idmapd
  - Resolves: #1232899 ipa-client-install does not respect --realm option
    - Allow user to force Kerberos realm during installation.
  - Resolves: #1276358 Remove /usr/share/ipa/updates/50-lockout-policy.update
    file from IPA 3.0 releases
    - Remove 50-lockout-policy.update file


author: Jan Cholasta <mbasti@redhat.com> - 3.0.0-50.el6
changelog:
  - Resolves: #1225868 display browser config options that apply to the browser -
    Chrome
    - Remove ico files from Makefile
  - Resolves: #1232843 ipa-client-install errors out if client and server time
    are not in sync or unreachable
    - Skip time sync during client install when using --no-ntp
  - Resolves: #1288495 Add userCertificate index used in Smart Card
    authentication
    - add DS index for userCertificate attribute
  - Resolves: #1293588 JavaScript error in ssbrowser.html - TypeError: Cannot
    read property 'mozilla' of undefined
    - webui: fix browser detection in browserconfig.html and ssbrowser.html
  - Resolves: #1296124 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Remove binary patching from patch 0140


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-50.el6.2
changelog:
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-50.el6.3
changelog:
  - Resolves: #1369470 IPA Replica-Install from RHEL6 to RHEL7 Fails
    - Modififed NSSConnection not to shutdown existing database.
    - Do not erroneously reinit NSS in Dogtag interface
    - Make sure replication works after DM password is changed


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-0
changelog:
  - Note why PR1834/RH1022017 is not suitable to go upstream in its current form.
  - Resolves: rhbz#1633817


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.9-17
changelog:
  - updated translation rhbz#993626
  - fixed bugs doscovered by coverity rhbz#905051
  - Resolves: #993626, #905051


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.9-19
changelog:
  - updated transaltion (ko) rhbz#993626
  - fixed bugzilla reporter to work with the new xmlrpc api rhbz#991088
  - Resolves: #991088, #993626


author: Jakub Filak <jfilak@redhat.com> - 2.0.9-20
changelog:
  - Bugzilla: pass Bugzilla_token in all XML RPC calls
  - mailx: improve notification e-mail headers
  - mailx: include hostane in notification e-mail
  - Resolves: #989530, #997871, #1090466, #1093375


author: Jakub Filak <jfilak@redhat.com> - 2.0.9-23
changelog:
  - resolve symbolic and hard link vulnerabilities
  - defend against directory traversal attack
  - Resolves: #1212095


author: Jakub Filak <jfilak@redhat.com> - 2.0.9-24
changelog:
  - switch ownership of new directories from "abrt:user" to "user:abrt"
  - fix a bug allowing libreport to read files outside dump directories
  - Related: #1212095


author: Jakub Filak <jfilak@redhat.com> - 2.0.9-25
changelog:
  - save all files changed by the reporter in the reporting GUI
  - Fixes CVE-2015-5302
  - Resolves: #1282143


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-10
changelog:
  - revert previous patch (#1172296)
  - fix: crash in ldap_domain2hostlist when processing SRV record (#1164369)
  - support TLS 1.1 and later (#1160467)
  - enhancement: add ppolicy-check-password (#1155390)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-7
changelog:
  - fix: regression: deadlock during SSL_ForceHandshake when getting connection to replica (#1267501)
    + apply (and modify a little) the patch from commit 1eeaeeb7


author: Baoquan He <bhe@redhat.com> - 2.0.0-273
changelog:
  - Fix max_mapnr issue on system has over 44-bit addressing, resolves bug 1008543
  - makedumpfile: fails phys_base calculation on sadump format, resolves bug 1010103


author: Baoquan He <bhe@redhat.com> - 2.0.0-274
changelog:
  - Add fence_kdump support for generic clusters, resolves bug 1083938
  - Add function setup_cluster_nodes_and_options, resolves bug 1083938
  - Add function get_pcs_cluster_nodes, resolves bug 1083938
  - Add function is_pcs_fence_kdump, resolves bug 1083938


author: Baoquan He <bhe@redhat.com> - 2.0.0-276
changelog:
  - kexec-tools: non-default routes are ignored by kdump, resolves bug 806992
  - kdumpctl: Pass disable_cpu_apicid to kexec of capture kernel, resolves bug 1061480
  - use -p option with fsck instead of -y, resolves bug 1055679
  - kdump doesn't work properly with nic that has "-" in it's name, resolves bug 874529
  - fix makedumpfile report and debug messages not shown, resolves bug 1016451


author: Baoquan He <bhe@redhat.com> - 2.0.0-277
changelog:
  - mkdumprd: add support for s390 DASD FBA type device, resolves bug 1022871
  - Check status of fsck before trying to mount a file system, resolves bug 1055672


author: Baoquan He <bhe@redhat.com> - 2.0.0-278
changelog:
  - Stop maximizing the bitmap buffer to reduce the risk of OOM, resolves bug 1114153
  - Move counting pfn_memhole for cyclic mode, resolves bug 1114153
  - Remove the 1st bitmap buffer from the ELF path in cyclic mode, resolves bug 1114153
  - Fix free bitmap_buffer_cyclic error, resolves bug 1114153
  - Introduce the mdf_pfn_t type, resolves bug 1114153


author: Baoquan He <bhe@redhat.com> - 2.0.0-279
changelog:
  - mkdurmpd: Issue sync after saving vmcore-dmesg.txt, resolves bug 1123061
  - mkdumprd: Fix check condition of selinux status, resolves bug 1122880
  - mkdumprd: fix no such file or directory warning in 2nd kernel on s390, resolves bug 1122883
  - Support for eppic language as a subpackage, resolves bug 823561
  - update .gitignore/sources for eppic_030413.tar.gz, resolves bug 823561
  - makedumpfile: Fix Makefile for eppic_makedumpfile.so build, resolves bug 823561


author: Baoquan He <bhe@redhat.com> - 2.0.0-280
changelog:
  - mkdumprd: wait for multipath device node, resolves bug 1128248
  - mkdumprd: clean up found logic in wait_for_multipath_devices(), resolves bug 1128248
  - use "getent ahostsv4 host-name" to get ipv4 address of a host name, resolves bug 1127138


author: Paul Lindner <lindner@inuus.com> - 1.4.3-1
changelog:
  - Add explicit require on memcached for memcached-devel (resolves 537046)
  - enable-threads option no longer needed
  - Update web site address


author: Paul Lindner <lindner@inuus.com> - 0:1.4.4-1
changelog:
  - Upgraded to upstream memcached-1.4.4 (http://code.google.com/p/memcached/wiki/ReleaseNotes144)
  - Add explicit Epoch to fix issue with broken devel dependencies (resolves 542001)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.4-3.el6_8.1
changelog:
  - fix vulnerabilities allowing remote code execution (CVE-2016-8704,
    CVE-2016-8705, CVE-2016-8706)


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-9
changelog:
  - Update fix_multiple_open patch to fix regression in openldap client
  - Remove pk11_genobj_leak patch, which caused crash with Firefox
  - Add comment in the policy file to preserve the last empty line
  - Disable SHA384 ciphersuites when CKM_TLS12_KEY_AND_MAC_DERIVE is not
    provided by softoken; this superseds check_hash_impl patch


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-14
changelog:
  - run the config file upgrade in %posttrans to avoid problems on multilib
    (#706454)
  - convert UID to long long on all arches to catch negative values (#741362)


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-16
changelog:
  - Do not print a "Broken Pipe" error message after requesting a large group
    (#791042)
  - Fix a typo in the disconnection logic (#747281), patch by Martin Poole


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-20.1
changelog:
  - Resolves: rhbz#1192451 - nslcd does not reconnect to alternate ldap server
                             when using SSL


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-20.2
changelog:
  - Do not crash when parsing the tls_ciphers option
  - Resolves: rhbz#1184361 - segfault occurs when nslcd starts


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-20.3
changelog:
  - Use a static buffer for OpenLDAP callback structure
  - Resolves: rhbz#999472 - nslcd does not reconnect to alternate ldap server
                            when using SSL


author: Peter Hatina <phatina@redhat.com> 1.8.10-1
changelog:
  - upgrade to 1.8.10
  - see http://www.wireshark.org/docs/relnotes/wireshark-1.8.10.html
  - Related: #711024


author: Peter Hatina <phatina@redhat.com> 1.8.10-5
changelog:
  - security patches
  - Resolves: CVE-2013-6336
              CVE-2013-6338
              CVE-2013-6339
              CVE-2013-6340
              CVE-2013-7112
              CVE-2013-7114


author: Peter Hatina <phatina@redhat.com> - 1.8.10-8
changelog:
  - security patches
  - Resolves: CVE-2014-6421
              CVE-2014-6423
              CVE-2014-6424
              CVE-2014-6425
              CVE-2014-6426
              CVE-2014-6427
              CVE-2014-6428
              CVE-2014-6429


author: Tom Lane <tgl@redhat.com> 8.4.7-2
changelog:
  - Add fix to make plpgsql cope with dropped columns in rowtypes
  Resolves: #694249
  - Add %{?_isa} to cross-subpackage Requires, per latest packaging guidelines,
    and add explicit dependencies on the -libs subpackage to pacify rpmdiff


author: Tom Lane <tgl@redhat.com> 8.4.9-1
changelog:
  - Update to PostgreSQL 8.4.9, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-9.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-8.html
    including the fix for CVE-2011-2483
  Resolves: #740736


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-3
changelog:
  - Synchronize javazic tool for OpenJDK 6 & 7 with upstream. (#1212549)
  - Fix Africa/Casablanca transitions from 2027 forward. (#1217109)


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - add option to set Differentiated Services Code Point (DSCP) (#1228314)
  - extend rawstats log (#1242895)
  - fix resetting of leap status (#1243034)
  - report clock state changes related to leap seconds (#1242937)
  - allow -4/-6 on restrict lines with mask (#1232146)
  - retry joining multicast groups (#1288534)
  - explain synchronised state in ntpstat man page (#1286969)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10
changelog:
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-11
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)


author: Patsy Franklin <pfrankli@redhat.com> - 2.12-1.212
changelog:
  - CVE-2017-15670: glob: Fix one-byte overflow with GLOB_TILDE (#1504810)
  - CVE-2017-15804: glob: Fix buffer overflow in GLOB_TILDE unescaping (#1504810)


author: Tomas Popela <tpopela@redhat.com> - 1.4.3-1
changelog:
  - Update to 1.4.3
  - Decrease debuginfo verbosity for s390 reduce memory consumption
  - Resolves: rhbz#1033151


author: Tomas Popela <tpopela@redhat.com> - 1.4.3-2
changelog:
  - Create symlinks to the libwebkitgtk library with the old name (libwebkit)
  - Resolves: rhbz#1033151


author: Tomas Popela <tpopela@redhat.com> - 1.4.3-3
changelog:
  - Compile with --disable-geolocation
  - Resolves: rhbz#1119647
  - Restore symlinks after ldconfig call in post to avoid their removal
  - Resolves: rhbz#1118424


author: Tomas Popela <tpopela@redhat.com> - 1.4.3-8
changelog:
  - Fix more of the wrongly aligned memory commits on ppc64
  - Fix crash in Yarr JIT
  - Resolves: rhbz#1136299


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-66
changelog:
  -Release 1.2.11.15-66
  - Resolves: #1272327 - CleanAllRUV should completely clean changelog (DS 48208)
  - Resolves: #1273132 - many attrlist_replace errors in connection with cleanallruv (DS 48283)
  - Resolves: #1278696 - SimplePagedResults -- abandon could happen between the abandon check and sending results (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-68
changelog:
  -Release 1.2.11.15-68
  - Resolves: #1278696 - SimplePagedResults -- abandon could happen between the abandon check and sending results -- Fixing a regression introduced in 1.2.11.15-68 (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-69
changelog:
  -Release 1.2.11.15-69
  - Resolves: #1289844 - The 'eq' index does not get updated properly when deleting and re-adding attributes in the same modify operation (DS 48370)
  - Resolves: #1290722 - SimplePagedResults -- in the search error case, simple paged results slot was not released. (DS 48375)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-70
changelog:
  -Release 1.2.11.15-70
  - Resolves: #1298095 - 1.2.11.15-68.el6_7 ns-slapd crash in ipa context - c_mutex lock memory corruption and self locks (DS 48406, revert DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-71
changelog:
  -Release 1.2.11.15-71
  - Resolves: #1306572 - slapd process crashes on entry modification (DS 47964)
  - Resolves: #1309962 - keep alive entries can break replication (DS 48445)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-72
changelog:
  -Release 1.2.11.15-72
  - Resolves: #1314241 - Double free while adding entries (DS 48287)
  - Resolves: #1314729 - change severity of some messages related to "keep alive" entries (DS 48420)


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-635.el6]
changelog:
  - [mm] backing-dev: ensure wakeup_timer is deleted (Jeff Moyer) [1318930]
  - [hv] vss: run only on supported host versions (Vitaly Kuznetsov) [1319813]
  - [sound] hda: Fix internal speaker for HP Z240 (Jaroslav Kysela) [1316673]
  - [perf] trace: Fix race condition at the end of started workloads (Jiri Olsa) [1302928]
  - [fs] nfsd: Combine decode operations for v4 and v4.1 (J. Bruce Fields) [1314536]
  - [hv] revert "vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: don't loose HVMSG_TIMER_EXPIRED messages" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: avoid unneeded compiler optimizations in vmbus_wait_for_unload" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: remove code duplication in message handling" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: avoid wait_for_completion on crash" (Vitaly Kuznetsov) [1318882]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-636.el6]
changelog:
  - [netdrv] mlx4_en: Choose time-stamping shift value according to HW frequency (Kamal Heib) [1320448]
  - [fs] anon_inodes implement dname (Aristeu Rozanski) [1296019]
  - [net] packet: set transport header before doing xmit (John Greene) [1309526]
  - [net] tuntap: set transport header before passing it to kernel (John Greene) [1309526]
  - [netdrv] macvtap: set transport header before passing skb to lower device (John Greene) [1309526]
  - [net] ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Jakub Sitnicki) [1312740]
  - [net] ipv6: sctp: add rcu protection around np->opt (Jakub Sitnicki) [1312740]
  - [net] ipv6: add complete rcu protection around np->opt (Jakub Sitnicki) [1312740]
  - [net] dccp: remove unnecessary codes in ipv6.c (Jakub Sitnicki) [1312740]
  - [net] ipv6: remove unnecessary codes in tcp_ipv6.c (Jakub Sitnicki) [1312740]
  - [net] ipv6: Refactor update of IPv6 flowi destination address for srcrt (RH) option (Jakub Sitnicki) [1312740]
  - [net] ipv6: protect flow label renew against GC (Sabrina Dubroca) [1313231]
  - [net] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc (Sabrina Dubroca) [1313231]
  - [perf] annotate: Support full source file paths for srcline fix (Jiri Olsa) [1304472 1304479]
  - [perf] tools: Support full source file paths for srcline (Jiri Olsa) [1304472 1304479]
  - [perf] annotate: Fix -i option, which is currently ignored (Jiri Olsa) [1304472 1304479]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-637.el6]
changelog:
  - [netdrv] mlx4-en: add missing patch to init rss_rings in get_profile (Don Dutile) [1321164]
  - [netdrv] mlx4-en: disable traffic class queueing by default (Don Dutile) [1321164]
  - [netdrv] mlx4_core: Fix mailbox leak in error flow when performing update qp (Don Dutile) [1321164]
  - [x86] nmi/64: Fix a paravirt stack-clobbering bug in the NMI code (Denys Vlasenko) [1259581] {CVE-2015-5157}
  - [x86] nmi/64: Switch stacks on userspace NMI entry (Denys Vlasenko) [1259581] {CVE-2015-5157}


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-638.el6]
changelog:
  - [mm] hugetlb: prevent BUG_ON in hugetlb_fault -> hugetlb_cow (Dave Anderson) [1303495]
  - [mm] hugetlb: fix race condition in hugetlb_fault (Dave Anderson) [1303495]
  - [s390] kdump: fix wrong BUG_ON statement (Hendrik Brueckner) [1321316]
  - [scsi] cxgb4i: Increased the value of MAX_IMM_TX_PKT_LEN from 128 to 256 bytes (Sai Vemuri) [1320193]
  - [fs] nfs: fix a regression causing deadlock in nfs_wb_page_cancel() (Benjamin Coddington) [1135601]
  - [netdrv] cxgb4/ethtool: Get/set rx checksum (Sai Vemuri) [1225167]
  - [netdrv] cxgb4vf:The RX checksum feature was not completely ported to cxgb4vf driver (Sai Vemuri) [1225167]
  - [netdrv] cxgb4/cxgb4vf: Enable GRO (Sai Vemuri) [1225167]
  - [netdrv] cxgb4: Enable RX checksum offload flag (Sai Vemuri) [1225167]
  - [netdrv] cxgb4: Report correct link speed for unsupported ones (Sai Vemuri) [1296467]
  - [netdrv] cxgb4: Use vmalloc, if kmalloc fails (Sai Vemuri) [1296473]
  - [netdrv] cxgb4: Enhance driver to update FW, when FW is too old (Sai Vemuri) [1296472]


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.504.el6
changelog:
  - kvm-vns-tls-don-t-use-depricated-gnutls-functions.patch [bz#1428750]
  - kvm-vnc-apply-display-size-limits.patch [bz#1430616 bz#1430617]
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1443448 bz#1443450]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1443448 bz#1443450 bz#1447542 bz#1447545]
  - kvm-cirrus-avoid-write-only-variables.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-PUTPIXEL-macro.patch [bz#1444378 bz#1444380]
  - Resolves: bz#1428750
    (Fails to build in brew)
  - Resolves: bz#1430616
    (CVE-2017-2633 qemu-kvm: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1430617
    (CVE-2017-2633 qemu-kvm-rhev: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1443448
    (CVE-2017-7718 qemu-kvm: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1443450
    (CVE-2017-7718 qemu-kvm-rhev: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1444378
    (CVE-2017-7980 qemu-kvm: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1444380
    (CVE-2017-7980 qemu-kvm-rhev: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1447542
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])
  - Resolves: bz#1447545
    (CVE-2016-9603 qemu-kvm-rhev: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.505.el6
changelog:
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501298]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1486641]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534692]
  - Resolves: bz#1486641
    (CVE-2017-13672 qemu-kvm-rhev: Qemu: vga: OOB read access during display update [rhel-6.10])
  - Resolves: bz#1501298
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-6.10])
  - Resolves: bz#1525939
    (CVE-2017-5715 qemu-kvm: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1528024
    (CVE-2017-5715 qemu-kvm-rhev: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1534692
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-6.10])
  - Resolves: bz#1549152
    (qemu-kvm-rhev: remove unused patch file [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6
changelog:
  - kvm-vga-add-share_surface-flag.patch [bz#1553674]
  - kvm-vga-add-sanity-checks.patch [bz#1553674]
  - Resolves: bz#1553674
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.1
changelog:
  - qemu-kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574074]
  - qemu-kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1574074]
  - qemu-kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1574074]
  - Resolves: bz#1574074
    (CVE-2018-3639 qemu-kvm: hw: cpu: speculative store bypass [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.3
changelog:
  - kvm-target-i386-define-md-clear-bit.patch [bz#1698996]
  - Resolves: bz#1698996
    (CVE-2018-12130 qemu-kvm: hardware: MFBDS)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-75
changelog:
  - Release 1.2.11.15-75
  - Resolves: #1335108 - Paged results search returns the blank list of entries (DS 48808)
  - Resolves: #1342614 - password history is not updated when an admin resets the password (DS 48813)
  - Resolves: #1342382 - Running db2index with no options breaks replication (DS 48854)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-76
changelog:
  - Release 1.2.11.15-76
  - Resolves: #1354331 - Replication changelog can incorrectly skip over updates (DS 48766)
  - Resolves: #1358390 - replication delay when server is configured with multiple replication agreements. (DS 48636)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-77
changelog:
  - Release 1.2.11.15-77
  - Resolves: #1358390 - replication delay when server is configured with multiple replication agreements. (DS 48636)
                         fixing a backport error


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-78
changelog:
  - Release 1.2.11.15-78
  - Resolves: #1354331 -  Replication changelog can incorrectly skip over updates (DS 48954)
  - Resolves: #1361421 - CVE-2016-5416 389-ds-base: ACI readable by anonymous user (DS 48354)
  - Resolves: #1360974 - CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-79
changelog:
  - Release 1.2.11.15-79
  - Resolves: #1358559 - CVE-2016-4992 389-ds-base: Information disclosure via repeated use of LDAP ADD operation
  - Resolves: #1376676 - Backport AES storage scheme plugin (DS 47462, 48862, 48243, 48777)
  - Resolves: #1354331 - Replication changelog can incorrectly skip over updates
  - Resolves: #1374588 - EASY FIX : dereferencing a NULL sr_candidates pointer in ldbm_back_next_search_entry_ext resulted a segfault (DS 47858)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-80
changelog:
  - Release 1.2.11.15-80
  - Resolves: #1379599 - ns-slapd general protection ip:7f570c56afd5 sp:7f56dc7edce0 error:0 in libc-2.12.so (DS 48944)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-81
changelog:
  - Release 1.2.11.15-81
  - Resolves: #Bug 1381153 - Crash in import_wait_for_space_in_fifo(). (DS 48960)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-29
changelog:
  - gssapi: pull in upstream fix for a possible NULL dereference in spnego
    (CVE-2014-4344, #1121510)
  - gssapi: pull in proposed-and-accepted fix for a double free in initiators
    (David Woodhouse, CVE-2014-4343, #1121510)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-30
changelog:
  - ksu: when evaluating .k5users, treat lines with just a principal name as if
    they contained the principal name followed by '*', and don't throw away data
    from .k5users when we're not passed a command to run, which implicitly means
    we're attempting to run the target user's shell (#1026721, revised)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-31
changelog:
  - ksu: when evaluating .k5users, don't throw away data from .k5users when we're
    not passed a command to run, which implicitly means we're attempting to run
    the target user's shell (#1026721, revised)


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-34
changelog:
  - fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
    incorrectly frees context (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
    deserialization results (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
    validates server principal name (MITKRB5-SA-2015-001)"


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-37
changelog:
  - fix for CVE-2014-5355 (#1193939) "krb5: unauthenticated
    denial of service in recvauth_common() and others"


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.147
changelog:
  - Fix stack overflow due to large AF_INET6 requests (CVE-2013-4458, #1111460).
  - Fix buffer overflow in readdir_r (CVE-2013-4237, #1111460).


author: Ade Lee <alee@redhat.com> 9.0.3-31
changelog:
  - Resolves #887305 - /var/run/pki/ca has wrong selinux context
  - Resolves #895702 - pki-cad restart avc denial


author: Ade Lee <alee@redhat.com> 9.0.3-32
changelog:
  - Resolves #999055 - AVC denials during ipa server and replica installs
  - Resolves #998715 - Package Sanity Test Failures


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-33
changelog:
  - Resolves #1051382 - IPA Replica installation fails when using an external CA
  - Test patch to filter out invalid XML and provide additional debugging
    information
  - Resolves #1083170 - Prevent LDAP Attributes from being affected by Locale
  - Resolves #1096142 - IPA replica setup fails during CA setup with
                        "unable to parse xml"
  - Resolves #1061442 - RFE - ipa-server should keep backup of CS.cfg
  - Resolves #1055080 - Giant /var/log/pki-ca/debug


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-39
changelog:
  - Resolves #1144608 - pki-core failed to build with cmake-2.8.12.2-4.el6
    (mharmsen - backport for RHEL 6.6.Z)
  - Resolves #1037248 - pki-core FTBFS if "-Werror=format-security" flag is used
    (mharmsen - backport for RHEL 6.6.Z)
  - Resolves #1243 - Outdated selinux-policy dependency in Dogtag 9
    (mharmsen - backport for RHEL 6.6.Z)
  - Resolves #1229361 - ipa-server-install fails when configuring CA
    (edewata - backport for RHEL 6.6.Z)


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.7.1.el6]
changelog:
  - [kernel] audit: acquire creds selectively to reduce atomic op overhead (Paul Moore) [1460164 1454847]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.8.1.el6]
changelog:
  - [fs] sunrpc: Enable the keepalive option for TCP sockets (Dave Wysochanski) [1462094 1458421]
  - [mm] enlarge stack guard gap (Larry Woodman) [1452729 1452730] {CVE-2017-1000364}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.10.1.el6]
changelog:
  - [mm] backport upstream large stack guard patch to RHEL6 (Larry Woodman) [1466667 1464237]
  - Revert: [mm] allow JVM to implement its own stack guard pages (Larry Woodman) [1466667 1464237]
  - Revert: [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]
  - [fs] sunrpc: Handle EADDRNOTAVAIL on connection failures [1472128 1459978]
  - [scsi] scsi_transport_srp: Fix a race condition (Don Dutile) [1462097 1417305]
  - [scsi] scsi_transport_srp: Introduce srp_wait_for_queuecommand() (Don Dutile) [1462097 1417305]
  - [block] make blk_cleanup_queue() wait until request_fn finished (Don Dutile) [1462097 1417305]
  - [s390] kernel: initial cr0 bits (Hendrik Brueckner) [1460194 1445326]
  - [s390] zfcp: do not trace pure benign residual HBA responses at default level (Hendrik Brueckner) [1460193 1421760]
  - [s390] zfcp: fix rport unblock race with LUN recovery (Hendrik Brueckner) [1460190 1421761]
  - [scsi] bnx2fc: fix race condition in bnx2fc_get_host_stats() (Maurizio Lombardi) [1467323 1393672]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.13.2.el6]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}
  - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}
  - [fs] binfmt_elf.c: fix bug in loading of PIE binaries (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}


author: David Vossel <dvossel@redhat.com> - 3.9.5-16
changelog:
  - Fixes unreliable detection of nic device in IPaddr2
  - Fix fs-lib.sh regression in is_alive write test failure detection
  - Fix properly handle mysql when alternate user is specified.

    Resolves: rhbz#1181187
    Resolves: rhbz#1183735
    Resolves: rhbz#1183148


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Fixes rgmanager lvm agent's ability to exclusively activate
    volume groups on nodes with aliases

    Resolves: rhbz#1085109


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018.
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-4
changelog:
  - Brazil moved the start of DST from the first Sunday in November
    to the third Sunday in November.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Lennart Poettering <lpoetter@redhat.com> - 0.6.25-7
changelog:
  - Fix for CVE-2010-2244
  - Resolves: #607296
  - Resolves: #594405
  - Related 587761
  - Related 584761
  - Related 584766
  - Related 596151
  - Related 599435


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-96
changelog:
  - Resolves: rhbz#1327238 rpm -V tomcat6 fails due on /var/log/tomcat6/catalina.out
  - Resolves: rhbz#1347778 The security manager doesn't work correctly


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-106
changelog:
  - Resolves: rhbz#1441478 CVE-2017-5647 tomcat6: tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-110
changelog:
  - Resolves: rhbz#1461292 CVE-2017-5664 tomcat6: tomcat: Security constrained bypass in error page mechanism


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have mknod capability. It creates a special file using mknod in a brick.
   - Update rules related to glusterd_brick_t.
   - Allow glusterd to execute lvm tools in the lvm_t target domain.
   - Allow glusterd to execute xfs_growfs in the target domain.
   - Add support for /usr/sbin/xfs_growfs.
   - Allow glusterd to create samba config files if it is started by service script and running with unconfined_u.
  Resolves:#1228109
  - Fix description for ftpd_use_passive_mode boolean.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have transition to insmod.
  - Allow glusterd to use geo-replication gluster tool.
  - Remove gluster from permissive domains.
  Resolves:#1229605


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-39
changelog:
  - Resolves #1144608 - pki-core failed to build with cmake-2.8.12.2-4.el6
  - Resolves #1037248 - pki-core FTBFS if "-Werror=format-security" flag is used
  - Resolves #1243 - Outdated selinux-policy dependency in Dogtag 9


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-40
changelog:
  - Resolves #1171848 - IPA - port 9443 (pki-core) is vulnerable to SSLv3 POODLE
    (based upon upstream changes provided by cfu and alee)


author: Jack Magne <jmagne@redhat.com> 9.0.3-42
changelog:
  - Resolves #1221900 - pki-core: cross-site scripting flaw in the dogtag administration page (port 9180, port 9444) [rhel-6.7]


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-43
changelog:
  - Resolves #1225589 - unable to create rhel 7.1 replica from rhel 6 replica CA because subsystem user does not exist


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-44
changelog:
  - Resolves #1256039 - Fixed missing subsystem user on external CA case.
  - Removed unused backup files (.p*) generated by the patches.


author: Bastien Nocera <bnocera@redhat.com> 4.66-1
changelog:
  - Update to 4.66
  - Update cable pairing patch
  - Remove out-dated patches, including wacom pairing
  - Move hidd, pand and dund man pages to the -compat
    sub-package
  Resolves: rhbz#565586


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.51-2.b16
changelog:
  - another touching attempt to polycies...
  - main links in alternatives moved to versionless format
  - Resolves: rhbz#1254197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.2
changelog:
  - Add backports of PR2233, PR2161, PR1661 (GConf changeset) and PR2320 from IcedTea 2.6.x
  - No longer set SYSTEM_GIO to false as we can link against it now GSettings is not required
  - Add test case to ensure file type detection works
  - Add build dependency on GConf2-devel for native proxy support.
  - Remove outdated dependencies on mercurial, redhat-lsb and libxslt from IcedTea builds.
  - Remove python dependency introduced for rpath rewrite script, which has now been removed.
  - Add build dependency on redhat-lsb-core to provide lsb_release for jdk_generic_profile.sh
  - Apply PR2323 to fix building of networking support with system GConf on and system GIO off
  - Revise PR2323 to use header defines to mark whether GLib types have been defined or not
  - Revise PR2323 to account for different glibconfig.h define used on RHEL 6
  - Use installed directory in check section and remove duplicate tests in build
  - Resolves: rhbz#1217984


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Bump to 2.6.0 and u80b32.
  - Drop upstreamed patches and separate AArch64 HotSpot.
  - Add dependencies on pcsc-lite-devel (PR2496) and lksctp-tools-devel (PR2446)
  - Only run -Xshare:dump on JIT archs other than power64 as port lacks support
  - Update remove-intree-libraries script to cover LCMS and PCSC headers and SunEC.
  - Resolves: rhbz#1235156


author: Kamil Dudka <kdudka@redhat.com> - 1.4.2-3.el6_10.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-70
changelog:
  - Add links to knowledge base articles.
  - Resolves: bug#1248686
  - Resolves: bug#1248687
  - Resolves: bug#1248690
  - Backport missing_requires to API.
  - Resolves: bug#1197245
  - Get correct rpmdb path from rpm configuration.
  - Resolves: bug#1271584


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-71
changelog:
  - Fix manpage for query_install_excludes option.
  - Resolves: bug#1248715
  - Don't traceback on xml parsing.
  - Resolves: bug#1225481
  - Respect epoch in package names.
  - Resolves: bug#1211390


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-72
changelog:
  - Add ftp_disable_epsv config option.
  - Resolves: bug#1293363
  - Honor proxy=_none_ set in yum.conf.
  - Resolves: bug#1293385


author: Tom Lane <tgl@redhat.com> 8.4.7-1
changelog:
  - Update to PostgreSQL 8.4.7, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-7.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-6.html
    including the fix for CVE-2010-4015
  Resolves: #672635


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-12
changelog:
  - add character sequence test to pam_cracklib
  - drop unused difignore option from pam_cracklib (#811243)
  - add enforce_for_root option to pam_cracklib (#588893)
  - mention limits.d in the limits.conf(5) manpage (#723297)
  - add ability to lock out inactive accounts to pam_lastlog
  - fix require_selinux option in pam_namespace (#750601)
  - add mntopts flag for tmpfs polyinstantiation method
  - preserve authtok_type in pam_get_authtok() (#811168)
  - fix username mismatch in pam_unix remember feature (#815516)
  - relax restriction of root in pam_pwhistory
  - relax soft nproc limit for root in 90-nproc.conf


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-18
changelog:
  - pam_cracklib: improve documentation (#889233)
  - unbreak authentication if ld.so.preload is not empty
  - correct off by one error in account expiration calculation (#947011)
  - pam_console_apply: do not print error if console.perms.d is empty
  - properly handle all cases where crypt() might return NULL (#1026203)
  - pam_limits: clarify documentation of maxsyslogins limit (#1028490)
  - pam_access: call DNS resolution only when necessary and cache
    results (#1029817)
  - pam_limits: nofile applies to file descriptors not files (#1040664)
  - pam_limits: check whether the utmp login entry is valid (#1054936)
  - correct URLs in spec file (#1071770)
  - pam_userdb: correct the example in man page (#1078779)
  - pam_selinux: canonicalize username for getseuser() (#1083981)
  - pam_access: fix netgroup matching and @user@@netgroup parsing (#740233)


author: Marek Kasik <mkasik@redhat.com> - 2.3-3
changelog:
  - Add -fno-strict-aliasing to pass "Testsuite regressions" test
  - Make docs subpackage "noarch"
  - Resolves: #605103


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-1
changelog:
  - update to 4.2.6p5 (#654004, #641800, #714079, #714084, #716968, #819781,
    - bind broadcast client to new interfaces (#973807)
  - allow selection of cipher for private key files (#749530)
  - retry few times in ntpdate init script before giving up (#673198)
  - print synchronization distance instead of dispersion in ntpstat (#830821)
  - ignore duplicate servers from dhclient (#862983)
  - add fourth server to default ntp.conf and use iburst (#667524, #623616)
  - drop comment enabling local driver in default config (#816645)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-7
changelog:
  - backport PGSTARTTIMEOUT variable from latest RHSCL while reasonably
    changing wait timeout to 2 seconds by default


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-8
changelog:
  - Prevent non-synced raid1 repair unless --force
  - Fix automatic updates of PV extension headers to newest version.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-9
changelog:
  - Fix lvchange --discard|--zero for active thin-pool.
  - Fix lock-holder device for thin pool with inactive thin volumes.
  - Use any inherited tags when wiping metadata sub LVs to ensure activation.
  - Do not issue "Failed to create directory" message for dm_create_dir failure.
  - Add Conflicts: lvm2-libs < 2.02.111 to device-mapper-event to prevent
    incorrect package setup if old and new device-mapper/lvm2 packages combined.
  - Move blkdeactivate/blk-availability script from lvm2 to device-mapper package.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-10
changelog:
  - Disable queueing on mpath devs in blk-availability initscript.
  - Add new -m|--mpathoption disablequeueing to blkdeactivate.
  - Prevent only repair for non-synced raid1 unless --force, not other raid types.


author: Chrissie Caulfield <ccaulfie@redhat.com> - 3.0.12.1-60
changelog:
  - fenced: keep manual ACk fifo open for longer and also make fenced_external()
    write to it.
    Resolves: rhbz#1059269


author: Andrew Price <anprice@redhat.com> - 3.0.12.1-61
changelog:
  - libgfs2: Fix up remove_mtab_entry
    Resolves: rhbz#1059853
  - fsck.gfs2: Check and repair per_node contents such as quota_changeX
    Resolves: rhbz#1062742
  - libgfs2: patch to update gfs1 superblock correctly
  - gfs2-utils: check and fix bad dinode pointers in gfs1 sb
    Resolves: rhbz#1053668


author: Andrew Price <anprice@redhat.com> - 3.0.12.1-63
changelog:
  - gfs2_edit: Add a savemeta file metadata header
  - gfs2_edit: Fix loop arithmetic in restore_data
  - gfs2_edit: Ensure all leaf blocks in per_node are saved
  - gfs2_edit: Reinstate a check for system dinodes
    Resolves: rhbz#1081523


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-64
changelog:
  - qdisk: Check cman_wait() return value and report errors
    Resolves: rhbz#979313
  - libccs: Read daemon logging attributes correctly
    Resolves: rhbz#980575
  - qdisk: Quorum init complete after tko_up cycles, not tko
    Resolves: rhbz#1029210
  - config: Fix typos and phrasing in defaults file
    Resolves: rhbz#1035929
  - ccs_tool: Fix crash using --verbose
    Resolves: rhbz#1074551
  - manpage: Mention cluster.conf.html schema in man page
    Resolves: rhbz#981043
  - fenced: Remove mention of skip_undefined feature as it is not supported
    Resolves: rhbz#994234


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-67
changelog:
  - dlm_controld: Adjust fence time comparison
    Resolves: #rhbz843160
  - man: update fence_node options
    Resolves: #rhbz886016
  - fenced: Wait for ringid
    gfs_controld: Fix first recovery case
    Resolves: #rhbz982305


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-68.1
changelog:
  - gfs_controld: Retry uevent recv() and reconnect uevent socket on error
    Resolves: rhbz#1234442
  - dlm_controld: Retry uevent recv() and reconnect uevent socket on error
    Resolves: rhbz#1233534


author: Ryan O'Hara <rohara@redhat.com> - 1.2.13-1
changelog:
  - Rebase to upstream version 1.2.13
    Resolves: rhbz#1052380, rhbz#1077201, rhbz#1007575, rhbz#967641


author: Remi Collet <rcollet@redhat.com> - 5.3.3-49
changelog:
  - fix php-soap fails to connect to HTTPS web service sporadically
    as stream_socket_enable_crypto() uses NONBLOCK #1283153


author: Todd Zullinger <tmz@pobox.com> - 1.6.5.2-1
changelog:
  - git-1.6.5.2
  - Drop asciidoc --unsafe option, it should not be needed anymore
  - Don't use install -t/-T, they're not compatible with older coreutils
  - Don't use -perm /a+x with find, it's incompatible with older findutils


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.92-0.b14
changelog:
  - Update to u92b14.
  - Remove upstreamed patches for Zero build failures 8087120 & 8143855.
  - Add 8132051 Zero fix upstreamed as 8154210 in 8u112.
  - Add upstreamed patch 6961123 from u102 to fix application name in GNOME Shell.
  - Add upstreamed patches 8044762 & 8049226 from u112 to fix JDI issues.
  - Regenerate java-1.8.0-openjdk-rh1191652-root.patch against u92
  - Resolves: rhbz#1350034


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-0.b13
changelog:
  - Update to u101b13.
  - Backport REPOS option in generate_source_tarball.sh
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1350034


author: David Lutterkort <lutter@redhat.com> - 0.9.0-2
changelog:
  - Fix BZ 781690 "Grub password --encrypted argument not parsed correctly"
  - Fix BZ 628507 "It's better to support fadot --help or fadot -h"
  - Fix BZ 759311 "augtool --autosave does not save changes"


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.0-4
changelog:
  - Rebase to Augeas 1.0.0
    resolves: rhbz#817753
  - Add dependency on libxml2-devel.
  - Remove all patches (all upstream and included in 1.0.0).
  - Print tests/test-suite.log when the tests fail.
  - Add fix for regression added in 1.0.0 (RHBZ#920609).
  - Fix tests/test-run.


author: Dominic Cleal <dcleal@redhat.com> - 1.0.0-6
changelog:
  - Fix CVE-2013-6412, incorrect permissions under strict umask (RHBZ#1036080)
  - Grub: support 'setkey' and 'lock' directives (RHBZ#1001635)
  - ActiveMQ: add ActiveMQ lens (RHBZ#1016899)
  - Splunk: add Splunk lens (RHBZ#1016900)
  - Sudoers: user aliases fail to parse (RHBZ#1016904)
  - Tests: testPermsError during compilation (RHBZ#1024275)
  - Shellvars: multi-variable export lines (RHBZ#1033795)
  - Shellvars: case statements with same-line ;; tokens (RHBZ#1033799)
  - Sysconfig: permit empty comments (RHBZ#1043636)
  - Grub: support 'foreground' directive (RHBZ#1059383)
  - Yum: permit space after equals sign (RHBZ#1062091)
  - IniFile: add generic INI lenses (RHBZ#1073072)
  - Automounter: permit hostnames with hyphens (RHBZ#1075112)
  - Rsyslog: parse property filters and templates (RHBZ#1083016)
  - Ldso: parse hwcap lines (RHBZ#1083021)
  - Sudoers: permit underscores in group names (RHBZ#1093711)
  - augtool: remove dump-xml filename arg (RHBZ#1100182)
  - augtool: add commands to autocomplete (RHBZ#1100184)
  - docs: update command and arg lists (RHBZ#1100186)
  - Nrpe: parse unknown config options (RHBZ#1100237)


author: Patsy Franklin <pfrankli@redhat.com> - 2014c-1
changelog:
  - Rebase to 2014c
    - Egypt's government to re-apply daylight saving time.
    - zic now generates transitions for minimum time values
    - Port to Cygwin sans glibc.
    - Remove now-confusing comment about Jordan.


author: Patsy Franklin <pfrankli@redhat.com> - 2014d-1
changelog:
  - Rebase to 2014d
    - zic no longer generates files containing time stamps before
      the Big Bang.  This works around GNOME bug 730332


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-1
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan 
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00


author: Patsy Franklin <pfrankli@redhat.com> - 2014f-1
changelog:
  - Rebase to 2014f
    - Several Russian time zone changes effective on 2014-10-26
      at 02:00 local time.  See NEWS file for additional details.


author: Patsy Franklin <pfrankli@redhat.com> - 2014g-1
changelog:
  - Rebase to 2014g
    - Turks & Caicos is switching from US eastern time to UTC-4
      year-round, modeled as a switch from EST/EDT to AST 
      on 2014-11-02 at 02:00.


author: Petr Machata <pmachata@redhat.com> - 2014h-1
changelog:
  - Rebase to 2014h
    - Changes to historical transitions in America/Jamaica and
      Asia/Novokuznetsk.
    - Africa/{Blantyre, Bujumbura, Gaborone, Harare, Kigali, Lubumbashi,
      Lusaka} now alias Africa/Maputo, because they don't differ in
      post-1970 stamps.
    - Africa/Maseru and Africa/Mbabane now alias Africa/Johannesburg for
      the same reason.


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d:
    - The Egyptian Cabinet announced that DST will be cancelled for 2015.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style. This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-47
changelog:
  - Revert "qemu: export disk snapshot support in capabilities" (rhbz#1149667)
  - qemu: allow restore with non-migratable XML input (rhbz#1141838)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1141838)
  - Make ABI stability issue easier to debug (rhbz#1141838)
  - domain_conf: fix domain deadlock (CVE-2014-3657)
  - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
  - sanlock: Avoid freeing uninitialized value (rhbz#1136788)
  - virsh: Print cephx and iscsi usage (rhbz#1156327)
  - Fix bug with loading bridge name for active domain during libvirtd start (rhbz#1146310)
  - conf: Fix even implicit labels (rhbz#1138500)
  - tests: Add test cases for previous commit (rhbz#1138500)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-48
changelog:
  - networkValidate: Disallow bandwidth in portgroups too (rhbz#1115292)
  - qemu: Fix checking of ABI stability when restoring external checkpoints (rhbz#834196)
  - qemu: Use "migratable" XML definition when doing external checkpoints (rhbz#834196)
  - qemu: Fix memleak after commit 59898a88ce8431bd3ea249b8789edc2ef9985827 (rhbz#834196)
  - qemu: blkiotune: Avoid accessing non-existing disk configuration (rhbz#1131821)
  - qemu: Fix build error introduced in 653137eb957a278b556c6226424aad5395a (rhbz#1131821)
  - qemu: snapshot: Use better check when reverting external snapshots (rhbz#1124854)
  - virsh: domain: Use global constant for XML file size limit (rhbz#1134671)
  - selinux: Avoid label reservations for type = none (rhbz#1138488)
  - Clean up chardev sockets on QEMU shutdown (rhbz#1122367)
  - Don't include @LIBS@ in libvirt.pc.in file (rhbz#1134455)
  - qemu: save domain state to XML after reboot (rhbz#1169405)
  - virsh: Honour -q in domblklist, vcpupin and emulatorpin (rhbz#1135171)
  - virsh-domain: Flip logic in cmdSetvcpus (rhbz#1139114)
  - Fix possible memory leak in util/virxml.c (rhbz#1136729)
  - esx_vi: fix possible segfault (rhbz#1136729)
  - sasl: Fix authentication when using PLAIN mechanism (rhbz#1171521)
  - Fix leak in x86UpdateHostModel (rhbz#1144304)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-49
changelog:
  - nwfilter: utility function virNWFilterVarValueEqual (rhbz#1126487)
  - qemu: support live update of an interface's filter (rhbz#1126487)
  - qemu: Update fsfreeze status on domain state transitions (rhbz#1136251)
  - virsh: Fix semantics of --config for "update-device" command (rhbz#1129112)
  - virsh: Don't use legacy API if --current is used on device hot(un)plug (rhbz#1125194)
  - qemu: Avoid double serial output with RHEL 6 qemu (rhbz#1162759)
  - storage: Check the partition name against provided name (rhbz#1138523)
  - qemu: Don't unconditionally delete file in qemuOpenFileAs (rhbz#1158036)
  - conf: Don't mangle vcpu placement randomly (rhbz#1170495)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-50
changelog:
  - conf: Don't format actual network definition in migratable XML (rhbz#1186142)
  - network: don't allow multiple portgroups with the same name in a network (rhbz#1115858)
  - build: fix build with latest rawhide kernel headers (rhbz#1198698)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-51
changelog:
  - sanlock: Don't spam logs with "target pid not found" (rhbz#1189414)
  - nwfilter: fix crash when adding non-existing nwfilter (rhbz#1202703)
  - util: more verbose error when failing to create macvtap device (rhbz#1186142)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-52
changelog:
  - qemu: Keep QEMU host drive prefix in BlkIoTune (rhbz#1203633)
  - qemu: Fix name comparison in qemuMonitorJSONBlockIoThrottleInfo() (rhbz#1203633)
  - virsh: fix typos in virsh man page (rhbz#1130835)
  - schemas: Allow all generic elements and attributes for all interfaces (rhbz#1206066)
  - RNG: Allow multiple parameters to be passed to an interface filter (rhbz#1206066)
  - qemu_domain: fix startup policy for disks (rhbz#1203542)
  - Create directory for lease files if it's missing (rhbz#1200991)
  - qemu: cgroup: Properly set up vcpu pinning (rhbz#1198096)
  - cgroup: Add accessors for cpuset.memory_migrate (rhbz#1198497)
  - qemu: Fix possible crash (rhbz#1198497)
  - qemu: Migrate memory on numatune change (rhbz#1198497)
  - qemu: fix crash when removing <filterref> from interface with update-device (rhbz#1205042)
  - nwfilter: Fix rule priority problem (rhbz#1210183)
  - qemuProcessHook: Call qemuProcessInitNumaMemoryPolicy only when needed (rhbz#1198645)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-53
changelog:
  - RHEL: Avoid memory leak when virCgroupSetCpusetMemoryMigrate fails (rhbz#1198497)
  - qemu: cgroup: Fix memory leak when there's no vCPU pinning (rhbz#1198096)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-54
changelog:
  - util: set MAC address for VF via netlink message to PF+VF# when possible (rhbz#1113474)
  - util: set macvtap physdev online when macvtap is set online (rhbz#1113474)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-54.el6_7.1
changelog:
  - qemu: split out cpuset.mems setting (rhbz#1265970)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1265970)
  - virNetDev{Replace, Restore}MacAddress: Fix memory leak (rhbz#1266039)
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1266039)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1266039)


author: Tim Waugh <twaugh@redhat.com> - 8.70-20
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1105520).
  - Improved support for PDF/A from upstream (bug #1060026).
  - Back-ported patch to process embedded files as a portable collection
    only if there is a /Collection attribute (bug #1027534).
  - Back-ported patch to preserve invisible PDF text in pdfwrite (bug #994452).


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 8.70-22
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: Martin Osvald <mosvald@redhat.com> - 8.70-24.el6_10.2
changelog:
  - It was found that the fix for CVE-2018-16509 was not complete, the missing
    pieces added into ghostscript-CVE-2018-16509.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-2
changelog:
  - Enable two additional ciphers and keep another one disabled
  - Prevent enabling extended masker key derive


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-6
changelog:
  - Fix syntax errors in patch that disables sslv2 tests
  - Resolves: Bug 1297888 - Rebase RHEL 6.8 to NSS 3.21 for Firefox 45


author: Kai Engert <kaie@redhat.com> - 3.21.3-2
changelog:
  - Mozilla #1314604 / Red Hat CVE-2016-8635
  - remove disable_hw_gcm.patch which hasn't been used since 3.16.1


author: jchaloup <jchaloup@redhat.com> - 0.40.rc1-16
changelog:
  - extending cgroup names with default
    resolves: #1139205
  - fixing libcgroup-0.40.rc1-reading-config-files-from-etc-cgconfig.d.patch not to modify patch backup file
    resolves: #1162220


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.503.el6_9.5
changelog:
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501296]
  - Resolves: bz#1501296
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-6.9.z])


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-61.rc4
changelog:
  - resolves: #1073356 - Fix CVE-2012-6150.
  - resolves: #1073356 - Fix CVE-2013-4496.
  - resolves: #1073356 - Fix CVE-2013-6442.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.0.0-62.rc4
changelog:
  - resolves: #1105502 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108843 - CVE-2014-3493: DoS in smbd with unicode path names.
  - resolves: #1105572 - CVE-2014-0178: Uninitialized memory exposure.


author: Denys Vlasenko <dvlasenk@redhat.com> - 1:1.15.1-12
changelog:
  - Backport 'set -o pipefail' support
  - Resolves: #782018
  - Add btrfs support to findfs and related applets
  - Resolves: #751927


author: Denys Vlasenko <dvlasenk@redhat.com> - 1:1.15.1-13
changelog:
  - Resolves: #790335 "busybox various flaws" including:
    "buffer underflow in decompression"
    "udhcpc insufficient checking of DHCP options"


author: Denys Vlasenko <dvlasenk@redhat.com> - 1:1.15.1-16
changelog:
  - Resolves: #859817
  - "mknod in busybox can not create device file with major number greater than 255"


author: Denys Vlasenko <dvlasenk@redhat.com> - 1:1.15.1-18
changelog:
  - Resolves: #855832
    "Installation from NFS: That directory could not be mounted from the server"
    by switching NFS mount default from UDP to TCP.


author: Denys Vlasenko <dvlasenk@redhat.com> - 1:1.15.1-20
changelog:
  - Resolves: #855832
    "Installation from NFS: That directory could not be mounted from the server"
    by switching NFS mount default from UDP to TCP.
    There was another place (in uclibc this time) which used UDP.


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-57.rc4
changelog:
  - resolves: #984809 - CVE-2013-4124: DoS via integer overflow when reading
                        an EA list


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.2
changelog:
  - Separate bootstrap option as it should not be tied to the JDK used.
  - Enable bootstrapping on JIT architectures going forward.
  - Temporarily enable bootstrapping on all architectures to work around RH1334465/PR2956.
  - Resolves: rhbz#1350044


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.4
changelog:
  - Non-JIT architectures have not been bootstrapping, due to RPM reading commented macros
  - Resolves: rhbz#1350044


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Set install directories in configure so that @prefix@ is substituted correctly in tapset
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Require a JDK with RH1334465/PR2956 fixed and turn off bootstrapping for Zero architectures.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Update to IcedTea 1.13.13 & OpenJDK 6 b41.
  - Fix context for rpath patch following PR3213.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Petr Hracek <phracek@redhat.com> - 3.9.4-10
changelog:
  - This resolves several CVEs
  - CVE-2014-8127, CVE-2014-8129, CVE-2014-8130
  - CVE-2014-9330, CVE-2014-9655, CVE-2015-8781
  - CVE-2015-8784, CVE-2015-1547, CVE-2015-8683
  - CVE-2015-8665, CVE-2015-7554, CVE-2015-8668
  - Resolves: #1299919


author: Nikola Forró <nforro@redhat.com> - 3.9.4-14
changelog:
  - Merge previously released fixes for CVEs:
  - CVE-2013-1960 CVE-2013-1961 CVE-2013-4231
  - CVE-2013-4232 CVE-2013-4243 CVE-2013-4244
  - Resolves: #1335099


author: Nikola Forró <nforro@redhat.com> - 3.9.4-16
changelog:
  - Add patches for CVEs:
  - CVE-2016-3632 CVE-2016-3945 CVE-2016-3990
  - CVE-2016-3991 CVE-2016-5320
  - Related: #1335099


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-8
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289881


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-5
changelog:
  - spec cleanup
  - simplified packaging (merge -perl in -utils)
  - remove obsoleted and/or unmaintained additional sources/patches
  - remove long time not used files from the cvs/srpm
  - update additional sources/patches from their upstream


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-9
changelog:
  - fix CVE-2011-3481: NULL pointer dereference via crafted 
    References header in email (#738391)
  - fix CVE-2011-3372: nntpd authentication bypass (#740822)


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-15
changelog:
  - 1125984 iscsistart vlan support
  - 906242 fix segfault from unexpected netlink event during driver load
  - 1181463 iscsiuio update


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-21
changelog:
  - 1294965 iscsiuio match based on driver to support new hardware without
    adding PCI IDs (still need IDs added to kernel)
  - bnx2i pass through ping support


author: Harald Hoyer <harald@redhat.com> 004-399
changelog:
  - add hyper kernel modules
  Resolves: rhbz#1298445 rhbz#1223315
  - fix ifcfg generation
  Resolves: rhbz#1261893
  - support multiple vlan definitions
  Resolves: rhbz#1111358
  - support setting of MTU via ip=..:ibft:<mtu>
  Resolves: rhbz#1076465
  - use cpio -R root:root rather than cpio -R 0:0
  Resolves: rhbz#1049763
  - fail hard if final image could not be written
  Resolves: rhbz#1252449
  - create correct bonding interface
  Resolves: rhbz#1263013


author: Harald Hoyer <harald@redhat.com> - 004-403
changelog:
  - network/ifup: use the correct interface name for the vlan parent
  - iscsiroot: for iscsi_firmware retry, if iscsistart -N fails
  Resolves: rhbz#1111358


author: Harald Hoyer <harald@redhat.com> - 004-408
changelog:
  - add more kernel modules for crypt
  Resolves: rhbz#1322893
  - trigger acpi subsystem before running plymouth
  Resolves: rhbz#1218130


author: Harald Hoyer <harald@redhat.com> - 004-409
changelog:
  - don't handle "iscsistart -N" exit value
    start iscsistart -b more reliably in the background
  Resolves: rhbz#1324340


author: James Antill <james.antill@redhat.com> - 4.3.10-5
changelog:
  - Change invocation as "zsh foo" to search the path by default.
  - Add new option PATH_SCRIPT for old behaviour.
  - Resolves: rhbz#612685
  - Solve defect in emulation of ksh with math substituion.
  - Resolves: rhbz#657300


author: James Antill <james.antill@redhat.com> - 4.3.10-7
changelog:
  - Change {NAME:OFFSET:LENGTH} substitution feature to ignore KSH_ARRAYS option.
  - Fixup tests.
  - Resolves: rhbz#820530


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-2.20100411git
changelog:
  Resolves: #609595
  - Fix to read connection configuration from stdin, so no conf file is stored now
  - Fix to read Xauth user password from stdin
  - Fix to delete the secret file as soon as read by Openswan
  - Fixed the issue of world readable conf and secret files
  - Modifed GUI to remove unused configuration boxes


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-3.20100411git
changelog:
  Resolves: #609595
  - Due to changes in NMVpnPluginUiInterface struct in NM, import and export
    fields had to be changed to import_from_file and export_to_file, respectively
  - Rebuilding as build was failing due to the above changes


author: Avesh Agarwal <avagarwa@redhat.com> - 0.8.0-5.20100411git
changelog:
  Resolves: #617016
  - Support for reading phase1 and phase2 algorithms through GUI
  - Fixed chanelog to reference correct bz 617016, and bumped release number.


author: Paul Wouters <pwouters@redhat.com> - 0.8.0-9
changelog:
  Resolves: #1267394
  - Add libreswan softlinks for nm helper to support libreswan dropin
  - Support for libreswan env vars PLUTO_PEER_DNS_INFO, PLUTO_PEER_DOMAIN_INFO and libreswan_reason


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.489.el6
changelog:
  - kvm-hw-qxl-qxl_send_events-nop-if-stopped.patch [bz#1290743]
  - kvm-block-mirror-fix-full-sync-mode-when-target-does-not.patch [bz#971312]
  - Resolves: bz#1290743
    (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)
  - Resolves: bz#971312
    (block: Mirroring to raw block device doesn't zero out unused blocks)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.490.el6
changelog:
  - kvm-qemu-ga-implement-win32-guest-set-user-password.patch [bz#1174181]
  - kvm-util-add-base64-decoding-function.patch [bz#1174181]
  - kvm-qga-convert-to-use-error-checked-base64-decode.patch [bz#1174181]
  - kvm-qga-use-more-idiomatic-qemu-style-eol-operators.patch [bz#1174181]
  - kvm-qga-use-size_t-for-wcslen-return-value.patch [bz#1174181]
  - kvm-qga-use-wide-chars-constants-for-wchar_t-comparisons.patch [bz#1174181]
  - kvm-qga-fix-off-by-one-length-check.patch [bz#1174181]
  - kvm-qga-check-utf8-to-utf16-conversion.patch [bz#1174181]
  - Resolves: bz#1174181
    (RFE: provide QEMU guest agent command for setting root account password (Linux guest))


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.491.el6_8.1
changelog:
  - kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331407]
  - kvm-vga.h-remove-unused-stuff-and-reformat.patch [bz#1331407]
  - kvm-vga-use-constants-from-vga.h.patch [bz#1331407]
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331407]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331407]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331407]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331407]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331407]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331407]
  - Resolves: bz#1331407
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-6.8.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.491.el6_8.2
changelog:
  - kvm-vga-add-sr_vbe-register-set.patch [bz#1347192]
  - Resolves: bz#1347192
    (Regression from CVE-2016-3712: windows installer fails to start)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.491.el6_8.3
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359724]
  - Resolves: bz#1359724
    (EMBARGOED CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-6.8.z])


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.491.el6.4
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1408389]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1408389]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1408389]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1408389]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1408389]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1408389]
  - Resolves: bz#1408389
    ([RHEL6.8.z] KVM guest shuts itself down after 128th reboot)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.491.el6_8.5
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398213]
  - Resolves: bz#1398213
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-6.8.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.491.el6_8.6
changelog:
  - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop.patch [bz#1418230 bz#1419416]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418230 bz#1419416]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418230 bz#1419416]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418230 bz#1419416]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418230 bz#1419416]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418230 bz#1419416]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418230 bz#1419416]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418230 bz#1419416]
  - Resolves: bz#1418230
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.8.z])
  - Resolves: bz#1419416
    (CVE-2017-2615 qemu-kvm-rhev: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.8.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.491.el6_8.7
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420486 bz#1420488]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420486 bz#1420488]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420486 bz#1420488]
  - Resolves: bz#1420486
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.8.z])
  - Resolves: bz#1420488
    (EMBARGOED CVE-2017-2620 qemu-kvm-rhev: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.8.z])


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b03-0.1.ea
changelog:
  - Provide Javadoc debug subpackage for now, but populate it from the normal build.
  - Resolves: rhbz#1724452


author: Remi Collet <rcollet@redhat.com> - 5.3.3-29
changelog:
  - drop unneeded part of CVE-2006-724.patch and fileinfo.patch
    extension not provided or git binary patches (#1064027)
  - odbc: fix incompatible pointer type (#1053982)
  - mysqli: fix possible segfault in mysqli_stmt::bind_result
    php bug 66762 (#1069167)
  - mysql: fix php_mysql_fetch_hash writes long value into int
    php bug 52636 (#1054953)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-31
changelog:
  - soap: fixRFC2616 transgression (#1045019)
  - fix static calling in non-static method (#953786)
  - fix autoload called from closing session (#954027)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-34
changelog:
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Jan Kaluza <jkaluza@redhat.com> - 5.3.3-35
changelog:
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480


author: Remi Collet <rcollet@redhat.com> - 5.3.3-36
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515


author: Remi Collet <rcollet@redhat.com> - 5.3.3-37
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-5
changelog:
  - Add support for TIMESTAMP/STRING selection types, this fixes copy and paste
    issues with some applications (vncviewer for example).
    Resolves: rhbz#1117764


author: Fabiano Fidêncio <fidencio@redhat.com> 0.14.0-6
changelog:
  - randr: Make resolution changing more robust
    Resolves: rhbz#1206117, rhbz#1130080 and rhbz#1209550


author: Fabiano Fidêncio <fidencio@redhat.com> 0.14.0-8
changelog:
  - Cannot get same result enablng second monitor after it was disabled using
    Guest's "Display Preference"
    Resolves: rhbz#1086657


author: Victor Toso <victortoso@redhat.com> 0.14.0-12
changelog:
  - Do not allow file-transfer on locked session
    Resolves: rhbz#1323630
  - Do not allow file-transfer on login screen
    Resolves: rhbz#1323640


author: Tomas Heinrich <theinric@redhat.com> 7.4.10-1
changelog:
  - initial import of rsyslog7
    changes since rsyslog-5.8.10-8:
    - rebase to 7.4.10
    - drop patches merged upstream
    - regenerate patches for rhbz820311, rhbz886117
    - add a patch to remove dependency on liblogging-stdlog
    - add a patch to fix compilation of omelasticsearch
      on platforms without atomic instructions
    - mark package as conlicting with rsyslog
    - update specification of dependencies
    - add the rsyslog-recover-qi.pl script
    - add new plugins
      imdiag, mmanon, mmjsonparse, mmsnmptrapd, omelasticsearch,
      pmaixforwardedfrom, pmcisconames, pmsnare
    - add new subpackage rsyslog-elasticsearch
    - make the build more verbose by adding 'V=1' to make
    - update conf file for new omusrmsg syntax
      for details, see http://www.rsyslog.com/doc/v6compatibility.html
    - drop default compatibility mode from SYSLOGD_OPTIONS
      for details, see http://www.rsyslog.com/doc/v6compatibility.html
    - fix typos in the spec file
    resolves: #869600


author: Tomas Heinrich <theinric@redhat.com> 7.4.10-2
changelog:
  - amend rsyslog.conf man page with information on omitting file sync
    resolves: #994127
  - add a patch to support TCP KEEPALIVE in imrelp
    resolves: #1009048
  - add a patch to fix missing note about message repetition in imuxsock
    resolves: #1020431
  - add a patch to prevent division-by-zero errors
    resolves: #996862
  - add a patch to fix the name of the PID file in man page
    resolves: #1009882
  - add a patch to remove references to Google ads from the html docs
    resolves: #1030040
  - add missing image files referenced from the html docs
    resolves: #1031673
  - add a patch to backport the mmcount module
    resolves: #1030206
  - add a patch to support arbitrary number of listeners in imuxsock
    resolves: #1096732
  - remove clean section
    resolves: #869600
  - add a list of bugs fixed by rebasing to 7.4.10
    resolves: #996857, #1007409, #1029910, #1061614, #1070689


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-4.b13
changelog:
  - Fix signedness build failure in shenandoahHeapRegion.cpp (upstream patch from mvala)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b15-0
changelog:
  - Move to single OpenJDK tarball build, based on aarch64/shenandoah-jdk8u.
  - Update to aarch64-shenandoah-jdk8u181-b15.
  - Drop 8165489-pr3589.patch which was only applied to aarch64/jdk8u builds.
  - Move buildver to where it should be in the OpenJDK version.
  - Split ppc64 Shenandoah fix into separate patch file with its own bug ID (PR3620).
  - Update pr3539-rh1548475.patch to apply after 8187045.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181.b16-0
changelog:
  - Update to aarch64-shenandoah-jdk8u181-b16.
  - Drop PR3619 & PR3620 Shenandoah patches which should now be fixed upstream.
  - Drop Shenandoah signedness fix as it appears in the new upstream tarball.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-22
changelog:
  - RHEL-6.8 erratum
    - fixed potential getcwd failure, resulting in Null pointer exception 
    Resolves: rhbz#1284886


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-23
changelog:
  - RHEL-6.8 erratum
    - fixed handling of closefrom_override defaults option
    Resolves: rhbz#1309976


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-24
changelog:
  - RHEL-6.8 erratum
    - fixed a bug causing that non-root users can list privileges of
      other users
    Resolves: rhbz#1312481


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-25
changelog:
  - RHEL-6.9 erratum
    - Fix "sudo -l command" in the LDAP and SSS backends when the command
      is not allowed.
    Resolves: rhbz#1374410
    - Fix sudo log file wrong group ownership
    Resolves: rhbz#1330001
    - Fix sudo parsing sudoers with user's locale
    Resolves: rhbz#1318374


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-26
changelog:
  - RHEL-6.9 erratum
    - Fix race condition when creating /var/log/sudo-io direcotry
    Resolves: rhbz#1365156


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-41.el6
changelog:
  - ipasam does not support deleting multiple child trusted domains due
    to LDAP delete operation (#1110664)
  - Excessive LDAP calls by ipa-sam during file operations to samba file
    share on freeipa master cause high CPU and slow performance (#1074314)


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-42.el6
changelog:
  - Require 389-ds-base >= 1.2.11.15-38 to fix roken dereference control with
    the FreeIPA 4.0 ACIs (#1112698)


author: Petr Vobornik <pvoborni@redhat.com> - 3.0.0-43.el6
changelog:
  - Release 3.0.0-43
  - Resolves: #1191040 - ipa-client-automount: failing with error LDAP server
                         returned UNWILLING_TO_PERFORM. This likely means that
                         minssf is enabled.
  - Resolves: #1185207 - ipa-client dont end new line character in
                         /etc/nsswitch.conf
  - Resolves: #1166241 - CVE-2010-5312 CVE-2012-6662 ipa: various flaws
  - Resolves: #1161722 - IDM client registration failure in a high load
                         environment
  - Resolves: #1154687 - POODLE: force using safe ciphers (non-SSLv3) in IPA
                         client and server
  - Resolves: #1146870 - ipa-client-install fails with "KerbTransport instance
                         has no attribute '__conn'" traceback
  - Resolves: #1132261 - ipa-client-install failing produces a traceback
                         instead of useful error message
  - Resolves: #1131571 - Do not allow IdM server/replica/client installation
                         in a FIPS-140 mode
  - Resolves: #1198160 - /usr/sbin/ipa-server-install --uninstall does not
                         clean /var/lib/ipa/pki-ca
  - Resolves: #1198339 - ipa-client-install adds extra sss to sudoers in
                         nsswitch.conf
  - Require: 389-ds-base >= 1.2.11.15-51
  - Require: mod_nss >= 1.0.10
  - Require: pki-ca >= 9.0.3-40
  - Require: python-nss >= 0.16


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-47.el6.1
changelog:
  - Resolves: #1280207 Unable to resolve group memberships for AD users when
    using sssd-1.12.2-58.el7_1.6.x86_64 client in combination with
    ipa-server-3.0.0-42.el6.x86_64 with AD Trust
    - Do not lookup up the domain too early if only the SID is known
    - Do not store SID string in a local buffer
    - Allow ID-to-SID mappings in the extdom plugin
  - Resolves: #1280208 ipa-server-install with externally signed CA fails with
    NSS error (SEC_ERROR_BUSY)
    - Free NSS objects in --external-ca scenario


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-8
changelog:
  - Fix bad dates in changelog
    Resolves: rhbz#1038670
  - Fix crash on migration during reboot
    Resolves: rhbz#1004443
  - Use TLS 1.0 or better
    Resolves: rhbz#1035695


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-9
changelog:
  - Fix potential infinite loop on long running VMs (> 46 days)
    Resolves: rhbz#1072700
  - Fix assertion in video streaming code
    Resolves: rhbz#1086820


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-12
changelog:
  - Fix spicevmc-related crash which could be triggered with older clients
    Resolves: rhbz#1163480
  - Fix crash when using VNC + QXL + rhel-6.0.0 machine type
    Resolves: rhbz#1135372


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-12.1
changelog:
  - Avoid race conditions reading monitor configs from guest. This race could
    trigger memory corruption host-side
    Resolves: rhbz#1239124


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-13
changelog:
  - Fix " qemu-kvm: spicevmc.c:324: spicevmc_red_channel_alloc_msg_rcv_buf:
    Assertion `!state->recv_from_client_buf' failed." assertion during migration
    Resolves: rhbz#1264113


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-13.1
changelog:
  - Fix heap-based memory corruption within smartcard handling
    Resolves: CVE-2016-0749
  - Fix host memory access from guest with invalid primary surface parameters
    Resolves: CVE-2016-2150


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.9-1
changelog:
  - New upstream release 1.1.9
  - Required for Samba 4 Beta 5
  - Ensure rename target does not exist before deleting old record
  - Add parameter to avoid NULL format string flagged by -Werror=format


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.13-3
changelog:
  - use the proper %patch stanza to make rpmdiff happy
  - related: rhbz#873422 - LDB 1.1.13 exports improper ABI


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.13-3.1
changelog:
  - Resolves: rhbz#1290712 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.2.z]
  - Remove the patch from the previous commit, it doesn't fix a remotely
    eploitable issue. Add patches from upstream #11636 instead.


author: Doug Ledford <dledford@redhat.com> - 3.10-2
changelog:
  - Somehow during editing I accidentally deleted a single character from
    the post scriptlet.  rpmdiff caught it, now I'm fixing it.
  - Resolves: bz990288


author: Doug Ledford <dledford@redhat.com> - 6.6_3.15-1
changelog:
  - Change numbering scheme to be clearer: first number is redhat
    release this package is for (aka rhel6.6), second number is the
    upstream kernel that our kernel code comes from, aka 3.15.
  - Minor fix to init script to support cxgb4 and ocrdma and mlx5
    drivers properly
  - Add a dracut module to make sure all the needed InfiniBand
    kernel modules and support files make it on to the initrd
  - Resolves: 1064308


author: Doug Ledford <dledford@redhat.com> - 6.7_3.15-2
changelog:
  - Fix ipoib MTU issue
  - Fix shutdown ordering of NFSoRDMA code
  - Absorb mlx4/cxgb3/cxgb4 setup/module init code into our package
  - Resolves: bz1186498, bz1163527


author: Doug Ledford <dledford@redhat.com> - 6.7_3.15-4
changelog:
  - Fix modprobe file so command line opts passed to modprobe mlx4_core will
    work again
  - Resolves: bz1215857


author: Paul Howarth <paul@city-fan.org> - 1.26-1
changelog:
  - Update to 1.26 (verify_hostname_of_cert matched only the prefix for the
    hostname when no wildcard was given, e.g. www.example.org matched against a
    certificate with name www.exam in it [#509819])


author: Paul Howarth <paul@city-fan.org> - 1.27-1
changelog:
  - Update to 1.27
    - various regex fixes for i18n and service names
    - fix warnings from perl -w (CPAN RT#48131)
    - improve handling of errors from Net::ssl_write_all


author: Paul Howarth <paul@city-fan.org> - 1.30-1
changelog:
  - Update to 1.30 (fix memleak when SSL handshake failed)
  - Add buildreq procps needed for memleak test


author: Ville Skyttä <ville.skytta at iki.fi> - 0.2.8.4-18
changelog:
  - Split libwmflite (WMF parser) into -lite subpackage (#432651).
  - Build with dependency tracking disabled.
  - Convert docs to UTF-8.


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-3
changelog:
  - drop the S390 build workaround as it is no longer needed
  - additional spec file cleanups for merge review (#226008)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-5
changelog:
  - use /dev/urandom for seeding in the FIPS mode
  - make the tests to pass in the FIPS mode also fixing
    the FIPS-186-3 DSA keygen


author: Roland Mainz <roland.mainz@nrubsig.org> 1.10.3-34
changelog:
  - Backport of krb1.12 localauth plugin support
    See krb5-1.10-localauth_backport.patch for porting comments.


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-36
changelog:
  - Backported krbdev #7996 ("Simplify and improve ksu cred
    verification"; cherry-picked from upstream
    bbfe19f03bdeca7b05b542dbae4c1692c9800c70) to fix RH bug
      less than 5 mins"): When verifying the user's initial
    credentials, don't compute a server name and preemptively
    obtain creds for it. This change allows
    |krb5_verify_init_creds()| to use any host key in the
    keytab, and not just the one for the canonicalized local
    hostname.


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-37
changelog:
  - Backported krb5-1.12.2 changes for |getclhoststr()|
    to fix RH bug #1154130 ("kadmind (Error): iprop_full_resync_1:
    getclhoststr failed").


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-38
changelog:
  - Backported krbdev #7868 ("Use preauth options when changing
    password") from krb-1.13 to fix RH bug #1075656 ("krb5
    client ignores FAST settings for changepw requests"):
    If we try to change the password in
    |rb5_get_init_creds_password()|, we must use all
    application-specified gic options which affect
    preauthentication when getting the kadmin/changepw ticket.
    Create a helper function |make_chpw_options()| which copies
    the application's options, unsets the options we don't want,
    and sets options appropriate for a temporary ticket.


author: - Roland Mainz <rmainz@redhat.com> - 1.10.3-39
changelog:
  - Backout patch #137 for krbdev #7996 ("Simplify and improve
    ksu cred verification" - see 1.10.3-36) for now until we
    figure out how to get this working.


author: Roland Mainz <rmainz@redhat.com> - 1.10.3-42
changelog:
  - fix for RH bug #1210704 ("Remove stray include in krb5's
    localauth_plugin.h"). This unnecessary #include statement
    was causing build failures on some systems by making libkrb5
    sources depend on gssapi.h (and as result to libcom_err,
    too).


author: Robbie Harwood <rharwood@redhat.com> - 1.10.3-42z1
changelog:
  - Fix CVE-2015-8629 and CVE-2015-8631
  - Also fix a spec trigger issue that prevents building
  - Resolves: #1306973


author: Nikola Forró <nforro@redhat.com> - 3.9.4-19
changelog:
  - Add patches for CVEs:
  - CVE-2016-9533 CVE-2016-9534 CVE-2016-9535
  - CVE-2016-9536 CVE-2016-9537 CVE-2016-9540
  - CVE-2016-5652
  - Resolves: #1412078


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.8-1
changelog:
  - New upstream release 1.1.8
  - Required for latest Samba 4 beta
  - Fixes for pyldb
  - Revert to using tdb1 by default
  - Drop support for tdb_compat
  - CCAN is no longer built as a static library


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.2.el6]
changelog:
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.3.el6]
changelog:
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.4.el6]
changelog:
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.5.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-85
changelog:
  - Release 1.2.11.15-85
  - Resolves: #1393007 - ds9 backport 47411 - Replace substring search with plain search in referint plugin (DS 47411)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-38
changelog:
  - refresh expired cookie in test172 from upstream test-suite (#1069271)
  - fix a memory leak caused by write after close (#1078562)
  - nss: implement non-blocking SSL handshake (#1083742)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-40
changelog:
  - fix re-use of wrong HTTP NTLM connection (CVE-2014-0015)
  - fix connection re-use when using different log-in credentials (CVE-2014-0138)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.35-1.13.7.0
changelog:
  - Update to IcedTea 1.13.7
  - Regenerate add-final-location-rpaths patch so as to be less disruptive.
  - Resolves: rhbz#1209066


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.2
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271927


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271927


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271927


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-17
changelog:
  - Backport of a more minimal dependency patch to avoid changes to AD
    provider behaviour
  - Related: rhbz#1264705 - Allow SSSD to notify user of denial due to AD
                            account lockout


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-18
changelog:
  - Resolves: rhbz#1209600 - Getting ERROR (getpwnam() failed): Broken pipe
                             with 1.11.6


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-3.el6_7.2
changelog:
  - Fix alloc segfault when extending LV with fewer stripes than in first seg.
  - Fix regression in cache causing some PVs to bypass filters (2.02.105).


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-2
changelog:
  - Revert the version not to be rebased.
  - Fix bug 608988 - Cannot de-select Hanja lock in applet menu
    Resolves: #608988


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-4
changelog:
  - Resolves: #651915 Wrong window position with ibus-x11
    Added ibus-651915-x11-position.patch
  - Resolves: #633330 Fixed kn.po
  - Resolves: #635541 Fixed gu.po
    Added ibus-1.3.4-po-2010-11-17.tar.bz2


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-6
changelog:
  - Fixed Bug 667031 - ibus requires dbus-x11
  - Fixed Bug 670137 - QT_IM_MODULE=xim in ibus.conf without ibus-qt


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-10
changelog:
  - Resolves: Bug 1403077 - Support second monitor in ZaphodHeads
    Added ibus-1403077-zaphodheads-x11.patch to get x11 screen number
    Added ibus-1403077-zaphodheads.patch


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - Update to u77b03.
  - Drop 8146566 which is applied upstream.
  - Replace s390 Java options patch with general version from IcedTea.
  - Apply s390 patches unconditionally to avoid arch-specific patch failures.
  - Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
  - Remove aarch64-specific suffix as update/build version are now the same as for other archs.
  - Only use z format specifier on s390, not s390x.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Correct spelling mistakes in tarball generation script.
  - Synchronise minor changes from Fedora.
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - Remove patches to generated configure script, which we re-generate anyway.
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - RHEL 6 adds -fasynchronous-unwind-tables which leads to libjvm.so being too big on x86
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-1.b03
changelog:
  - Revert previous change to CFLAGS/LDFLAGS as issue is not us, but rhbz#1320961
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-2.b03
changelog:
  - Avoid WithSeed versions of NSS functions as they do not fully process the seed
  - Resolves: rhbz#1320662


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.91-1.b14
changelog:
  - Use basename of test file to avoid misinterpretation of full path as a package
  - Resolves: rhbz#1325421


author: Steve Dickson <steved@redhat.com> 0.2.1-7
changelog:
  - Fixed some races in getnetconfig code (bz 1031498)
  - Remove the installation of libtirpc.a and libtirpc.la (bz 869397)


author: Steve Dickson <steved@redhat.com> 0.2.1-11
changelog:
  - Backported upstream debugging (bz 1273158)
  - Fixed memory leak in svc_vc_create (bz 1276687)
  - Fixed memory leak in svc_tli_create (bz 1276855)
  - Fixed memory leak in __svc_vc_dodestroy (bz 1276856)


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.2.el6]
changelog:
  - x86/speculation: Provide SRBDS late microcode loading support (Waiman Long)
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.3
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength
  - replace expired testing certificates


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.4
changelog:
  - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher
  - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-82
changelog:
  - Release 1.2.11.15-82
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 48983)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-83
changelog:
  - Release 1.2.11.15-83
  - Resolves: #1327065 - After updating server, component nss-3.21.0-0.3.el6_7.x86_64, some client applications cannot connect to server (DS 48798)
  - Resolves: #1266920 - invalid message about write_changelog_and_ruv on consumers (DS 47801)
  - Resolves: #1330758 - add a nsTLS1.0 on or off new configuration parameter to cn=encryption,cn=config in RHEL 6 389-ds-base (DS 48816)
  - Resolves: #1369572 - cleanallruv changelog cleaning incorrectly impacts all backends (DS 48964)
  - Resolves: #1371706 - Server Side Sorting crashes the server. (DS 48970)
  - Resolves: #1371678 - Disabling CLEAR password storage scheme will crash server when setting a password (DS 48975)
  - Resolves: #1370145 - cannot reindex retrochangelog (DS 47619)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-84
changelog:
  - Release 1.2.11.15-84
  - Resolves: #1352109 - Replication stops working only when fips mode is set to true  (DS 48909)
  - Resolves: #1372420 - DES to AES backport issues (DS 47462)
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 48983)
  - Resolves: #1382386 - Directory Server accepts a wrong userdn macro ACI (DS 449)
  - Resolves: #1382519 - 1.2.11 only -- coverity fixes (DS 49004)
  - Resolves: #1387022 - specific search with sizelimit=1 sometimes returns no entry (DS 47703)
  - Resolves: #1387772 - trace args debug logging must be more restrictive (DS 49009)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-85
changelog:
  - Release 1.2.11.15-85
  - Resolves: #1372420 - DES to AES backport issues (DS 47462)
  - Resolves: #1391324 - ds9 backport 47411 - Replace substring search with plain search in referint plugin (DS 47411)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-86
changelog:
  - Release 1.2.11.15-86
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 49049)
  - Resolves: #1400997 - ldif2db.pl script shows wrong usage for -n as instance, instead of database (DS 49070)
  - Resolves: #1403754 - ns-slapd crashes during tickets/ticket48665_test.py (DS 48665)
  - Resolves: #1410645 - The "repl-monitor" web page does not display "year" in date. (DS 48220)
  - Resolves: #1399600 - ns-slapd segfaults during execution of tickets/ticket47966_test.py (DS 47966, DS 48987)
  - Resolves: #1402012 - Importing big ldif file with duplicate DNs throwing "unable to flush" error
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-87
changelog:
  - Release 1.2.11.15-87
  - Resolves: #1391701 - do not treat missing csn as fatal (DS 49020)
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-88
changelog:
  - Release 1.2.11.15-88
  - Resolves: #1413692 - custom schema is registered in small caps after schema reload (DS 47973)
  - Resolves: #1408976 - dbscan-bin crashing due to a segmentation fault. (DS 49104)


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-89
changelog:
  - Release 1.2.11.15-89
  - Resolves: #1421512 - ns-slapd crashes in ldif_sput due to the output buf size is less than the real size.


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-90
changelog:
  - Release 1.2.11.15-90
  - Resovles: #1435365 - Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.1.11.15-91
changelog:
  - Release 1.2.11.15-91
  - Resolves: bug 1437777 - EMBARGOED CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-47.1
changelog:
  - mod_proxy: fix regression caused inherited workers to use a different
    scoreboard slot then the original one (#1252574)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-39
changelog:
  - Fix crash when saving a domain with type none dac label (rhbz#1108590)
  - Initialize threading & error layer in LXC controller (rhbz#1109120)


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-286
changelog:
  - arping running as netutils_t sys_module capability for removing tap devices. Dontaudit this access.
  - Allow hv_vss_daemon to write access on all mount point directories to make VSS live backup if working if there is home partition.
  - Add support for squid to be able to create temoporary files. 
  Resolves:#1291164
  - Allow usbhid-ups to access /proc/bus/usb to have it working on ppc64 machines. 
  Resolves:#1290693
  - Add support for /var/run/chronyd.sock. 
  Resolves:#1290310
  - Update apache_content_template() inteface to allow "shutdown" permissions for apache scripts on unix_stream_socket. 
  Resolves:#1286052
  - Fix label for /var/lib/graphite-web 
  Resolves:#1221934
  - Dontaudit rpm write access for prelink_mask_t Resolves:#1216907
  - Allow apcupsd_t to communicate with sssd Add default label for /var/lock/subsys/apcupsd and /var/lock/LCK.
  Resolves:#1286030
  - Allow shorewall_t to create netlink_socket 
  Resolves:#1290705


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-287
changelog:
  - Allow sssd-ifp to dbus chat with all users. 
  Resolves:#1296693
  - Allow keepalived to connect to 3306/tcp port - mysqld_port_t.
  Resolves:#1296854
  - Add support for stunnel custom log files, allow transition and label /log/stunnel* log files. 
  Resolves:#1296238
  - Provide conman_unconfined_script_exec_t/conman_unconfined_script_t SELinux types used for conman scripts.
  - Resolves:#1290565
  - Allow ctdbd trasition to smbcontrol_t when "ctdb disablescript 50.samba" is executed.
  - Resolves:#1293787
  - Label ctdbd event scripts as ctdbd_exec_t instead of bin_t. 
  Resolves:#1293787
  - Allow watchdog to read localization files. It wants to access localtime. 
  Resolves:#1267974
  - Backport rules allowing sssd_t to be able to request the kernel to load a module.
  Resolves:#1246634


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-288
changelog:
  - Allow netutils_t domain to chown capability.
  Resolves:#1298514
  - Allow all jabber domain to access SSL certs.
  Resolves:#1261145
  - Allow shorewall request kernel load module
  Resolves:#1290705
  - Allow passwd to create temporary files to support ssh logins if gnome-keyring-daemon is called by passwd and runs in passwd_t.
  Resolves:#1131531
  - Allow stunnel to write log outputs on users pty.
  Resolves:#1296238
  - Allow polkit-1/actions to get attributes for all filesytems.
  Resolves:#1301561
  - Allow p11-child to connect to apache ports. Allow p11-child  to manage authentication cache.


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  Related: #1326621


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.1
changelog:
  - Allow ipc_lock capability for glusterd.
  - GlusterFS volumes of RDMA transport proceed fuse mount and requires ipc_lock capability.
  Resolves: #1388582


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.2
changelog:
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1393267
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs
  Resolves: rhbz#1393253


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.3
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1409482


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-53.P1.3
changelog:
  - Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow

  <* Wed Feb 28 2018 Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-53.P1.2
  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.0
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938 (ttable_match_7) and PR2939 (fontpath)) applied upstream.
  - Resolves: rhbz#1350039


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350039


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.0
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Resolves: rhbz#1410612


author: Dan Horák <dan@danny.cz> - 1.28-1
changelog:
  - update to version 1.28
  - added fixes from RHEL to rescan-scsi-bus.sh
  - added scsi-rescan symlink to the rescan-scsi-bus.sh script


author: Dan Horák <dan@danny.cz> - 1.28-2
changelog:
  - include rescan-scsi-bus script 1.35
  - rebase patches and add fix for issue mentioned in #538787
  - Related: #538787


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-105
changelog:
  - Fix ControlPersist option with ProxyCommand (#1160487)
  - Backport fix of ssh-keygen with error : gethostname: File name too long (#1161454)
  - Backport show remote address instead of UNKNOWN after timeout at password prompt (#1161449)
  - Fix printing of extensions in v01 certificates (#1093869)
  - Fix confusing audit trail for unsuccessful logins (#1127312)
  - Don't close fds for internal sftp sessions (#1085710)
  - Fix config parsing quotes (backport) (#1134938)
  - Enable logging in chroot into separate file (#1172224)
  - Fix auditing when using combination of ForcedCommand and PTY (#1131585)
  - Fix ssh-copy-id on non-sh remote shells (#1135521)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-106
changelog:
  - Add missing ControlPersist option to man ssh (#1197763)
  - Add sftp option to force mode of created files (#1191055)
  - Do not load RSA1 keys in FIPS mode (#1197072)
  - Add missing support for ECDSA in ssh-keyscan (#1196331)
  - Fix coverity/gcc issues (#1196063)
  - Backport wildcard functionality for PermitOpen in sshd_config file (#1159055)
  - Ability to specify an arbitrary LDAP filter in ldap.conf (#1119506)


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.19.1.el6]
changelog:
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1732107]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1728931]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.20.1.el6]
changelog:
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.2.el6]
changelog:
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.14.2.el6]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.471.el6
changelog:
  - kvm-aio-switch-aiocb_size-type-int-size_t.patch [bz#1069519]
  - kvm-aio-use-g_slice_alloc-for-AIOCB-pooling.patch [bz#1069519]
  - kvm-aio-rename-AIOPool-to-AIOCBInfo.patch [bz#1069519]
  - kvm-ide-ahci-Check-for-ECANCELED-in-aio-callbacks.patch [bz#1069519]
  - kvm-block-Add-refcnt-in-BlockDriverAIOCB.patch [bz#1069519]
  - kvm-block-Add-bdrv_aio_cancel_async.patch [bz#1069519]
  - kvm-block-Drop-bdrv_em_co_aiocb_info.cancel.patch [bz#1069519]
  - kvm-block-Drop-bdrv_em_aiocb_info.cancel.patch [bz#1069519]
  - kvm-posix-aio-Remove-raw_aiocb_info.cancel.patch [bz#1069519]
  - kvm-linux-aio-Convert-laio_aiocb_info.cancel-to-.cancel_.patch [bz#1069519]
  - kvm-dma-Convert-dma_aiocb_info.cancel-to-.cancel_async.patch [bz#1069519]
  - kvm-blkdebug-Drop-blkdebug_aiocb_info.cancel.patch [bz#1069519]
  - kvm-curl-Drop-curl_aiocb_info.cancel.patch [bz#1069519]
  - kvm-qed-Drop-qed_aiocb_info.cancel.patch [bz#1069519]
  - kvm-rbd-Drop-rbd_aiocb_info.cancel.patch [bz#1069519]
  - kvm-vdi-Drop-vdi_aio_cancel.cancel.patch [bz#1069519]
  - kvm-gluster-Drop-gluster_aiocb_info.cancel.patch [bz#1069519]
  - kvm-block-Drop-AIOCBInfo.cancel.patch [bz#1069519]
  - kvm-block-Rename-qemu_aio_release-qemu_aio_unref.patch [bz#1069519]
  - kvm-scsi-Drop-scsi_req_abort.patch [bz#1069519]
  - kvm-scsi-generic-Handle-canceled-request-in-scsi_command.patch [bz#1069519]
  - kvm-scsi-Unify-request-unref-in-scsi_req_cancel.patch [bz#1069519]
  - kvm-scsi-Drop-SCSIReqOps.cancel_io.patch [bz#1069519]
  - kvm-scsi-Introduce-scsi_req_cancel_complete.patch [bz#1069519]
  - kvm-scsi-Introduce-scsi_req_cancel_async.patch [bz#1069519]
  - kvm-virtio-scsi-Handle-TMF-request-cancellation-asynchro.patch [bz#1069519]
  - kvm-scsi-fix-cancellation-when-I-O-was-completed-but-DMA.patch [bz#1069519]
  - kvm-block-Fix-bdrv_aio_co_cancel_em-RHEL-only.patch [bz#1069519]
  - kvm-qcow2-Zero-write-support.patch [bz#1130014]
  - Resolves: bz#1069519
    ([FJ6.5 Bug] A KVM guest hangs up for about 30 seconds after issuing SG_IO ioctl to a virtio-scsi device.)
  - Resolves: bz#1130014
    (test case 033 and 034 of qemu-iotests fail for vmdk)


author: Robert Kuska <rkuska@redhat.com> - 2.6.6-59
changelog:
  - Let ConfigParse handle options without values
  - Add check phase to specfile, fix and skip relevant failing tests
  Resolves: rhbz#1031709


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-63
changelog:
  - Since -libs now provide python-ordered dict, added ordereddict
    dist-info to site-packages
  Resolves: rhbz#1199997


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346355


author: Harald Hoyer <harald@redhat.com> 147-2.65
changelog:
  - 80-drivers.rules: only make an exception for ipmi for
                      modprobe with DRIVER set
  Resolves: rhbz#1268251


author: Michal Sekletar <msekleta@redhat.com> - 147-2.66
changelog:
  - prevent creation of duplicate udev rules by write_net_rules helper (#652499)
  - fix memory leak in scsi_id (#891669)
  - introduce SECLABEL{selinux} for setting explicit SELinux labels on device nodes (#1015300)
  - for ATA disks udev will now also create by-id/wwn-* symlinks when appropriate (#1220617)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.485.el6
changelog:
  - kvm-Change-fsfreeze-hook-default-location.patch [bz#1213233]
  - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1290743]
  - Resolves: bz#1213233
    ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1290743
    (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.486.el6
changelog:
  - kvm-blockdev-Error-out-on-negative-throttling-option-val.patch [bz#1294619]
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298046]
  - Resolves: bz#1294619
    (Guest should failed to boot if set iops,bps to negative number)
  - Resolves: bz#1298046
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-6.8])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.487.el6
changelog:
  - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249740]
  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249740]
  - Resolves: bz#1249740
    (Segfault occurred at Dst VM while completed migration upon ENOSPC)


author: Miroslav Rezanina <mrezanin@redhat.com - 0.12.1.2-2.488.el6
changelog:
  - Fixed qemu-ga path configuration [bz#1213233]
  - Resolves: bz#1213233
    ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.4
changelog:
  - kvm-target-i386-Sanitize-the-XSAVE-related-feature-bits.patch [bz#1673779]
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1689790]
  - Resolves: bz#1673779
    (RHEL8 VM's do not install on RHEL6 KVM hypervisor)
  - Resolves: bz#1689790
    (CVE-2019-9824 qemu-kvm: QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.5
changelog:
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669066]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669066]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669066]
  - kvm-qxl-check-release-info-object.patch [bz#1712728]
  - kvm-net-Use-iov-helper-functions.patch [bz#1636415]
  - kvm-net-increase-buffer-size-to-accommodate-Jumbo-frame-.patch [bz#1636415]
  - kvm-net-ignore-packet-size-greater-than-INT_MAX.patch [bz#1636415]
  - kvm-net-drop-too-large-packet-early.patch [bz#1636415]
  - kvm-PATCH-slirp-fix-buffer-overrun.patch [bz#1586251]
  - kvm-Fix-build-from-previous-commit.patch [bz#1586251]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586251]
  - kvm-slirp-Convert-mbufs-to-use-g_malloc-and-g_free.patch [bz#1586251]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586251]
  - kvm-pcnet-fix-possible-buffer-overflow.patch [bz#1636774]
  - Resolves: bz#1586251
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-6.10.z])
  - Resolves: bz#1636415
    (CVE-2018-10839 qemu-kvm: Qemu: ne2000: integer overflow leads to buffer overflow issue [rhel-6])
  - Resolves: bz#1636774
    (CVE-2018-17962 qemu-kvm: Qemu: pcnet: integer overflow leads to buffer overflow [rhel-6])
  - Resolves: bz#1669066
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-6.10.z])
  - Resolves: bz#1712728
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-6])


author: Victor Toso <victortoso@redhat.com> - 0.12.4-15
changelog:
  - Avoid spice assertion when changing sized stream
    Resolves: rhbz#1274575
  - Make red_client_{ref,unref} thread safe to avoid crash
    Resolves: rhbz#1361946


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-16
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-16.2
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-301
changelog:
  - Allow hald_t to read nvme devices.
  Resolves: rhbz#1389982
  - Allow ftpdctl_t domain to manage own sockets
  Resolves: rhbz#1392525


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-302
changelog:
  - Label /var/lock/kdump as kdump_lock_t.
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-303
changelog:
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565
  - Allow guest-set-user-passwd to set users password
  Resolves: rhbz#1369699


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-304
changelog:
  - Allow _java_t domain to read systemd state.
  Resolves:rhbz#1393938
  - Allow kdumpgui to read/write to nvme filesystem.
  Resolves:rhbz#1323293


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-305
changelog:
  - Fix typo bug sepgsql_contexts file
  Resolves: rhbz#1397703
  - Allow sssd_t domain to manage samba files and dirs.
  Resolves: rhbz#1395403
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1397117
  - Allow consolekit_t domain to manage consolekit_log_t dirs
  Resolves: rhbz#1397802


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-306
changelog:
  - Allow hostname_t domain to manage cluster_tmp_t files
  Resolves: rhbz#1400234
  - Allow ipsec_mgmt_t domain use nsswitch
  Resolves:rhbz#1401611
  - Allow conman_t domain to list conman_uconfined_script_exec_t dirs.
  Resolves:rhbz#1397117


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-307
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1404152
  - Label /usr/bin/puppet* binaries as puppet_exec_t
  Resolves: rhbz#1386181


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-307.1
changelog:
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  Resolves: rhbz#1462824
  - Disable mysqld_safe_t secure mode environment cleansing.
  Resolves: rhbz#1464145


author: Ade Lee <alee@redhat.com> 9.0.3-48
changelog:
  - Resolves #1306989 - Crash seen with pki-common pkg during IPA server install
  - Resolves #1290535 - Check for incompatible Java at startup
  - Resolves #1313207 - ca.subsystem.certreq missing from CS.cfg


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.1
changelog:
  - Require softokn build 22 to ensure runtime compatibility.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.17-35.el6_8.1
changelog:
  - fix regression with 'jobs' builtin output not going to stdout (bug #1357127)
  - fix several regressions in tcsh-6.17.00-quote-backslashes-properly.patch (bug #1357126)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-57
changelog:
  - vmx: Relax virtualHW.version check (rhbz#1300574)
  - qemu: snapshot: Don't leak XML definition and forget to unlock job (rhbz#1305793)
  - qemu: Fix formatting flags in qemuDomainSaveImageOpen (rhbz#1307094)
  - network: Resolve some issues around vlan copying (rhbz#1300843)
  - network: fix connections count in case of allocate failure (rhbz#1300843)
  - network: consolidate connection count updates for device pool (rhbz#1300843)
  - network: consolidated info log for all network allocate/free operations (rhbz#1300843)
  - util: increase libnl buffer size (rhbz#1276478)
  - util: reduce debug log in virPCIGetVirtualFunctions() (rhbz#1276478)
  - util: improve error reporting in virNetDevVPortProfileGetStatus (rhbz#1276478)
  - util: add missing newline (rhbz#1276478)
  - util: eliminate bogus error log in virNetDevVPortProfileGetStatus (rhbz#1276478)
  - util: clean up and expand 802.1QbX negotiation logging (rhbz#1276478)
  - util: report the MAC address that couldn't be set (rhbz#1276478)
  - util: reset MAC address of macvtap passthrough physdev after disassociate (rhbz#1276478)
  - bitmap: add way to find next clear bit (rhbz#1276478)
  - Introduce virBitmapIsBitSet (rhbz#1276478)
  - util: Introduce flags field for macvtap creation (rhbz#1276478)
  - virnetdevmacvlan.c: Introduce mutex for macvlan creation (rhbz#1276478)
  - util: keep/use a bitmap of in-use macvtap devices (rhbz#1276478)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-61
changelog:
  - virsh: Properly display block job type (rhbz#1326653)
  - spec: proper soft static allocation of qemu uid (rhbz#1351792)
  - Revert "qemu: snapshot: Fix modification of vm object without job" (rhbz#1326652)
  - qemu: snapshot: Fix job handling when creating snapshots (rhbz#1326652)
  - tls: remove support for gnutls 1.x.x, require 2.2.0 (rhbz#1333415)
  - configure: allow setting default TLS priority string (rhbz#1333415)
  - rpc: allow priority string to be passed to TLS context (rhbz#1333415)
  - libvirtd: add config option for TLS priority (rhbz#1333415)
  - remote: allow TLS protocol/cipher priority override in URI (rhbz#1333415)
  - Pass config file object through to driver open methods (rhbz#1333415)
  - remote: allow TLS priority to be customized (rhbz#1333415)
  - qemu: -numa doesn't (yet) support disjoint range (rhbz#1310122)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62
changelog:
  - qemu: fix return value of qemuDomainBlockPivot on errors (rhbz#1300159)
  - qemu: Fix virsh freeze when blockcopy storage file is removed (rhbz#1300159)
  - migration: add support for migrateURI configuration (rhbz#1347389)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62.el6_9.1
changelog:
  - util: Implement virFileReadHeaderFD (CVE-2017-5715)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-63
changelog:
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64
changelog:
  - cpu: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64.el6_10.1
changelog:
  - cpu_x86: Do not cache microcode version (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)


author: Andreas Schneider <asn@redhat.com> - 4.0.0-67.rc4
changelog:
  - resolves: #1290709 - CVE-2015-7540
  - related: #1290709 - CVE-2015-5299
  - related: #1290709 - CVE-2015-5296
  - related: #1290709 - CVE-2015-5252
  - related: #1290709 - CVE-2015-5330


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Rebase to NSS 3.36.0 BETA
  - Remove upstreamed nss-is-token-present-race.patch
  - Revert the upstream changes that default to sql database


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Use the correct tarball of NSS 3.36 release
  - Ignore EncryptDeriveTest which only works with newer nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-5
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-9
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Pavel Alexeev <Pahan@Hubbitus.info> - 6.5.4.7-3
changelog:
  - Update to version 6.5.4-7
  - Use lzma-compressed source tarball as sugested by Ville Skyttä (BZ#515319)


author: Olivier Fourdan <ofourdan@redhat.com> - 6.5.4.7-6
changelog:
  - Add fix for CVE-2010-4167
  - Add fix for CVE-2012-0247 CVE-2012-0248 CVE-2012-1185 CVE-2012-1186
  - Add fix for CVE-2012-0259 CVE-2012-0260 CVE-2012-1798


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.16
changelog:
  - Revert more strict model check code, as it requires request_firmware-based
    microcode loading mechanism and breaks enabling of microcode with caveats.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.18
changelog:
  - Intel CPU microcode update to 20191112, addresses CVE-2017-5715,
    CVE-2019-0117, CVE-2019-11135, CVE-2019-11139 (#1764049, #1764062, #1764953,
      - Addition of 06-a6-00/0x80 (CML-U 6+2 A0) microcode at revision 0xc6;
    - Addition of 06-66-03/0x80 (CNL-U D0) microcode at revision 0x2a;
    - Addition of 06-55-03/0x97 (SKL-SP B1) microcode at revision 0x1000150;
    - Addition of 06-7e-05/0x80 (ICL-U/Y D1) microcode at revision 0x46;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xcc to 0xd4;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) microcode from revision 0xcc
      to 0xd4
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (AML-Y V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (CML-U 4+2 V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (WHL-U V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-G/X H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-H/S/Xeon E3 B0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xb8 to 0xc6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.20
changelog:
  - Package the publicy available microcode-20191112 release (#1755021):
    - Addition of 06-4d-08/0x1 (AVN B0/C0) microcode at revision 0x12d;
    - Addition of 06-55-06/0xbf (CSL-SP B0) microcode at revision 0x400002c;
    - Addition of 06-7a-08/0x1 (GLK R0) microcode at revision 0x16;
    - Update of 06-55-03/0x97 (SKL-SP B1) microcode from revision 0x1000150
      up to 0x1000151;
    - Update of 06-55-04/0xb7 (SKL-SP H0/M0/U0, SKL-D M1) microcode from revision
      0x2000064 up to 0x2000065;
    - Update of 06-55-07/0xbf (CSL-SP B1) microcode from revision 0x500002b
      up to 0x500002c;
    - Update of 06-7a-01/0x1 (GLK B0) microcode from revision 0x2e up to 0x32;
  - Include 06-9e-0c (CFL-H/S P0) microcode from the microcode-20190918 release.
  - Correct the releasenote file (0001-releasenote-changes-summary-fixes.patch).
  - Update README.caveats with the link to the new Knowledge Base article.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.21
changelog:
  - Update Intel CPU microcode to microcode-20191113 release:
    - Update of 06-9e-0c (CFL-H/S P0) microcode from revision 0xae up to 0xc6.
  - Drop 0001-releasenote-changes-summary-fixes.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.22
changelog:
  - Update Intel CPU microcode to microcode-20191115 release:
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4
      up to 0xd6;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision
      0xc6 up to 0xca;
    - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6
      up to 0xca;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0b/0x02 (CFL-S B0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0c/0x22 (CFL-S/Xeon E P0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0d/0x22 (CFL-H/S R0) from revision 0xc6 up to 0xca;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) from revision 0xc6 up to 0xca.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: David Knox <dknox@redhat.com> 0:6.0.24-80
changelog:
  - Related: CVE-2013-4590  - remove xml schema names javaee_5,
  - javaee_web_services_1_2, and javaee_web_services_1_2_client
  - from descriptor.DigesterFactory initialization. These
  - schema definitions are not relevant to 6.0.24 as the version
  - of their spec did not exist at the time.
  - Resolves: rhbz#1140855 - request parameter truncated


author: David Knox <dknox@redhat.com> 0:6.0.24-82
changelog:
  - Resolves: rhbz#1207048  Tomcat init script needs to be adjusted 
  - to kill tomcat if stop is unsuccessful


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches of:
     patch561 8075484-pr3473-rh1490713.patch
     patch532 8162384-pr3122-rh1358661.patch
     patch547 8173941-pr3326.patch
     patch554 8175887-pr3415.patch
     patch550 8180048-pr3411-rh1449870.patch
  - adapted pr3286-no_fp_contract.patch, CFLAGS_linux_ppc64 no longer have -ffp-contract=off so was dropped from hunk
  - Resolves: rhbz#1528233


author: Richard Hughes <rhughes@redhat.com> - 0.6.21-5
changelog:
  - Update to version 0.6.21 fixing many bugs and CVEs
  - Remove upstreamed patches
  - Resolves: #839916


author: Baoquan He <bhe@redaht.com> - 2.0.0-281
changelog:
  - starting kdump service after network, local fs and remote fs, resolves bug 1132300
  - Add sample eppic scripts to kexec-tools-eppic package, resolves bug 1104837
  - Convert leftover "getent hosts" to "getent ahostsv4", resolves bug 1142666
  - mkdurmpd: Fix the syntax error on the condition of fips inexistence, resolves bug 1131945


author: Baoquan He <bhe@redhat.com> - 2.0.0-283
changelog:
  - makedumpfile: Exclude unnecessary hugepages. resolves bug 1068674
  - makedumpfile: Vtop address translation support for vmalloc region in PPC64 arch. resolves bug 1068674
  - makedumpfile: Initialize for vmalloc address translation support in PPC64 arch. resolves bug 1068674
  - makedumpfile: Get rid of overrun adjustments. resolves bug 1068674
  - makedumpfile: Generic handling of multi-page exclusions. resolves bug 1068674


author: Baoquan He <bhe@redhat.com> - 2.0.0-286
changelog:
  - update kexec-kdump-howto.txt, resolves bug 949376
  - mkdumprd: Load the mlx4_core module if it is needed in the 2nd kernel, resolves bug 1099589
  - nfs dump will fail when netdev has different device name in ifcfg-$dev, resolves bug 1005141 
  - udev-rules: Restart kdump service on cpu ADD/REMOVE events, resolves bug 1113276


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-6
changelog:
  - fix for uninit defect (revealed by Coverity) added with %patch11.
  - recovered traditional behaviour of '--keep-old-files' option and added new
    option '--skip-old-files' (#799252)


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-7
changelog:
  - disable tests/remfiles01.at for running as a privileged user (#687972)
  - fix undesired error exit on receiving SIGPIPE during performing --list
    operation (#807728) and related fix for test suite -- skip SIGPIPE-dependent
    tests in environments ignoring SIGPIPE


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-8
changelog:
  - fix for bad file matching during extracting concrete files from an archive
    (backported fix from fedora 14) (#841308)
  - typo - better separate comments in spec file


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-9
changelog:
  - backport also --listed-incremental crash fix, this patch is in upstream and in
    fedora from f14 (related to #841308)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.23-10
changelog:
  - backport upstream patch to make sure that file matching is done before file
    file-name transformation (#875727)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.23-11
changelog:
  - avoid crash by backporting upstream patch for internal construction of
    file-name hash table (#877769).


author: Pavel Raiskup <praiskup@redhat.com> - 1.23-12
changelog:
  - better auto-recognize xz compressed archives (#1056672)
  - fix --verify option (#923359)
  - fnmatch fixes (#1034360)


author: Pavel Raiskup <praiskup@redhat.com> - 1.23-14
changelog:
  - fix error while storing UID > 2^21 into posix format archive (rhbz#1247788)
  - don't mistakenly set default ACLs (#1220891)


author: Petr Kubat <pkubat@redhat.com> - 1.23-15
changelog:
  - fix error when compressing/listing large sparse files (#1334559)
  - improve sparse mode in genfile for build-time-testsuite purposes


author: Shane Bradley <sbradley@redhat.com> = 3.2-49
changelog:
  - [sosreport] The reports were not generated.
    Resolves: bz1299892

  - [npm/nodejs] Add plugins npm and nodejs.
    The patch contained plugin classes that are not in rhel-6
    which were removed.
    Resolves: bz1368547


author: Filip Krska <fkrska@redhat.com> = 3.2-54.el6_9.1
changelog:
  [networking] iptables: check module version and do ipv6
    Resolves: bz1451784
    [cluster] Scrub passwords in pcs config
    Resolves: bz1427589


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-696.10.2.el6]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}


author: Tim Waugh <twaugh@redhat.com> - 8.70-13
changelog:
  - Applied patch to prevent null pointer dereference (CVE-2010-4054,
    bug #646086).
  - Applied patch to prevent integer underflow in TrueType bytecode
    interpreter (CVE-2009-3743, bug #627902).
  - Applied patch to avoid reading initialization and library files from
    CWD (CVE-2010-2055, bug #599564; CVE-2010-4820, bug #771853).


author: Tim Waugh <twaugh@redhat.com> - 8.70-14
changelog:
  - Fixed character spacing problems using backported patch (bug #695766).
  - Apply some fixes from upstream to avoid gdevcups segfaults (bug #643105).


author: Marek Grac <mgrac@redhat.com> - 4.0.15-4
changelog:
  - fence_ilo_moonshot: New fence agent for HP Moonshot
    Resolves: rhbz#1099551
  - fence_mpath: New fence agent for multipath devices
    Resolves: rhbz#1118008


author: Marek Grac <mgrac@redhat.com> - 4.0.15-5
changelog:
  - fence_ilo_ssh: New fence agent
    Resolves: rhbz#1111482
  - fence_kdump: Update metadata for 'monitor'
    Resolves: rhbz#1094515


author: Marek Grac <mgrac@redhat.com> - 4.0.15-7
changelog:
  - fence_scsi: remove new pythonic version
  - fence_ipmilan: unset default cipher
  - fence_ilo2: add options --tls1.0
  - fence_bladecenter: fix login process
    Resolves: rhbz#1049805


author: Marek Grac <mgrac@redhat.com> - 4.0.15-8.1
changelog:
  - fence_ipmilan no longer understands -i
    Resolves: rhbz#1254046
  - fence_ipmilan no longer understands 'timeout'
    Resolves: rhbz#1254700
  - fence_ilo: Improve negotiation of TLS protocol
    Resolves: rhbz#1256902
  - fence_rsa: Login process over telnet is not working
    Resolves: rhbz#1247062
  - fence_mpath: lose scsi keys after restart
    Resolves: rhbz#1254183


author: Dan Williams <dcbw@redhat.com> - 1:0.7.3-4
changelog:
  - Fix issues with Opportunistic/Proactive Key Caching (OKC) (rh #813579)
  - Be less aggressive when choosing to roam (rh #837402)
  - Don't install manpage for wpa_gui (rh #672976)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.7.3-5
changelog:
  - Add domain_match config option from upstream (rh #1186806) (rh #1178263)
  - Include peer certificate in EAP events for use by clients
  - Add dbus signal for information about server certification
  - eapol_test: Add option for writing server certificate chain to a file


author: Lubomir Rintel <lrintel@redhat.com> - 1:0.7.3-8
changelog:
  - Enable syslog logging support (rh #822128)
  - Support run-time rotation the debug log file (rh #908306)
  - Fix scriptlet dependencies (rh #712848)
  - Enable timestampes in logs (rh #1150004)


author: Davide Caratti <dcaratti@redhat.com> - 1:0.7.3-9.1
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082)


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.14-3
changelog:
  - prevent crmd crash after unexpected Pacemaker Remote connection takeover
   - ensure package URL is displayed correctly

    Resolves: rhbz#1252206


author: Honza Horak <hhorak@redhat.com> - 2.19-23
changelog:
  - fix memory leak when malformed request is received
    Resolves: #845283
  - Fixed returned value when all entries requested and no such
    map exists
    Resolves: #790812


author: Matej Muzila <mmuzila@redhat.com> - 2.19-29
changelog:
  - Make mknetid to handle properly files with either
    empty lines or unexpected format
    Resolves: #1071962


author: Matej Muzila <mmuzila@redhat.com> - 2.19-30
changelog:
  - Make server return YP_NOMAP when NIS client asks for non-existing map
    using yp_first/yp_next RPC calls
    Resolves: #988203


author: Matej Muzila <mmuzila@redhat.com> - 2.19-31
changelog:
  - Return failure if yppassw cannot write to /etc/shadow or /etc/passwd.adjunct
    because of wrong SELinux context
  - Move domainname check from ypserv to yppasswdd
  - Resolves: #747334, #456249


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-55
changelog:
  - daemon: Suppress logging of VIR_ERR_NO_DOMAIN_METADATA (rhbz#1260864)
  - Allow <source> for type=block to have no dev (rhbz#1220197)
  - qemu: event: Properly handle spice events (rhbz#1236581)
  - qemu: event: Clean up VNC monitor handling (rhbz#1236581)
  - qemu: split out cpuset.mems setting (rhbz#1263263)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1263263)
  - virNetDev{Replace, Restore}MacAddress: Fix memory leak (rhbz#1251532)
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1251532)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1251532)
  - qemu: fix hotplugging cpus with strict memory pinning (rhbz#1263263)
  - storage: Track successful creation of LV for removal (rhbz#1232170)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-56
changelog:
  - qemu: snapshot: Fix return value of external checkpoint with no disks (rhbz#1292312)
  - qemu: snapshot: Fix modification of vm object without job (rhbz#1290647)
  - virsh-domain: Add --live, --config, --current logic to cmdAttachInterface (rhbz#1229128)
  - RHEL: virsh: remove duplicate --config for 'virsh update-device' (rhbz#1224037)
  - Update ESX driver to always use privateData (rhbz#1213348)
  - esx: Simplify VI (vSphere) API and VMware product version handling (rhbz#1213348)
  - conf: net: Correctly switch how to format address fields (rhbz#1299700)
  - qemu: Refuse to create snapshot of a disk without source (rhbz#1299411)
  - Build all binaries with PIE (rhbz#1242156)
  - Enable full RELRO mode (rhbz#1242156)
  - Don't duplicate compiler warning flags when linking (rhbz#1242156)
  - Simplify RELRO_LDFLAGS (rhbz#1242156)
  - Fix AM_LDFLAGS typo (rhbz#1242156)
  - Pass AM_LDFLAGS to driver modules too (rhbz#1242156)
  - RHEL: Enable RELRO for python modules (rhbz#1242156)


author: Adam Jackson <ajax@redhat.com> 1.2.2-2
changelog:
  - libvorbis-1.2.2-svn16228.patch: Backport a fix from pre-1.2.3 to hopefully
    fix small sound file playback. (#505610)


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-1
changelog:
  - Rebase to NSS 3.18
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]
  - Keep the same cipher suite order as we had in NSS_3_15_3_RTM
  - Resolves: Bug 1202488 - openldap-2.4.23-34.el6_5.1.i686 fails after updating nss to nss-3.16.1-4.el6_5.i686
  - Resolves: Bug 1182902 - rhel65 ns-slapd crash, segfault error 4 in libnss3.so in PK11_DoesMechanism at pk11slot.c:1824


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.26.0
  - Remove upstreamed patch for CVE-2016-1950
  - Remove p-disable-md5-590364-reversed.patch for bug 1335915


author: Joe Orton <jorton@redhat.com> - 2.0.1-8
changelog:
  - add security fix for CVE-2009-3560 (#533174)
  - add security fix for CVE-2009-3720 (#531697)
  - run the test suite


author: Weiping Pan <wpan@redhat.com> 2.0.8.rh1 2
changelog:
  - rebuild oracleasm for RHEL6.5, sync to upstream commit d368091e98dc
  - (oracleasm: Add support for new error return codes from block/SCSI)


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-7
changelog:
  - Add patch to check if hash algorithms are backed by a token
  - Add patch to disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256,
    which have never enabled in the past


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.0
changelog:
  - Update to IcedTea 1.13.12 & OpenJDK 6 b40.
  - Separate SystemTap option from bootstrap options.
  - Use configure macro and disable long-running JTreg & SystemTap tests from make check
  - Remove redundant patch-ecj target invocation for bootstrap build.
  - Add check section to run the new tests introduced in 1.13.12.
  - Fix context for rpath patch following PR3140.
  - Add RHEL version of b40 tarball.
  - Require mailcap at build time as well, so configure finds /etc/mime.types (PR2800)
  - Remove unneeded dependency on jakarta-commons-logging, as VisualVM is no longer included.
  - Resolves: rhbz#1350044


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-27.b13
changelog:
  - updated to security u45
  - minor sync with 6.7
   - generate_source_tarball.sh
   - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
   - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
   - added upstreamed patch 501 and 505
   - included removeSunEcProvider-RH1154143.patch
  - returned java (jre only) provides
  - repacked policies (source20)
  - removed duplicated NVR provides
  - added automated test for priority (length7)
  - Resolves: RHBZ#1209074


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.41
changelog:
  - Allow use sandbox to follow homedirs symlinks
  Resolves:#913175
  - Make sure file equivalance target and source do not end
   with a /
  - Allow make only valid domains as permissive domains
  - Fix polgen.py to allow "_" in a policy file.
  - Implement --noreload option to semanage
  - Add missing long options in sandbox man page


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.42
changelog:
  - Fail properly on invalid options for restorecon/setfiles when using -R or -r
  - Check if all files exist for setfiles and restorecon
  - Remove handling of cgroups from sandbox. 
  Resolves:#1091139
  - Make -q and -d options mutually exclusive


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.43
changelog:
  - Fix semanage man page to contain also noreload option
  Resolves:#1032828
  - Fix sandbox man page
  - Make setfiles more informative if bad option is given


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.46
changelog:
  - Make semanage -i working on empty file
  - Fix setfiles man page
  - Fix setfiles -r option to be working correctly
  Resolves:#1086456


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.83-19.47
changelog:
  - Fix setfiles man page
  Resolves:#1086456
  - Fix  semanage fcontext  error message when non-existing context given
  Resolves:#1122023


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346354


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.4-6
changelog:
  - apply relro (CFLAGS&DFLAGS) in specfile, because in configure we
   need to call autoreconf.
  - Resolve: rhbz#676040


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.4-7
changelog:
  - switch off --enable-pie, because it's overloaded with flags in spec
  - added RPM_OPT_FLAGS into CFLAGS
  - Related: rhbz#676040


author: Marcela Mašláňová <mmaslano@redhat.com> - 1.4.4-9
changelog:
  - during spring DST change are jobs executed 61 times if they are set
    for 2:00 or 3:00 am.
  - 995089 - incorrectly running jobs when time difference is negative
  - cronie doesn't drop privileges before popen
  - adoptions at the crontab orphanage needed
  - config file permissions are world readable
  - 733697 - Service restart needlessly reports failure
  - 743473 - Confusing comments in /etc/cron.hourly/0anacron
  - 887859 - Incorrect example in anacrontab manpage
  - 990710 - cron disallows setting PATH via PAM
  - 985893 - do not use putenv
  - 985888 - cronie drops $LANG and never passes it on to jobs run
  - 829910 - random prefix in crontables for running jobs
  - 922829 - crond generating invalid emails 
  - 919440 - prevent new crond process when already running 
  - Resolves: rhbz#821046, rhbz#697485, rhbz#738232, rhbz#706979, rhbz#733697
  - Resolves: rhbz#743473, rhbz#887859, rhbz#990710, rhbz#985893, rhbz#985888
  - Resolves: rhbz#829910, rhbz#922829, rhbz#995089, rhbz#919440


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.4-14
changelog:
  - fix segfault on null dereference in anacron (#1031383)
  - do not remove daemon pid file in the child process
  - add log message about crond shutdown (#1108384)
  - add log message when getpwnam fails


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-66
changelog:
  - Release 1.2.11.15-66
  - Resolves: #1270002 - cleanallruv should completely clean changelog (DS 48208)
  - Resolves: #1267405 - many attrlist_replace errors in connection with cleanallruv (DS 48283)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-67
changelog:
  - Release 1.2.11.15-67
  - Resolves: #1234431 - Man pages and help for remove-ds.pl doesn't display "-a" option (DS 48245)
  - Resolves: #1236148 - Slow replication when deleting large  quantities of multi-valued attributes (DS 48195)
  - Resolves: #1236156 - Avoid using regex in ACL if possible (DS 48175)
  - Resolves: #1236656 - Dynamic nsMatchingRule changes had no effect on the attrinfo thus following reindexing, as well. (DS 48212)
  - Resolves: #1240451 - Individual abandoned simple paged results request has no chance to be cleaned up (DS 48192)
  - Resolves: #1244970 - Crash during retro changelog trimming (DS 48206)
  - Resolves: #1245237 - winsync lastlogon attribute not syncing between DS and AD. (DS 48232)
  - Resolves: #1246165 - verify_db.pl doesn't verify DB specified by -a option (DS 48215)
  - Resolves: #1247812 - logconv autobind handling regression caused by 47446 (DS 48231)
  - Resolves: #1253406 - wrong password check if passwordInHistory is decreased. (DS 48228)
  - Resolves: #1255290 - db2index creates index entry from deleted records (DS 48252)
  - Resolves: #1259959 - perl module conditional test is not conditional when checking SELinux policies (DS 48305)
  - Resolves: #1260622 - ns-slapd - LOGINFO:Unable to remove file (DS 48304)
  - Resolves: #1265851 - Double free while adding entries (1.2.11 only) (DS 48287)
  - Resolves: #1273552 - Deadlock between two MODs on the same entry between entry cache and backend lock (DS 47978)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-68
changelog:
  - Release 1.2.11.15-68
  - Resolves: #1278585 - deadlock in mep delete post op (DS 47976) 
  - Resolves: #1247792 - SimplePagedResults -- abandon could happen between the abandon check and sending results (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-69
changelog:
  - Release 1.2.11.15-69
  - Resolves: #1247792 - SimplePagedResults -- abandon could happen between the abandon check and sending results -- Fixing a regression introduced in 1.2.11.15-68 (DS 48338)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-70
changelog:
  - Release 1.2.11.15-70
  - Resolves: #1259959 - perl module conditional test is not conditional when checking SELinux policies - fixing a regression (DS 48305)
  - Resolves: #1282457 - The 'eq' index does not get updated properly when deleting and re-adding attributes in the same ldapmodify operation (DS 48370)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-71
changelog:
  - Release 1.2.11.15-71
  - Resolves: #1284791 - 389-ds-base: ldclt -e randomauthid Segmentation fault. (DS 48289)
  - Resolves: #1290243 - SimplePagedResults -- in the search error case, simple paged results slot was not released (DS 48375)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-72
changelog:
  - Release 1.2.11.15-72
  - Resolves: #1292649 - allow users to specify to relax the FQDN constraint (DS 48332)
  - Resolves: #1294770 - Supplier can skip a failing update, although it should retry (DS 47788)
  - Resolves: #1296694 - ns-slapd crash in ipa context - c_mutex lock memory corruption and self locks (DS 48406, DS 48338 reverted)
  - Resolves: #1297385 - Interpret IPV6 addresses for ACIs, replication, and chaining (DS 196)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-73
changelog:
  - Release 1.2.11.15-73
  - Resolves: #1294770 - Supplier can skip a failing update, although it should retry (DS 47788)
  - Resolves: #1298496 - slapd process crashes on entry modification (DS 47964)
  - Resolves: #1307152 - keep alive entries can break replication (DS 48445)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-74
changelog:
  - Release 1.2.11.15-74
  - Resolves: #1313258 - change severity of some messages related to "keep alive" entries (DS 48420)


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.13
changelog:
  - Remove disclaimer, as it is not as important now to justify kmsg/log
    pollution; its contents are partially adopted in README.caveats.


author: David Vossel <dvossel@redhat.com> - 3.9.5-7
changelog:
  - Update force_unmount=safe option so it does not process
    duplicate process ids.

    Resolves: rhbz#1095943


author: Baoquan He <bhe@redhat.com> - 2.0.0-291
changelog:
  - fadump/ppc64: update spec file, resolves bug 1254923
  - fadump/ppc64: add firmware-assisted dump howto document, resolves bug 1254923
  - fadump/ppc64: handle default action in fadump mode, resolves bug 1254923
  - fadump/ppc64: modify kdump init script to capture vmcore to local filesystems, resolves bug 1254923
  - fadump/ppc64: modify kdump script to stop firmware assisted dump, resolves bug 1254923
  - fadump/ppc64: modify kdump script to start the firmware assisted dump, resolves bug 1254923
  - fadump/ppc64: modify status routine to check for firmware-assisted dump, resolves bug 1254923


author: Baoquan He <bhe@redhat.com> - 2.0.0-292
changelog:
  - mkdumprd: Enhance kdump to handle multiport network card properly resolves bug 1284605
  - mkdumprd: Create special partition name for NVME device resolves bug 1235374
  - Don't handle vnet<n> used by VMs on RHEV host resolves bug 1283191
  - mkdumprd: hush does not support parenthesis in ko parameter directly resolves bug 1028298
  - kdump.init: fix a typo resolves bug 1295283


author: Baoquan He <bhe@redhat.com> - 2.0.0-293
changelog:
  - mkdumprd: Remove partition seperater as well while dropping partition number in device name, resolves bug 1228799


author: Baoquan He <bhe@redhat.com> - 2.0.0-298
changelog:
  - b0e4c65 Use file offset in initialize_mmap(), resolves bug 1314158
  - 85f20f9 mkdumprd: redirect stderr of bmc-watchdog to /dev/null resolves bug 1315270


author: Jindrich Novy <jnovy@redhat.com> 2007-57
changelog:
  - fix CVE-2010-2642 CVE-2011-0433 CVE-2011-0764 CVE-2011-1552
    CVE-2011-1553 CVE-2011-1554, texlive various flaws (#773184)


author: Than Ngo <than@redhat.com> - 2007-58
changelog:
  - Resolves: bz#699575, running latex when the .aux file is non-writable can erase the input .tex file


author: Andrew Price <anprice@redhat.com> - 3.0.12.1-69
changelog:
  - fsck.gfs2: fix broken i_goal values in inodes
  - gfs2_convert: use correct i_goal values instead of zeros for inodes
  - fsck.gfs2: Reprocess nodes if anything changed - addendum 1 of 2
  - fsck.gfs2: addendum to fix broken i_goal values in inodes - addendum 2 of 2
    Resolves: rhbz#1149516


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-72
changelog:
  - xml: ccs_update_schema: be verbose about extraction fail
    Resolves rhbz#1087286
  - qdiskd: warn if no heuristics defied for >2 node clusters
    Resolves: rhbz#1095418
  - *_controld: better logging if receive_start fails
    Resolves: rhbz#1095657
  - qdiskd: Enable master_wins if votes=1
    Resolves: rbhz#1099223
  - cman: fix cman.5 man page to indicate only 1 altname is allowed
    Resolves: rhbz#1111500
  - cman: Slight fix to message issued for invalid two_node clusters
    Resolves: rhbz#1142947


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-73.1
changelog:
  - gfs_controld: Retry uevent recv() and reconnect uevent socket on error
    Resolves: rhbz#1234443
  - dlm_controld: Retry uevent recv() and reconnect uevent socket on error
    Resolves: rhbz#1233535


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-5
changelog:
  - script-login did not drop privileges correctly (#709095)
  - fix directory traversal due to not obeying chroot directive (#709097)
  - check proxy destination host against SSL certificate name (#754980)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-8.3
changelog:
  - mention it in config file, that we disabled SSLv2 and SSLv3
    by default (#1174158)
  - add ssl_protocols configuation option and disable SSLv2 and SSLv3
    by default (#1174158)


author: Thomas Woerner <twoerner@redhat.com> 1.2.13-13
changelog:
  - added repackage.sh script to remove joyos2,h and symbian.zip (really)
  - added comment about riva_mmio.h license


author: Thomas Woerner <twoerner@redhat.com> 1.2.14-1
changelog:
  - rebase to 1.2.14
  - fixed build for libtool 2.2.6 and newer
  - fix from Josh Boyer <jwboyer@gmail.com>:
    - disable ps3 video support that was added in 2.14.  It fails to
      build on ppc/ppc64


author: Petr Pisar <ppisar@redhat.com> - 1.2.14-3
changelog:
  - Fix left button press event in windowed mode (sdl894, Resolves: #640682)
  - Remove invalid configure arguments (Resolves: #640687)
  - Kernel joystick structure has grown in unknown 2.6 Linux version (sdl900,
    Resolves: #640694)
  - Do not call memcpy() on overlapping areas (sdl1090, Resolves: #678569)
  - Don't block SDL_WM_GrabInput() if window is not viewable (sdl1155,
    Resolves: #733605)


author: Steve Dickson <steved@redhat.com> 1.1.5-2
changelog:
  - Updated to latest upstream release: libnfsidmap-0.24-rc1 (bz 650970)
  - Reset default values in /etc/idmap.conf (bz 650997)
  - Remove some warnings in the RPMdiff run (bz 594279)


author: Jeff Garzik <jgarzik@redhat.com> - 2-6
changelog:
  - Resolves: bz#576678
  - increase version number of rng-utils that we obsolete
  - use global rather than define, for sbindir (Fedora pkg review)
  - improve BuildRoot (Fedora pkg review)


author: David Howells <dhowells@rehdat.com> - 2-7
changelog:
  - Resolves: bz#597221
  - Fix some compiler warnings thus dealing with the SEGV
  - Make do_loop() correctly interpret the result of iter->xread()


author: Jay Fenlason <fenlason@redhat.com> - 2-9
changelog:
  - Add patch from James M. Leddy <james.leddy@redhat.com> to add
    an option to ignore FIPS failures.
    Resolves: bz#733452


author: Jeff Garzik <jgarzik@redhat.com> - 2-13
changelog:
  - Resolves: bz#751374
  - Add post/preun calls to chkconfig, during rpm install/removal
  - Remove unused rotate, resume steps from init script


author: Omair Majid <omajid@redhat.com> - 1.7.0.51-2.4.7.5.el6
changelog:
  - Work when capabilities are set on the binary
  - Include hardcoded install path as well as $ORIGIN in RPATH
  - Resolves: rhbz#1105293


author: Michal Srb <msrb@redhat.com> - 0:1.1.1-11.6
changelog:
  - Prevent XXE and RCE in JSTL XML tags
  - Apply correction for previous CVE-2015-0254 patch (prevent XXE in <x:transform>)
  - Resolves: CVE-2015-0254


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Remove upstreamed patches.
  - Regenerate add-final-location-rpaths patch against new release.
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - Use xz for tarballs to reduce file size.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148899


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Remove upstreamed patch for RH1158799.
  - Regenerate add-final-location-rpaths patch against new release.
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Resolves: rhbz#1180290


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Resolves: rhbz#1180290


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update IcedTea and OpenJDK sources to fix x86 build issue.
  - Regenerate add-final-location-rpaths patch against new release.
  - Resolves: rhbz#1180290


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Regenerate add-final-location-rpaths patch against new release.
  - Resolves: rhbz#1180290


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.35-1.13.7.0
changelog:
  - Update to IcedTea 1.13.7
  - Regenerate add-final-location-rpaths patch so as to be less disruptive.
  - Resolves: rhbz#1209065


author: Tim Waugh <twaugh@redhat.com> 1.1.0-9
changelog:
  - Init script fixes:
    - Attempt to start all configured servers (bug #562669, bug #768405).
    - Avoid problems when user's configured shell is not bash (bug #949522).
  - Applied Debian patch to fix busy loop when run from inetd in nowait
    mode (bug #958988, bug #920373).
  - Avoid initializing the vnc extension twice (bug #1004093).
  - Use exceptions instead of asserts for ZRLE decoding boundary checks
    (bug #1078508).


author: Tim Waugh <twaugh@redhat.com> 1.1.0-13
changelog:
  - Added versioned pixman and libX11 dependencies (bug #917717,
    bug #991285).
  - Link against system-wide libjpeg-turbo (bug #956779).
  - Describe -SecurityTypes option in man pages (bug #882952).
  - Fixed kbase URL in sysconfig file (bug #728981).


author: Tim Waugh <twaugh@redhat.com> 1.1.0-16
changelog:
  - Unknown pseudo-encodings (those with negative values) would cause
    vncviewer to crash (bug #1121041).
  - Set source as well as target when building java as some JDKs require
    this (bug #1078427).


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-1
changelog:
  - New upstream version, resolves rhbz #766335
  - Build python bindings to satisfy Samba4 BuildRequires


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-2
changelog:
  - Obsolete older pytalloc{,-devel} releases to clear the upgrade path
    towards non-multilib pytalloc
  - Resolves: rhbz#862062


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-11
changelog:
  - Skip calls to CHECK_FORK in {C & NSC}_GetFunctionList
  - Resolves: Bug 1053437 - Admin server segfault when configuration DS configured on SSL port


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-12
changelog:
  - Avoid call to sdb_measureAccess in lib/softoken/sdb.c s_open if NSS_SDB_USE_CACHE is "yes" or "no"
  - Resolves: Bug 1044666 - Can curl HTTPS requests make fewer access system calls?


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-11
changelog:
  - mention it in config file, that we disabled SSLv2 and SSLv3
    by default (#1153041)
  - add ssl_protocols configuation option and disable SSLv2 and SSLv3
    by default (#1153041)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-17
changelog:
  - fix race condition when creating INBOX (#1184865)
  - close stderr if it's not used for logging (#730746)
  - login proxy should not fail connection if CRL isn't found for some certificate (#813957)
  - fix crash in list-status (#961466)
  - installation of dovecot hangs if there is no /dev/urandom (#1026790)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Add reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - ABS_JAVA_HOME_DIR is no longer used in the latest tapsets
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.0
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-40
changelog:
  - mod_proxy: do not mix workers shared memory during graceful restart (#1149906)
  - mod_ssl: Fix SSL_CLIENT_VERIFY value when optional_no_ca and SSLSessionCache
    are used and SSL session is resumed (#1149703)
  - mod_ssl: log revoked certificates at the INFO level (#1161328)
  - mod_ssl: use -extensions v3_req for certificate generation (#906476)
  - core: check the config file before restarting the server (#1146194)
  - core: do not match files when using DirectoryMatch (#1016963)
  - core: improve error message for inaccessible DocumentRoot (#987590)
  - rotatelogs: improve support for localtime (#922844)
  - mod_deflate: fix decompression of files larger than 4GB (#1057695)
  - ab: fix integer overflow when printing stats with lot of requests (#1092419)
  - ab: try all addresses instead of failing on first one when not available (#1125269)
  - ab: fix read failure when targeting SSL server (#1045477)
  - apachectl: support HTTPD_LANG variable from /etc/sysconfig/httpd (#963146)
  - do not display "bomb" icon for files ending with "core" (#1069625)


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-20
changelog:
  - register and deregister: if there is an error registering or deregistering
    one or more collection, skip it but return non-zero return code
  - fix the problem with metapackage dependencies when BuildArch is specified


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-21
changelog:
  - fix an obscure segfault when listing collections on i386
  - fix registration to work with slash-ended paths
  - add the %scl_dependency_generators macro
  - drop recursive ownership of /usr/lib within SCL root


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-22
changelog:
  - Add execution of register and deregister scripts during registration
    and deregistration if they exist.
  - Add capability to make collection nfs mountable using macro nfsmountable.
  - removed the dependency generators and all related changes
    (maintainers' demands)


author: Lubos Kardos <lkardos@redhat.com - 20120927-23
changelog:
  - Modified paths of state and conf files
  - Add owning and creating of state and conf files if nfsmountable is defined
  - Add printing file names in error messages


author: Lubos Kardos <lkardos@redhat.com> - 20120927-25
changelog:
  - Creating filelist in build subdirectory instead of build directory.
  - Removing filelist before build.


author: Christophe Fergeau <cfergeau@redhat.com> 0.3.1-2
changelog:
  - Requires a new enough librest as we use symbols not available in older
    librest
    Related: rhbz#1116844


author: Christophe Fergeau <cfergeau@redhat.com> 0.3.2-1.2
changelog:
  - Access oVirt API through /ovirt-engine/api rather than /api, this fixes
    foreign menu when accessing a VM from .vv files
    Resolves: rhbz#1297810


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - fixed ldap's and sssd's sudoOption value and remove quotes
    - fixed ldap's and sssd's sudoOption whitespaces parse problem
    Resolves: rhbz#1144422
    Resolves: rhbz#1279447


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - search also by user id when fetching rules from LDAP
    Resolves: rhbz#1135531


author: Bala FA <barumuga@redhat.com> - v3.6.0.24-1
changelog:
  - fixes bugs bz#1104153 bz#1109149 bz#1112582 bz#1113961 bz#1114008 
    bz#1114592 bz#1115266 bz#1115267


author: Bala FA <barumuga@redhat.com> - v3.6.0.25-1
changelog:
  - fixes bugs bz#1007033 bz#1101910 bz#1104121 bz#1104921 bz#1109150 
    bz#1116376 bz#1116703 bz#1116992 bz#1117135 bz#1120198 bz#1120245 bz#BUG:


author: Bala FA <barumuga@redhat.com> - v3.6.0.26-1
changelog:
  - fixes bugs bz#1111029 bz#1111577 bz#1113852 bz#1116761 bz#1117135 
    bz#1117283 bz#1119223 bz#1120830 bz#1121059 bz#1121603


author: Bala FA <barumuga@redhat.com> - v3.6.0.28-1
changelog:
  - fixes bugs bz#1110694 bz#1116150 bz#1121099 bz#1124692 bz#1127234 
    bz#1136711 bz#921528 bz#969298


author: Bala FA <barumuga@redhat.com> - v3.6.0.29-2
changelog:
  - fixes bugs bz#1136711 bz#1138288 bz#1139213 bz#1139273 bz#1139473 
    bz#1140643 bz#1143960
  - build to make higher release with rhs-3.0-client to avoid build
    collision


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-55.el6
changelog:
  - Fixed 'clientaddr' option for UDPv6 client messages (#1279501)
  - Increased maximum size of AgentX packets (#1271196).
  - Fixed IP-MIB::ipSystemStatsInOctets and similar counters for IPv4
    (#1250023).
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1246568)
  - Fixed typos in NET-SNMP-AGENT-MIB.txt (#1241865)
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1227640)
  - Restored message about duplicate IP address (#1227374)
  - Fixed fd leak in sctp statistics (#1291054)


author: Josef Ridky <jridky@redhat.com> - 1:5.5-57.el6_8.1
changelog:
  - Resolves: #1363606 - An SNMPv3 request with a small max message size can lead to SNMPv1/2c bulk requests timing out


author: Tom Lane <tgl@redhat.com> 2:1.2.46-1
changelog:
  - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,
    CVE-2011-2691, CVE-2011-2692
  Resolves: #721306


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-40.el6
changelog:
  - Explicitly specify auth mechanism when calling ldapmodify in
    the installers (#1108661)
  - Add support for DNS classless reverse domains (#1095250)
  - Multiple nsDS5ReplicaId attributes created in
    cn=replication,cn=etc (#1109050)
  - ipa-client-install should configure sudo automatically (#1111121)


author: Devrim GUNDUZ <devrim@commandprompt.com> - 0:3.2.1-1
changelog:
  - Updated to 3.2.1
  - Updated patch #1 and #4
  - Own %dir /usr/lib/gcj/jakarta-commons-collections, per #473612.


author: Soren Sandmann <ssp@redhat.com>
changelog:
  - Add two patches for the man page:
    - 0001-xfreerdp.1.xml-Don-t-claim-to-support-multiple-conne.patch
      Don't claim to support multiple connections, #988272
    - 0002-Replace-itemizedlist-s-with-variablelist-s.patch
      Work around a bug in RHEL 6 docbook, that causes <itemizedlist>
      to be mangled. This patch replaces them with <variablelist>s.


author: Soren Sandmann <ssp@redhat.com> - 1.0.2-2
changelog:
  - Add patch listing the plugins available in RHEL 6
    - 0003-List-plugins-available-in-RHEL-6.patch
    Related: #988272


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-26
changelog:
  - Match exact Oracle SID to avoid waiting for 90 seconds and killing other databases if their names include the name of the database you're trying to stop
  - Use DAD to check for address collision instead of ping for IPv6 in rgmanager
  - MySQL wait up to "startup_wait" seconds for mysqld to create PID
  - Handle failure state during stop in orainstance.sh
  - Add Oracle resource agents for Pacemaker

    Resolves: rhbz#1200639
    Resolves: rhbz#1191247
    Resolves: rhbz#1207285
    Resolves: rhbz#1234777
    Resolves: rhbz#1070479


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-27
changelog:
  - SAP HANA add Multiple Components One System (MCOS) support
  - sap_redhat_cluster_connector add support for "-" in hostnames

    Resolves: rhbz#1200903
    Resolves: rhbz#1269897


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-28
changelog:
  - Use IPv6 DAD for collision detection in IPaddr2
  - Add RAID segment type support for HA LVM
  - Fix Tomcat SELinux failed in enforcing mode
  - Add migrate_options parameter to VirtualDomain
  - Remove not-working tmpfs "support" from fs.sh
  - Fix tmpfile leak in mysql resource agent

    Resolves: rhbz#1276698
    Resolves: rhbz#1266173
    Resolves: rhbz#1280319
    Resolves: rhbz#1286650
    Resolves: rhbz#1024505
    Resolves: rhbz#1292054


author: Jan Pokorny <jpokorny@redhat.com> - 3.9.5-31
changelog:
  - Fix up for wrongly generated RNG schema for cluster configuration
    wrt. "action" tag

    Related: rhbz#1272587


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-32
changelog:
  - Add portblock resource agent for Pacemaker
  - Add Oracle Data Guard resource agent for rgmanager

    Resolves: rhbz#1302545
    Resolves: rhbz#1086838


author: Ian Kent <ikent@redhat.com> - 5.0.5-131
changelog:
  - bz1396403 - Trying to access a non-existent directory using automount
                results in 4 minute hang with nfs-utils-1.2.3-73.el6
    - fix inconsistent signed usage for __rpc_ping().
    - check NFS server availability on local mount fallback
  - Resolves: rhbz#1396403


author: Ian Kent <ikent@redhat.com> - 5.0.5-132
changelog:
  - bz1277033 - RHEL6.7: shutdown / reboot hangs with findmnt in a readlink
    system call, doing path_walk and stuck in autofs4_wait
    - make set_direct_mount_catatonic() more general.
    - set autofs mounts catatonic at exit
  - Related: rhbz#1277033


author: Ian Kent <ikent@redhat.com> - 5.0.5-133
changelog:
  - bz1496901 - Autofs processes hung while waiting for the release of an
    entry master_lock that is held by another thread waiting on a bind mount
    - only take master map mutex for master map update.
  - Resolves: rhbz#1496901


author: Ian Kent <ikent@redhat.com> - 5.0.5-134
changelog:
  - bz1496901 - Autofs processes hung while waiting for the release of an
    entry master_lock that is held by another thread waiting on a bind mount
    - fix incorrect patch specification in spec file.
  - Related: rhbz#1496901


author: Ian Kent <ikent@redhat.com> - 5.0.5-135
changelog:
  - bz1463004 - Server availability probe broke tunneling nfs via localhost
    - remove some redundant rpc library code.
    - add port parameter to rpc_ping().
    - dont probe NFSv2 by default.
    - add version parameter to rpc_ping().
  - Resolves: rhbz#1463004


author: Ian Kent <ikent@redhat.com> - 5.0.5-136
changelog:
  - bz1495442 - automount crashes due to segfault
    - fix create_client() RPC client handling
  - Resolves: rhbz#1495442


author: Ian Kent <ikent@redhat.com> - 5.0.5-137
changelog:
  - bz1463004 - Server availability probe broke tunneling nfs via localhost
    - update "add version parameter to rpc_ping()" patch to current updtream
      version which fixes 2 covarity warnings.
  - Resolves: rhbz#1463004


author: Ian Kent <ikent@redhat.com> - 5.0.5-138
changelog:
  - bz1559295 - autofs: can't mount nfs vers=2
    - fix NFS version mask usage.
  - Resolves: rhbz#1559295


author: Ian Kent <ikent@redhat.com> - 5.0.5-139
changelog:
  - bz1495442 - automount crashes due to segfault
    - fix fd leak in rpc_do_create_client().
  - Related: rhbz#1495442


author: Ian Kent <ikent@redhat.com> - 5.0.5-140
changelog:
  - bz1627004 - yum update hanging while restarting autofs
    - fix incorrect locking in sss lookup.
  -Resolves: rhbz#1627004


author: Stepan Kasal <skasal@redhat.com> - 0.9.7-4
changelog:
  - repack the tarball, there are .jar files without any source
  - do not BR findutils, they are guaranteed in Fedora mock
  - fix obsolete, so that it covers only packages created before this
    spec was added to Fedora


author: Petr Pisar <ppisar@redhat.com> - 0.9.7-7
changelog:
  - Revert CVE-2011-0904 and CVE-2011-0905 patch because libvncserver is not
    vulnerable (bug #696767)


author: Petr Pisar <ppisar@redhat.com> - 0.9.7-7.1
changelog:
  - Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157668)
  - Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
    (bug #1157668)
  - Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
    handling) (bug #1157668)
  - Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
    (bug #1157668)
  - Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
    handling) (bug #1157668)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-53
changelog:
  - Release 1.2.11.15-53
  - Resolves: #1202502 - memory leak in new_passwdPolicy (1.2.11 only) (DS 48135)
  - Resolves: #1202062 - Non tombstone entry which dn starting with "nsuniqueid=...," cannot be deleted (DS 48133)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-54
changelog:
  - Release 1.2.11.15-54
  - Resolves: #1207983 - disable writing unhashed#user#password to changelog (DS 561)
  - Resolves: #1207024 - IPA Replicate creation fails with error "Update failed! Status: [10 Total update abortedLDAP error: Referral]" (DS 47942)
  - Resolves: #1211077 - nsslapd-ndn-cache-enabled returns 1 or 0 instead of "on" or "off" (DS 408)
  - Resolves: #1211006 - start/stop/restart-dirsrv utilities should ignore admin-serv directory (DS 48148)
  - Resolves: #1210996 - Disable SSL v3, by default [389-ds-base-1.2.11 only] (DS 47928)
  - Resolves: #1214074 - Need a way to abort a cleanallruv abort task (DS 48154)
  - Resolves: #1212657 - Password is not correctly passed to perl command line tools if it contains shell special characters. (DS 48143)
  - Resolves: #1218341 - ns-slapd crash related to paged results (DS 48146)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-55
changelog:
  - Release 1.2.11.15-55
  - Resolves: #1118285 - Lowering the log level of "Configured SSL version range" message (1.2.11 only) (DS 48180)
  - Resolves: #1211006 - start/stop/restart-dirsrv utilities should ignore admin-serv directory (DS 48148)
  - Resolves: #1219208 - Remove cleanAllRUV task limit of 4 (DS 48158)
  - Resolves: #1219218 - Improve CleanAllRUV logging (DS 48151)


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-27
changelog:
  - 1170750 apply "Set non negotiated params early" from upstream
    to fix SendTargets discovery over iSER with some targets


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.146
changelog:
  - Fix memory order when reading libgcc handle (#905941).
  - Fix format specifier in malloc_info output (#1027261).
  - Fix nscd lookup for innetgr when netgroup has wildcards (#1054846).


author: Jiri Denemark <jdenemar@redhat.com> - 2.48-7
changelog:
  - Fix lease-change script (rhbz#815819)
  - Check tftp-root exists and is accessible at startup (rhbz#824214)


author: Tomas Hozza <thozza@redhat.com> - 2.48-10
changelog:
  - Fixed dnsmasq-2.48-add-bind-dynamic-option.patch
   - the option --bind-dynamic was not set correctly when used


author: Tomas Hozza <thozza@redhat.com> - 2.48-11
changelog:
  - Revert previous changes because of many problems with --bind-dynamic option backport.
  - Dropping dnsmasq-2.48-add-bind-dynamic-option.patch
  - Set SO_BINDTODEVICE socket option when using --bind-interfaces (rhbz#884957)


author: Kamil Dudka <kdudka@redhat.com> - 4.3.10-12
changelog:
  - avoid using uninitialised memory after lexer realloc (#1146119)
  - replace an incorrect comment in /etc/zshenv (#1103697)
  - optimize matching of multiple * in wildcards (#1131172)
  - use heap rather than stack allocation for variable length arrays (#567215)
  - prevent jobs -Z from destroying environment variables (#878324)
  - shell emulation doc addition (#1104021)


author: Steve Dickson <steved@redhat.com> 1.2.3-67
changelog:
  - mount.nfs: Fix fallback from tcp to udp (bz 1287894)
  - exportfs: escape path for function test_export (bz 735696)
  - nfs-utils.spec: No verification on runtime configuration files (bz 1118176)
  - idmapd: added usage statement (bz 1001439)
  - mountd: fix netgroup lookup for short hostnames (bz 1231998)
  - mountd: fix bug affecting exports of dirs with 64bit inode number (bz 994564)


author: Steve Dickson <steved@redhat.com> 1.2.3-71
changelog:
  - rpc.mountd: set libtirpc nonblocking mode to avoid DO (bz 1301581)
  - nfsidmap: Clean up other exit status cases (bz 1313603)
  - gssd: Fix inner-loop variable reuse (bz 1313090)
  - mount.nfs manpage: Add nfsmount.conf (bz 1302981)
  - nfs.init: Set exit code on restarts (bz 1205055)


author: Steve Dickson <steved@redhat.com> 1.2.3-73
changelog:
  - mountd: fix is_subdirectory to understand '/' (bz 1331207)
  - mount.nfs: Fix for the bug in v1.2.4 that breaks mount.nfs (bz 1208385)
  - mount.nfs: Removed supported flag from usage string (bz 1000990)
  - mountd.man: Update to change -P option as an alias for -p (bz 1037926)
  - exportfs: Deal with path's trailing "/" in unexportfs_parsed() (bz 1276538)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1352856)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-4
changelog:
  - Resolves: #1301005 - insufficient check for running service
    in condrestart and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.1
changelog:
  - Resolves: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid34: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.2
changelog:
  - Related: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid34: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.3
changelog:
  - Resolves: #1334499 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556
    squid34: various flaws
  - Resolves: #1334506 - CVE-2016-4553 squid34: squid: Cache poisoning
    issue in HTTP Request handling


author: Chris Feist <cfeist@redhat.com> - 0.9.123-3
changelog:
  - Added ability to upgrade cluster cib and we auto upgrade cib if we're running
    an acl command (except show or help)
  - Resolves: rhbz#1112727


author: Chris Feist <cfeist@redhat.com> - 0.9.123-4
changelog:
  - Fixed resource delete for clones of groups with more than one resource
  - Fixed unclone of group so all resources are removed
  - Resolves: rhbz#1107612 rhbz#1108778


author: Chris Feist <cfeist@redhat.com> - 0.9.123-6
changelog:
  - Fixed issue with sync cluster.conf & adding uid/gid across cluster on RHEL6 w/ pcsd
  - Resolves: rhbz#1102836


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-47.4
changelog:
  - core: fix possible long graceful restart caused by race condition between
    httpd children processes (#1304712)


author: Lukáš Tinkl <ltinkl@redhat.com> - 6:4.3.4-22
changelog:
  - Resolves rhbz#1088925 - Opening a terminal in Konqueror / Dolphin does not 
    inherit environment variables


author: James Antill <james.antill@redhat.com> - 0.9.9-18
changelog:
  - Option -C does nothing on empty repo.
  - Resolves: rhbz#877301
  - Fix the options documentation.
  - Resolves: rhbz#892657


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-19
changelog:
  - Options --checksum, --unique-md-filenames, --simple-md-filenames for modifyrepo.
  - Resolves: rhbz#952602


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-20
changelog:
  - Catch IOErrors when loading pkglist.
  - Resolves: rhbz#1083185
  - Fix OSError when running createrepo on CIFS shares.
  - Resolves: rhbz#1035588


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-24
changelog:
  - Make sure filename doesn't already contain a checksum.
  - Resolves: bug#1104840
  - Remove nonexistent --no-compress option from the manpage.
  - Resolves: bug#1106454


author: Paul Wouters <pwouters@redhat.com> - 3.15-5.1
changelog:
  - Resolves: rhbz#1284966 add libreswan to RHEL6 (core)
  - Resolves: rhbz#1288086 /var/run/pluto should have 755 and should have 700


author: Paul Wouters <pwouters@redhat.com> - 3.15-5.2
changelog:
  - Resolves: rhbz#1289498 keyingtries=0 is broken
  - Resolves: rhbz#1166151 Pluto crashes on during 'service ipsec stop'
  - Resolves: rhbz#1216946 IPv6 in RHEL6 fails after reboot
  - Resolves: rhbz#1144462 ikev2 status shows "no tunnels up" while tunnel is up


author: Paul Wouters <pwouters@redhat.com> - 3.15-6
changelog:
  - Resolves: rhbz#1345959 openswan - libreswan migration issues
  - Resolves: rhbz#1360134 libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails
  - Resolves: rhbz#1313709 ipsec pluto returns zero even if it fails [doc change only]
  - Resolves: rhbz#1315415 ipsec.conf manpage does not contain any mention about crl-strict option


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.1
changelog:
  - Resolves: rhbz#1375741 Pluto (libreswan) intermittent abort when ' auto --up --asynchronous' is used
  - Resolves: rhbz#1335896 ipsec initnss/checknss custom directory not recognized


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.2
changelog:
  - Resolves: rhbz#1313843 Prescript warning: Missing control file /var/run/pluto/pluto.ctl
  - Resolves: rhbz#1375741 Pluto (libreswan) intermittent abort [extended patch]
  - Resolves: rhbz#1369990 Libreswan connection sometimes does not get re-established after one side restarts


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.3
changelog:
  - Resolves: rhbz#1403201 pluto uses up available memory and fails with 'unable to popen'
  - Resolves: rhbz#1311360 When IKE rekeys [...] (updated for IKEv1 responder side)


author: Paul Wouters <pwouters@redhat.com> - 3.15-9
changelog:
  - Resolves: rhbz#1781903 ipsec newhostkey fails with ipsec rsasigkey: key pair generation failed: -8187


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.6
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-1
changelog:
  - Rebase to 0.9.16 to provide the version Samba4 needs
  - Resolves: rhbz#766336
  - Drop ABI compatibility patch (no longer needed)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-2
changelog:
  - Add BuildRequires on libxslt and docbook-style-xsl to enable
    building manual pages

  - Related: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.17-1
changelog:
  - Rebase to 0.9.17 to provide the version Samba4 needs
  - Drop EXCLUDE_PATTERNS workaround in specfile
  - Resolves: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-2
changelog:
  - Resolves: rhbz#975489 - Additional flags might have no effect
                            on 32bit architectures


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-1
changelog:
  - Rebase libtevent to 0.9.26
  - Remove upstreamed or no longer applicable patches
  - Related: rhbz#1322688


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-2
changelog:
  - temporarily disable make check, which keeps failing in mock despite
    working correctly on a full system
  - Related: rhbz#1322688


author: David Vossel <dvossel@redhat.com> - 3.9.5-5
changelog:
  - Add support for pacemaker db2 agent
  - Fix syntax error in nfsserver.sh
  - Updates pacemaker nfs server agents. Adds support for
    nfsnotify agent.

    Resolves: rhbz#1059981
    Resolves: rhbz#1091102
    Resolves: rhbz#974239


author: Joe Orton <jorton@redhat.com> - 1.3.9-4
changelog:
  - add fix for apr_fnmatch() regression (CVE-2011-1928, #706352)
  - add fix for CVE-2011-0419 (#703520)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-58
changelog:
  - Resolves: #1349546 - comments no longer allowed at the end of Allow
    from statements and maybe other statements from mod_authz*


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-60.5
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Adam Jackson <ajax@redhat.com> 1.8.6-3
changelog:
  - cairo-1.8.6-repeat-modes.patch: Enable the repeat and pad blend modes in
    the xlib backend to make firefox performance slightly less dire.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.1
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Remove patches added for RH1183014 which are now upstream in 2.6.5/7u99.
  - Resolves: rhbz#1320657


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.1
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop a leading zero from the priority as the update version is now three digits
  - Update PR2809 patch to apply against 2.6.6.
  - Resolves: rhbz#1325426


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.6
changelog:
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734747]
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749731]
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791558]
  - Resolves: bz#1734747
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-6.10.z])
  - Resolves: bz#1749731
    (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-6])
  - Resolves: bz#1791558
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-6.10.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.441.el6
changelog:
  - kvm-block-Improve-bdrv_aio_co_cancel_em.patch [bz#1018537]
  - kvm-usb-Avoid-reentrancy-of-ehci_advance_async_state-dow.patch [bz#1018537]
  - kvm-scripts-add-sample-model-file-for-Coverity-Scan.patch [bz#1102409]
  - Resolves: bz#1018537
    (qemu core dump after run read/randwr fio in guest with usb or scsi disk)
  - Resolves: bz#1102409
    (Unable to handle NULL pointer dereference in qcow2_check_refcounts)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.442.el6
changelog:
  - kvm-Fix-TEXI-section-mark-imbalance-in-qemu-img-cmd.hx.patch [bz#1116558]
  - kvm-qemu-img-Allow-source-cache-mode-specification.patch [bz#1116558]
  - kvm-vl-Change-mem-prealloc-to-match-upstream.patch [bz#1006027]
  - Resolves: bz#1006027
    (-mem-prealloc option behaviour is opposite to expected)
  - Resolves: bz#1116558
    (Allow qemu-img to bypass the host cache (check, compare, convert, rebase, amend))


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.443.el6
changelog:
  - kvm-char-add-a-dummy-fe_open-implementation.patch [bz#1027181]
  - kvm-char-restore-read-callback-on-a-reattached-hotplug-c.patch [bz#1027181]
  - Resolves: bz#1027181
    (Guest can't receive any character transmitted from host after hot unplugging virtserialport then hot plugging again)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.443.el6
changelog:
  - kvm-qxl-render-add-more-sanity-checks.patch [bz#1095612]
  - Resolves: bz#1095612
    (Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.445.el6
changelog:
  - kvm-trace-add-systemtap-initscript-README-file-to-RPM.patch [bz#1139438]
  - Resolves: bz#1139438
    (README for qemu-kvm systemtap flight recorder)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.446.el6
changelog:
  - Properly adding missing README.systemtap [bz#1139438]
  - Resolves: bz#1139438
    (README for qemu-kvm systemtap flight recorder)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.447.el6
changelog:
  - kvm-net-Forbid-dealing-with-packets-when-VM-is-not-runni.patch [bz#1142756 bz#970103]
  - kvm-migration-set-speed-to-maximum-during-last-stage.patch [bz#1142756 bz#970103]
  - kvm-migration-only-call-append-when-there-is-something-t.patch [bz#1142756 bz#970103]
  - kvm-migration-avoid-no-op-memmove-of-potential-large-buf.patch [bz#1142756 bz#970103]
  - kvm-migration-remove-not-needed-ram_save_remaining-funct.patch [bz#1142756 bz#970103]
  - kvm-migration-move-bandwidth-calculation-to-inside-stage.patch [bz#1142756 bz#970103]
  - kvm-migration-Don-t-calculate-bandwidth-when-last-cycle-.patch [bz#1142756 bz#970103]
  - Resolves: bz#1142756
    (Downtime during live migration of busy VM is much higher than migration_downtime in vdsm.conf)
  - Resolves: bz#970103
    (Downtime during live migration of busy VM is much higher than migration_downtime in vdsm.conf)
  - Properly include README.systemtap [bz#1145672]
  - Resolves: bz#1145672
    (README for qemu-kvm systemtap flight recorder)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.448.el6
changelog:
  - kvm-Revert-migration-Don-t-calculate-bandwidth-when-last.patch [bz#970103]
  - kvm-Revert-migration-move-bandwidth-calculation-to-insid.patch [bz#970103]
  - kvm-Revert-migration-remove-not-needed-ram_save_remainin.patch [bz#970103]
  - kvm-Revert-migration-avoid-no-op-memmove-of-potential-la.patch [bz#970103]
  - kvm-Revert-migration-only-call-append-when-there-is-some.patch [bz#970103]
  - kvm-Revert-migration-set-speed-to-maximum-during-last-st.patch [bz#970103]
  - kvm-Revert-net-Forbid-dealing-with-packets-when-VM-is-no.patch [bz#970103]
  - Reverts attempt to solve: bz#970103
    (Downtime during live migration of busy VM is much higher than migration_downtime in vdsm.conf)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.448.el6_6.1
changelog:
  - kvm-net-Forbid-dealing-with-packets-when-VM-is-not-run_2.patch [bz#970103]
  - kvm-virtio-net-drop-assert-on-vm-stop.patch [bz#970103]
  - kvm-migration-set-speed-to-maximum-during-last-stage_2.patch [bz#970103]
  - kvm-migration-only-call-append-when-there-is-something_2.patch [bz#970103]
  - kvm-migration-Only-call-memmove-when-there-is-anything-t.patch [bz#970103]
  - kvm-migration-remove-not-needed-ram_save_remaining-fun_2.patch [bz#970103]
  - kvm-migration-move-bandwidth-calculation-to-inside-sta_2.patch [bz#970103]
  - kvm-migration-Don-t-calculate-bandwidth-when-last-cycl_2.patch [bz#970103]
  - kvm-buffered_flush-return-errors.patch [bz#970103]
  - kvm-bandwidth_limit-standarize-in-size_t.patch [bz#970103]
  - kvm-fix-bz-1196970.patch [bz#1196970]
  - Resolves: bz#1196970
    (Migrate status is failed after migrate_cancel.)
  - Resolves: bz#970103
    (Downtime during live migration of busy VM is much higher than migration_downtime in vdsm.conf)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.448.el6_6.2
changelog:
  - kvm-cirrus-fix-blit-region-check.patch [bz#1170571]
  - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrus_bltbuf.patch [bz#1170571]
  - Resolves: bz#1170571
    (CVE-2014-8106 qemu-kvm: qemu: cirrus: insufficient blit region checks [rhel-6.6.z])


author: Josef Ridky <jridky@redhat.com> - 1:5.5-58.el6
changelog:
  - Resolves: #1315481 - An SNMPv3 request with a small max message size can lead to SNMPv1/2c bulk requests timing out


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.5
changelog:
  - Intel CPU microcode update to 20180807a (#1614427).
  - Add check for minimal microcode version to reload_microcode.


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-16.1
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171208)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-16.2
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173566)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173566)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-16.3
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183671)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183679)


author: Bob Relyea <rrelyea@redhat.com> - 3.14.3-21
changelog:
  - Require nss-softokn-freebl of at least the same version and release
  - Resolves: Bug 1182662 - nss-softokn-3.14.3-19.el6_6 breaking yum and rpm


author: Kai Engert <kaie@redhat.com> - 2017.2.20-65.1
changelog:
  - Update to CKBI 2.20 from NSS 3.34.1 with legacy modifications.
    In the original upstream release, Mozilla.org removed all trust for
    the code signing usage. As part of the default legacy configuration,
    this package retains code signing trust for all CAs that are still
    trusted for the server authentication usage.
    The ca-legacy disable configuration disables all code signing trust.


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-60.0
changelog:
  -Update to CKBI 2.32 from NSS 3.44
  -   Removing:
  -    # Certificate "Visa eCommerce Root"
  -    # Certificate "AC Raiz Certicamara S.A."
  -    # Certificate "TC TrustCenter Class 3 CA II"
  -    # Certificate "ComSign CA"
  -    # Certificate "S-TRUST Universal Root CA"
  -    # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5"
  -    # Certificate "Certplus Root CA G1"
  -    # Certificate "Certplus Root CA G2"
  -    # Certificate "OpenTrust Root CA G1"
  -    # Certificate "OpenTrust Root CA G2"
  -    # Certificate "OpenTrust Root CA G3"
  -   Adding:
  -    # Certificate "GlobalSign Root CA - R6"
  -    # Certificate "OISTE WISeKey Global Root GC CA"
  -    # Certificate "GTS Root R1"
  -    # Certificate "GTS Root R2"
  -    # Certificate "GTS Root R3"
  -    # Certificate "GTS Root R4"
  -    # Certificate "UCA Global G2 Root"
  -    # Certificate "UCA Extended Validation Root"
  -    # Certificate "Certigna Root CA"
  -    # Certificate "emSign Root CA - G1"
  -    # Certificate "emSign ECC Root CA - G3"
  -    # Certificate "emSign Root CA - C1"
  -    # Certificate "emSign ECC Root CA - C3"
  -    # Certificate "Hongkong Post Root CA 3"


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-65.1
changelog:
  - Remove expired 1024 bit roots
  -    Removing:
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure CA"
  -     # Certificate "ValiCert Class 1 VA"
  -     # Certificate "ValiCert Class 2 VA"
  -     # Certificate "RSA Root Certificate 1"
  -     # Certificate "Entrust.net Secure Server CA"
  -     # Certificate "NetLock Business (Class B) Root"
  -     # Certificate "NetLock Express (Class C) Root"


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Remove upstreamed patch for RH1151372.
  - Regenerate add-final-location-rpaths patch against new release.
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180291


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Regenerate add-final-location-rpaths patch against new release.
  - Resolves: rhbz#1180291


author: Jiri Skala <jskala@redhat.com> - 4.0.9-1
changelog:
  - Resolves: #602838 - CVE-2010-2251 lftp: multiple HTTP client download filename vulnerability
  - re-base to latest upstream version


author: Tomas Hozza <thozza@redhat.com> - 4.0.9-3
changelog:
  - Fix lftp to try also other addresses if connecting to first fails (#732863)
  - Fix lftp hang when using ascii mode with sftp (#842322)
  - Fix lftp to overwrite filename when auto-rename and clobber are enabled (#619777)
  - Add description of xfer:auto-rename into man page (#674875)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-56
changelog:
  - Resolves: #1310582 - when ProxyErrorOverride is On, modcluster return
    503 status code on subsequent requests


author: Miloslav Trmač <mitr@redhat.com> - 0.96-6
changelog:
  - Use real --help text and error messages instead of showing a man page in
    pkaction and pkcheck.  Fix description of (pkaction --action-id) in the man 
    page.
    Resolves: #628862
  - Add support for Identity=default in .pkla files
    Resolves: #812684
  - Use a consistent order for .pkla files within a directory.  Based on a patch
    by Jared Jennings <jared.jennings.ctr@eglin.af.mil>.
    Resolves: #864613
  - Build using PIE and relro
    Resolves: #927406


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.92
changelog:
  - Modify 0246-RHBZ-1145442-raw-output-and-wildcards.patch
    * fix PAD and PRINT macros
  - Resolves: bz #1145442


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.93
changelog:
  - Add 0250-RHBZ-1316165-fix-i686-size-bug.patch
    * make multipathd use uint64_t for tracking the interactive command
      fingerprint.
  - Resolves: bz #1316165


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.94
changelog:
  - Add 0251-RHBZ-1349376-fix-makefile.patch
    * make multipath use correct version of libdevmapper
  - Add 0252-RHBZ-1333334-huawei-config.patch
  - Add 0253-RHBZ-1305589-check-multipathd.patch
    * warn if multipath devices exist and mutipathd is not running
  - Add 0254-RHBZ-1310320-no-kpartx.patch
    * add skip_kpartx option to skip kpartx device creation
  - Add 0255-UPBZ-1322532-disable-reinstate.patch
    * do not reinstate unusable Implicit ALUA ghost paths
  - Add 0256-RHBZ-1324764-man-page-typo.patch
  - Add 0257-UPBZ-1328077-resize-map.patch
    * reset size if resizer operation fails
  - Add 0259-UPBZ-1343747-dont-fail-discovery.patch
    * keep multipath from failing if it fails to get information on any device
  - Add 0260-RHBZ-1364879-check-mpath-prefix.patch
    * ignore all devices that don't have a uuid starting with "mpath-"
  - Add 0261-RHBZ-1377532-disable-changed-paths.patch
    * do not use path devices that change their wwid
  - Resolves: bz #1299644, #1305589, #1310320, #1322532, #1324764, #1328077
  - Resovles: bz #1333334, #1343747, #1349376, #1364879, #1377532


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.95
changelog:
  - Modify 0254-RHBZ-1310320-no-kpartx.patch
    * fix small bug with unitialized data
  - Refresh 0261-RHBZ-1377532-disable-changed-paths.patch
  - Add 0262-RH-free-vector.patch
    * Fix coverity discovered bug in error path
  - Resolves: bz #1310320


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.96
changelog:
  - Add 0258-UPBZ-1300414-PURE_config.patch
  - Add 0264-RHBZ-1365710-no-use-after-free.patch
    * Fix two segfaults, and NULL out some structures after free
  - Add 0265-RHBZ-1390472-dont-exit.patch
    * don't exit if multipath hits recoverable errors during startup
  - Resolves: bz #1300414, #1365710, #1390472


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.97
changelog:
  - Add 0265-RHBZ-1355669-max-sectors-kb.patch
    * add "max_sectors_kb" config option to set this value on all paths
  - Change devicemapper Requires to >= 1.02.117-9.el6 (bz #1344381)
    * forces multipath to use latest version of blk-availability
  - Resolves: bz #1344381, #1355669


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.98
changelog:
  - Add 0266-RHBZ-1401391-fix-prio-put.patch
    * don't try to drop a nonexistant prio handler
  - Add 0267-RHBZ-1401769-orphan-status.patch
    * don't print out checker and device status for orphan paths
  - Resolves: bz #1401391, #1401769


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.100
changelog:
  - Modify 0261-RHBZ-1377532-disable-changed-paths.patch
    * add man page information
  - Refresh 0265-RHBZ-1355669-max-sectors-kb.patch
  - Related: #1377532


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.100.1
changelog:
  - Add 0268-RHBZ-1497059-fix-reserve.patch
    * stop waiting for threads that weren't successfully created
  - Resolves: bz #1497059


author: Carlos O'Donell <carlos@redhat.com> - 2.12-1.158
changelog:
  - Enhance nscd to detect any configuration file changes (#859965).
  - Fix __times() handling of EFAULT when buf is NULL (#1124204).
  - Fix memory leak with dlopen() and thread-local storage variables (#978098).
  - Prevent getaddrinfo from writing DNS queries to random fd (CVE-2013-7423,
    - Implement userspace half of in6.h header coordination (#1053178).
  - Correctely size relocation cache used by profiler (#1144132).
  - Fix reuse of cached stack leading to bounds overrun of DTV (#1116050).


author: Carlos O'Donell <carlos@redhat.com> - 2.12-1.166.1
changelog:
  - The malloc deadlock avoidance support has been temporarily removed since it
    triggers deadlocks in certain applications (#1244002).


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.11-1
changelog:
  - Update to sblim-sfcb-1.3.11
    Resolves: #633580
  - Compile with --enable-uds, i. e. enable unix domain socket local connect functionality
    Resolves: #620303
  - Create sfcb system group (used by basic authentication with PAM) in pre install scriptlet,
    remove it in post uninstall scriptlet
    Resolves: #618081
  - Fix default location where sfcbrepos is looking for schema files
    and simplify sfcbrepos command in post install sciptlet
    Resolves: #618080


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.3.11-2
changelog:
  - Checks for valid pointer before calling free() in providerDrv.c,
    result.c and support.c (backported from upstream)


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-504.18.1.el6]
changelog:
  - [fs] cifs: Use key_invalidate instead of the rh_key_invalidate() (Sachin Prabhu) [1203366 885899]
  - [fs] KEYS: Add invalidation support (Sachin Prabhu) [1203366 885899]
  - [infiniband] core: Prevent integer overflow in ib_umem_get address arithmetic (Doug Ledford) [1181173 1179327] {CVE-2014-8159}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.20.1.el6]
changelog:
  - [fs] exec: do not abuse ->cred_guard_mutex in threadgroup_lock() (Petr Oros) [1208620 1169225]
  - [kernel] cgroup: always lock threadgroup during migration (Petr Oros) [1208620 1169225]
  - [kernel] threadgroup: extend threadgroup_lock() to cover exit and exec (Petr Oros) [1208620 1169225]
  - [kernel] threadgroup: rename signal->threadgroup_fork_lock to ->group_rwsem (Petr Oros) [1208620 1169225]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.21.1.el6]
changelog:
  - [netdrv] ixgbe: Fix memory leak in ixgbe_free_q_vector, missing rcu (John Greene) [1210901 1150343]
  - [netdrv] ixgbe: Fix tx_packets and tx_bytes stats not updating (John Greene) [1210901 1150343]
  - [netdrv] qlcnic: Fix update of ethtool stats (Chad Dupuis) [1210902 1148019]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.22.1.el6]
changelog:
  - [kernel] hrtimer: Prevent hrtimer_enqueue_reprogram race (Prarit Bhargava) [1211940 1136958]
  - [kernel] hrtimer: Preserve timer state in remove_hrtimer() (Prarit Bhargava) [1211940 1136958]
  - [crypto] testmgr: fix RNG return code enforcement (Herbert Xu) [1212695 1208804]
  - [net] netfilter: xtables: make use of caller family rather than target family (Florian Westphal) [1212057 1210697]
  - [net] dynticks: avoid flow_cache_flush() interrupting every core (Marcelo Leitner) [1210595 1191559]
  - [tools] perf: Fix race in build_id_cache__add_s() (Milos Vyletel) [1210593 1204102]
  - [infiniband] ipath+qib: fix dma settings (Doug Ledford) [1208621 1171803]
  - [fs] dcache: return -ESTALE not -EBUSY on distributed fs race (J. Bruce Fields) [1207815 1061994]
  - [net] neigh: Keep neighbour cache entries if number of them is small enough (Jiri Pirko) [1207352 1199856]
  - [x86] crypto: sha256_ssse3 - also test for BMI2 (Herbert Xu) [1204736 1201560]
  - [scsi] qla2xxx: fix race in handling rport deletion during recovery causes panic (Chad Dupuis) [1203544 1102902]
  - [redhat] configs: Enable SSSE3 acceleration by default (Herbert Xu) [1201668 1036216]
  - [crypto] sha512: Create module providing optimized SHA512 routines using SSSE3, AVX or AVX2 instructions (Herbert Xu) [1201668 1036216]
  - [crypto] sha512: Optimized SHA512 x86_64 assembly routine using AVX2 RORX instruction (Herbert Xu) [1201668 1036216]
  - [crypto] sha512: Optimized SHA512 x86_64 assembly routine using AVX instructions (Herbert Xu) [1201668 1036216]
  - [crypto] sha512: Optimized SHA512 x86_64 assembly routine using Supplemental SSE3 instructions (Herbert Xu) [1201668 1036216]
  - [crypto] sha512: Expose generic sha512 routine to be callable from other modules (Herbert Xu) [1201668 1036216]
  - [crypto] sha256: Create module providing optimized SHA256 routines using SSSE3, AVX or AVX2 instructions (Herbert Xu) [1201668 1036216]
  - [crypto] sha256: Optimized sha256 x86_64 routine using AVX2's RORX instructions (Herbert Xu) [1201668 1036216]
  - [crypto] sha256: Optimized sha256 x86_64 assembly routine with AVX instructions (Herbert Xu) [1201668 1036216]
  - [crypto] sha256: Optimized sha256 x86_64 assembly routine using Supplemental SSE3 instructions (Herbert Xu) [1201668 1036216]
  - [crypto] sha256: Expose SHA256 generic routine to be callable externally (Herbert Xu) [1201668 1036216]
  - [crypto] rng: RNGs must return 0 in success case (Herbert Xu) [1201669 1199230]
  - [fs] isofs: infinite loop in CE record entries (Jacob Tanenbaum) [1175243 1175245] {CVE-2014-9420}
  - [x86] vdso: ASLR bruteforce possible for vdso library (Jacob Tanenbaum) [1184896 1184897] {CVE-2014-9585}
  - [kernel] time: ntp: Correct TAI offset during leap second (Prarit Bhargava) [1201674 1199134]
  - [scsi] lpfc: correct device removal deadlock after link bounce (Rob Evers) [1211910 1194793]
  - [scsi] lpfc: Linux lpfc driver doesn't re-establish the link after a cable pull on LPe12002 (Rob Evers) [1211910 1194793]
  - [x86] switch_to(): Load TLS descriptors before switching DS and ES (Denys Vlasenko) [1177353 1177354] {CVE-2014-9419}
  - [net] vlan: Don't propagate flag changes on down interfaces (Jiri Pirko) [1173501 1135347]
  - [net] bridge: register vlan group for br ports (Jiri Pirko) [1173501 1135347]
  - [netdrv] tg3: Use new VLAN code (Jiri Pirko) [1173501 1135347]
  - [netdrv] be2net: move to new vlan model (Jiri Pirko) [1173501 1135347]
  - [net] vlan: mask vlan prio bits (Jiri Pirko) [1173501 1135347]
  - [net] vlan: don't deliver frames for unknown vlans to protocols (Jiri Pirko) [1173501 1135347]
  - [net] vlan: allow nested vlan_do_receive() (Jiri Pirko) [1173501 1135347]
  - [net] allow vlan traffic to be received under bond (Jiri Pirko) [1173501 1135347]
  - [net] vlan: goto another_round instead of calling __netif_receive_skb (Jiri Pirko) [1173501 1135347]
  - [net] bonding: fix bond_arp_rcv setting and arp validate desync state (Jiri Pirko) [1173501 1135347]
  - [net] bonding: remove packet cloning in recv_probe() (Jiri Pirko) [1173501 1135347]
  - [net] bonding: Fix LACPDU rx_dropped commit (Jiri Pirko) [1173501 1135347]
  - [net] bonding: don't increase rx_dropped after processing LACPDUs (Jiri Pirko) [1173501 1135347]
  - [net] bonding: use local function pointer of bond->recv_probe in bond_handle_frame (Jiri Pirko) [1173501 1135347]
  - [net] bonding: move processing of recv handlers into handle_frame() (Jiri Pirko) [1173501 1135347]
  - [netdrv] revert "bonding: fix bond_arp_rcv setting and arp validate desync state" (Jiri Pirko) [1173501 1135347]
  - [netdrv] revert "bonding: check for vlan device in bond_3ad_lacpdu_recv()" (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Always untag vlan-tagged traffic on input (Jiri Pirko) [1173501 1135347]
  - [net] Make skb->skb_iif always track skb->dev (Jiri Pirko) [1173501 1135347]
  - [net] vlan: fix a potential memory leak (Jiri Pirko) [1173501 1135347]
  - [net] vlan: fix mac_len recomputation in vlan_untag() (Jiri Pirko) [1173501 1135347]
  - [net] vlan: reset headers on accel emulation path (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Fix the ingress VLAN_FLAG_REORDER_HDR check (Jiri Pirko) [1173501 1135347]
  - [net] vlan: make non-hw-accel rx path similar to hw-accel (Jiri Pirko) [1173501 1135347]
  - [net] allow handlers to be processed for orig_dev (Jiri Pirko) [1173501 1135347]
  - [net] bonding: get netdev_rx_handler_unregister out of locks (Jiri Pirko) [1173501 1135347]
  - [net] bonding: fix rx_handler locking (Jiri Pirko) [1173501 1135347]
  - [net] introduce rx_handler results and logic around that (Jiri Pirko) [1173501 1135347]
  - [net] bonding: register slave pointer for rx_handler (Jiri Pirko) [1173501 1135347]
  - [net] bonding: COW before overwriting the destination MAC address (Jiri Pirko) [1173501 1135347]
  - [net] bonding: convert bonding to use rx_handler (Jiri Pirko) [1173501 1135347]
  - [net] openvswitch: use rx_handler_data pointer to store vport pointer (Jiri Pirko) [1173501 1135347]
  - [net] add a synchronize_net() in netdev_rx_handler_unregister() (Jiri Pirko) [1173501 1135347]
  - [net] add rx_handler data pointer (Jiri Pirko) [1173501 1135347]
  - [net] replace hooks in __netif_receive_skb (Jiri Pirko) [1173501 1135347]
  - [net] fix conflict between null_or_orig and null_or_bond (Jiri Pirko) [1173501 1135347]
  - [net] remove the unnecessary dance around skb_bond_should_drop (Jiri Pirko) [1173501 1135347]
  - [net] revert "bonding: fix receiving of dups due vlan hwaccel" (Jiri Pirko) [1173501 1135347]
  - [net] uninline skb_bond_should_drop() (Jiri Pirko) [1173501 1135347]
  - [net] bridge: Set vlan_features to allow offloads on vlans (Jiri Pirko) [1173501 1135347]
  - [net] bridge: convert br_features_recompute() to ndo_fix_features (Jiri Pirko) [1173501 1135347]
  - [net] revert "bridge: explictly tag vlan-accelerated frames destined to the host" (Jiri Pirko) [1173501 1135347]
  - [net] revert "fix vlan gro path" (Jiri Pirko) [1173501 1135347]
  - [net] revert "bridge: do not learn from exact matches" (Jiri Pirko) [1173501 1135347]
  - [net] revert "bridge gets duplicate packets when using vlan over bonding" (Jiri Pirko) [1173501 1135347]
  - [net] llc: remove noisy WARN from llc_mac_hdr_init (Jiri Pirko) [1173501 1135347]
  - [net] bridge: stp: ensure mac header is set (Jiri Pirko) [1173501 1135347]
  - [net] vlan: remove reduntant check in ndo_fix_features callback (Jiri Pirko) [1173501 1135347]
  - [net] vlan: enable soft features regardless of underlying device (Jiri Pirko) [1173501 1135347]
  - [net] vlan: don't call ndo_vlan_rx_register on hardware that doesn't have vlan support (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Fix vlan_features propagation (Jiri Pirko) [1173501 1135347]
  - [net] vlan: convert VLAN devices to use ndo_fix_features() (Jiri Pirko) [1173501 1135347]
  - [net] revert "vlan: Avoid broken offload configuration when reorder_hdr is disabled" (Jiri Pirko) [1173501 1135347]
  - [net] vlan: vlan device is lockless do not transfer real_num_<tx|rx>_queues (Jiri Pirko) [1173501 1135347]
  - [net] vlan: consolidate 8021q tagging (Jiri Pirko) [1173501 1135347]
  - [net] propagate NETIF_F_HIGHDMA to vlans (Jiri Pirko) [1173501 1135347]
  - [net] Fix a memmove bug in dev_gro_receive() (Jiri Pirko) [1173501 1135347]
  - [net] vlan: remove check for headroom in vlan_dev_create (Jiri Pirko) [1173501 1135347]
  - [net] vlan: set hard_header_len when VLAN offload features are toggled (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Calling vlan_hwaccel_do_receive() is always valid (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Centralize handling of hardware acceleration (Jiri Pirko) [1173501 1135347]
  - [net] vlan: finish removing vlan_find_dev from public header (Jiri Pirko) [1173501 1135347]
  - [net] vlan: make vlan_find_dev private (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Avoid hash table lookup to find group (Jiri Pirko) [1173501 1135347]
  - [net] revert "vlan: Add helper functions to manage vlans on bonds and slaves" (Jiri Pirko) [1173501 1135347]
  - [net] revert "bonding: assign slaves their own vlan_groups" (Jiri Pirko) [1173501 1135347]
  - [net] revert "bonding: fix regression on vlan module removal" (Jiri Pirko) [1173501 1135347]
  - [net] revert "bonding: Always add vid to new slave group" (Jiri Pirko) [1173501 1135347]
  - [net] revert "bonding: Fix up refcounting issues with bond/vlan config" (Jiri Pirko) [1173501 1135347]
  - [net] revert "8021q/vlan: filter device events on bonds" (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Use vlan_dev_real_dev in vlan_hwaccel_do_receive (Jiri Pirko) [1173501 1135347]
  - [net] gro: __napi_gro_receive() optimizations (Jiri Pirko) [1173501 1135347]
  - [net] vlan: Rename VLAN_GROUP_ARRAY_LEN to VLAN_N_VID (Jiri Pirko) [1173501 1135347]
  - [net] vlan: make vlan_hwaccel_do_receive() return void (Jiri Pirko) [1173501 1135347]
  - [net] vlan: init_vlan should not copy slave or master flags (Jiri Pirko) [1173501 1135347]
  - [net] vlan: updates vlan real_num_tx_queues (Jiri Pirko) [1173501 1135347]
  - [net] vlan: adds vlan_dev_select_queue (Jiri Pirko) [1173501 1135347]
  - [net] llc: use dev_hard_header (Jiri Pirko) [1173501 1135347]
  - [net] vlan: support "loose binding" to the underlying network device (Jiri Pirko) [1173501 1135347]
  - [net] revert "net: don't set VLAN_TAG_PRESENT for VLAN 0 frames" (Jiri Pirko) [1173501 1135347]
  - [net] bridge: Add support for TX vlan offload (Jiri Pirko) [1173562 1146391]
  - [net] revert "bridge: Set vlan_features to allow offloads on vlans" (Vlad Yasevich) [1144442 1121991]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.23.1.el6]
changelog:
  - [x86] crypto: sha256_ssse3 - fix stack corruption with SSSE3 and AVX implementations (Herbert Xu) [1218681 1201490]
  - [scsi] storvsc: ring buffer failures may result in I/O freeze (Vitaly Kuznetsov) [1215754 1171676]
  - [scsi] storvsc: get rid of overly verbose warning messages (Vitaly Kuznetsov) [1215753 1167967]
  - [scsi] storvsc: NULL pointer dereference fix (Vitaly Kuznetsov) [1215753 1167967]
  - [netdrv] ixgbe: fix detection of SFP+ capable interfaces (John Greene) [1213664 1150343]
  - [x86] crypto: aesni - fix memory usage in GCM decryption (Kurt Stutsman) [1213329 1213330] {CVE-2015-3331}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.23.2.el6]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202860 1185166] {CVE-2015-1805}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.23.3.el6]
changelog:
  - [netdrv] bonding: fix locking in enslave failure path (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: primary_slave & curr_active_slave are not cleaned on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: vlans don't get deleted on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: mc addresses don't get deleted on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: IFF_BONDING is not stripped on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: fix error handling if slave is busy v2 (Nikolay Aleksandrov) [1222483 1221856]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.23.4.el6]
changelog:
  - [crypto] drbg: fix maximum value checks on 32 bit systems (Herbert Xu) [1225950 1219907]
  - [crypto] drbg: remove configuration of fixed values (Herbert Xu) [1225950 1219907]


author: Elio Maldonado <emaldona@redhat.com> - 4.9.5-3
changelog:
  - Bump the release tag so it's higher than the one for rhel-6.4.z
  - Resolves: rhbz#919180 - Rebase to nspr-4.9.5


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-1
changelog:
  - Update Version to 4.10.0 to prevent Mozilla apps update problems as
  - reported and fixed on https://bugzilla.redhat.com/show_bug.cgi?id=981166
  - Resolves: rhbz#1002643 - Rebase RHEL 6 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Rebase to nspr-4.10.2
  - Resolves: rhbz#1032488 - CVE-2013-5607 (MFSA 2013-103) Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269360 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Jeff E. Nelson <> - 0.12.1.2-2.439.el6
changelog:
  - kvm-spice-fix-libvirt-snapshots.patch [bz#1010670]
  - kvm-ide-Ignore-double-DMA-transfer-starts-stops.patch [bz#1104573]
  - kvm-ide-Reset-current_addr-after-stopping-DMA.patch [bz#1104573]
  - kvm-ide-Reset-BMIDEA-bit-when-the-bus-master-is-stopped.patch [bz#1104573]
  - Resolves: bz#1010670
    (spice session is closed when taking snapshot with ram)
  - Resolves: bz#1104573
    (DMA error when install RHEL.5.11.x86_64 guest (ide drive) on RHEL6.5.z host)


author: Jeff E. Nelson <> - 0.12.1.2-2.440.el6
changelog:
  - kvm-hw-qdev-emit-DEVICE_DELETED-event-only-if-the-device.patch [bz#1124314]
  - kvm-ide-Fix-segfault-when-flushing-a-device-that-doesn-t.patch [bz#1120541]
  - Resolves: bz#1120541
    (qemu-kvm crashed when doing iofuzz testing)
  - Resolves: bz#1124314
    (incorrect event reported by QMP on hot plugging an in-use VF to guest)


author: Marek Kasik <mkasik@redhat.com> 2.3.11-7
changelog:
  - Add freetype-2.3.11-CVE-2010-3855.patch
      (Protect against invalid `runcnt' values.)
  - Resolves: #651762


author: Marek Kasik <mkasik@redhat.com> 2.3.11-8
changelog:
  - Add freetype-2.3.11-CVE-2011-0226.patch
      (Add better argument check for `callothersubr'.)
      - based on patches by Werner Lemberg,
        Alexei Podtelezhnikov and Matthias Drochner
  - Resolves: #723468


author: Marek Kasik <mkasik@redhat.com> - 2.3.11-15.el6_6.1
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197737


author: Jiri Popelka <jpopelka@redhat.com> - 1:1.4.2-60
changelog:
  - CVE-2014-2856: cross-site scripting flaw (bug #1117798)
  - CVE-2014-3537: insufficient checking leads to privilege escalation (bug #1117794)


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-63
changelog:
  - Applied upstream patch to fix CVE-2014-5029 (bug #1122600),
    CVE-2014-5030 (bug #1128764), CVE-2014-5031 (bug #1128767).
  - Fix conf/log file reading for authenticated users (STR #4461).


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-66
changelog:
  - More STR #4461 fixes from upstream: make rss feeds world-readable,
    but cachedir private.
  - Fix icon display in web interface during server restart (STR #4475).


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-52
changelog:
  - deprecate and disable verification of insecure hash algorithms
  - disallow DH keys with less than 1024 bits in TLS client
  - remove support for weak and export ciphersuites
  - use correct digest when exporting keying material in TLS1.2 (#1376741)


author: Petr Pisar <ppisar@redhat.com> - 2.0.4-12
changelog:
  - Fix CVE-2011-2767 (arbitrary Perl code execution in the context of the user
    account via a user-owned .htaccess) (bug #1626272)


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.166.2
changelog:
  - Unlock main arena after allocation in calloc (#1256812).
  - Enable robust malloc change again (#1256812).
  - Fix perturbing in malloc on free and simply perturb_byte (#1256812).
  - Don't fall back to mmap prematurely (#1256812).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.166.3
changelog:
  - Check for NULL arena pointer in _int_pvalloc (#1256890).
  - Don't change no_dyn_threshold on mallopt failure (#1256891).


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-3
changelog:
  - fix problems found by qe:
  - AC13: SSL3 "disabled"
  - AC26: Chacha20 and TLS 1.3 ciphers should be prioritized
  -   SHA-384 PRF => *_256_GCM_SHA384 ciphers should be reenabled for consistency
  - AC28: nss-policy-check is missing from packages and $PATH
  - extra: apostrophes in certutil manpage got mangled


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Chris Feist <cfeist@redhat.com> - 0.16.2-70
changelog:
  - Added ability to create/remove uidgid entries for corosync in cluster.conf
  - Resolves: rhbz#1025053


author: Chris Feist <cfeist@redhat.com> - 0.16.2-71
changelog:
  - Added --noenable/--nodisable options when starting/stoping cluster
  - Only propagate/activate cluster on last node when using --activate
  - ccs no longer returns 0 when --startall/--stopall fails on a node
  - If not hostname or filename is specified, use 'localhost'
  - Don't leave tempfiles around from schema tests
  - Resolves: rhbz#1090642 rhbz#917809 rhbz#1062402 rhbz#1024962 rhbz#996196


author: Chris Feist <cfeist@redhat.com> - 0.16.2-72
changelog:
  - Added '-s' option to disable SSLv2 connections to ricci
  - Added ability to configure RICCIOPTS variable in /etc/sysconfig/cluster
    or /etc/sysconfig/ricci
  - Resolves: rhbz#1075176


author: Jan Pokorny <jpokorny@redhat.com> - 0.16.2-73
changelog:
  - ricci: fix end-use modules do not handle stdin polling correctly
  - ricci: fix missing deployment-time dependencies
  - ricci: prevent possible reboot loop
  - Resolves: rhbz#1076713 rhbz#1106842 rhbz#1044122


author: Jan Pokorny <jpokorny@redhat.com> - 0.16.2-74
changelog:
  - ccs: sync cluster.rng schema with latest updates from cluster packages
  - ricci: enhance possible reboot loop prevention (avoid stale batches)
  - Resolves: rhbz#1055424 rhbz#1044122


author: Jan Pokorny <jpokorny@redhat.com> - 0.16.2-75
changelog:
  - ccs: sync cluster.rng schema with latest updates from cluster packages
    (last-minute revamp)
  - Resolves: rhbz#1055424


author: Jan Pokorný <jpokorny@redhat.com> - 0.16.2-75.1
changelog:
  - ricci: fix modules cannot return values due to bug in Module::empty_response
           (introduced with rhbz#1044122 fix)
  - Resolves: rhbz#1199561 (Z-stream of 1187745)


author: Jan Horak <jhorak@redhat.com> - 31.3.0-6
changelog:
  - Fixed rhbz#1164855 - firefox.desktop is missing
    x-scheme-handler MimeType entries
  - Fixed problems with dictionaries (mozbz#1097550)


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-0.3
changelog:
  - Rebase RHEL 6.7.z to NSS-util 3.21 in preparation for Firefox 45
  - Resolves: Bug 1299874
  - Update upstream patch for CVE-2016-1950


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.5
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271928


author: Filip Krska <fkrska@redhat.com> = 3.2-63
changelog:
  [archive] compress tarball without a timeout
    Resolves: bz1439943
    [policies] stop execution on Ctrl+C during user input
    Resolves: bz1567054


author: Filip Krska <fkrska@redhat.com> = 3.2-63.1
changelog:
  [archive] Force decoding if content is bytes
    [reporting] deal with UTF-8 characters
    Resolves: bz1599234


author: Filip Krska <fkrska@redhat.com> = 3.2-63.3
changelog:
  [smartcard] Stop collecting pkcs11_inspect debug
    Resolves: bz1567063
    [satellite] don't collect /root/ssl-build
    Resolves: bz1667018


author: Mark Reynolds <mreynolds@redhat,com> - 1.2.11.15-91
changelog:
  - Release 1.2.11.15-91
  - Resolves: bug 1437776 - EMBARGOED CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-95
changelog:
  - Release 1.2.11.15-95
  - Resolves: Bug 1562152 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch
  - Resolves: Bug 1544415 - CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (fix cherry-pick error)
  - Resolves: Bug 1543798 - EMBARGOED CVE-2018-1054 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-97
changelog:
  - Bump version to 1.2.11.15-97
  - Resolves: Bug 1563539 - acl_copyEval_context double free (fix spec file patch)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
  - July 2015 security update to u51b16.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
  - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
  - Re-generate EC disablement patch following CPU DH changes.
  - Resolves: rhbz#1235160


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
  - update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
  - merge-review cosmetics (#226429)
    - drop ancient sqlite3 obsoletes
    - fix tab vs space whitespace issues
    - remove commas from summaries
  - fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
  - update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
  - disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
  - update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
  - drop no longer needed test-disabler patches


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-0.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Update PR1834/RH1022017 fix to reduce curves reported by SSL to apply against u121.
  - Re-generate RH1393047 ObjectInputStream patch against u121.
  - Resolves: rhbz#1410612


author: Adam Tkac <atkac redhat com> 1:0.17-46
changelog:
  - changes related package review (#226484)
  - remove unused patches
    - telnet-0.17-linemode.patch
    - telnet-0.17-env-5x.patch


author: Michal Sekletar <msekleta@redhat.com> 1:0.17-48
changelog:
  - reuse utmp entries correctly
  - break out from infinite loop if we tried to bind to non-existing address (#772912)
  - mitigate possibility of self-deadlock while updating utmp or wtmp (#832059)


author: Steve Dickson <steved@redhat.com> 1.2.3-65
changelog:
  - nfsidmap: make sure give arguments are valid (bz 1230600)
  - nfsidmap: Display the effective NFSv4 domain name (bz 948680)
  - gssd: allow gssd and svcgssd to set the libtirpc debug level (bz 1273161)
  - gssd: select non-conventional principal (bz 1268031)
  - gssd:  Don't assume the machine account will be in uppercase (bz 1273166)
  - sm-notify: delete files in sm.bak after a NOTIFY reply (bz 1278921)


author: Steve Dickson <steved@redhat.com> 1.2.3-66
changelog:
  - svc_create: Make sure errors are logged (bz 1156647)
  - gssd: suppress error message if rpc_pipefs dir disappears (bz 1220156)
  - gssd: set $HOME to prevent recursion (bz 1223661)
  - statd: Update existing record if we receive SM_MON... (bz 1280024)
  - mountstats.man: fixed typo in man page (bz 1263968)


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.74
changelog:
  - Add 0195-UPBZ-1024103-alua-prio-timeout.patch
    * change alua prioritizer timeout from 5 minutes to one minute
  - Resolves: bz #1024103


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.75
changelog:
  - Add 0196-RHBZ-1012672-fix-sysdev.patch
    * rewrite multipath sysfs device handling to fix various issues from
      bzs #1012672, #1064636, and #1049637
  - Add 0197-RHBZ-1049315-netapp-rw-change.patch
    * allow reload_rewrite to be set by device, and set it by default for
      netapp devices.
  - Add 0198-RHBZ-1080052-orphan-paths-on-reload.patch
    * make multipath orphan paths that are no longer included in the device
      when the table is reread.
  - Add 0199-RHBZ-1007719-multipath-man.patch
    * documentation update
  - Add 0200-RHBZ-1009061-allow_devt.patch
    * allow specifying paths to multipath by major:minor, instead of devname
  - Add 0201-RHBZ-1018697-cli-use-basename.patch
    * make multipathd interactive commands accept device names that start with
      /dev/
  - Add 0202-RHBZ-1024604-weighted-prio-man.patch
    * documentation update
  - Add 0203-RHBZ-1054046-mpathconf-typo.patch
    * fix command output typo
  - Add 0204-RHBZ-1067102-doc-add-selectors.patch
    * documentation update
  - Add 0205-RHBZ-1072974-alua-typo.patch
    * fix priritizer output typo
  - Add 0206-UPBZ-1020556-e-series-config.patch
    * udpate E-Series config to autodetect prio and hardware handler.
  - Resolves: bz #1049637, #1064636, #1049315, #1080052, #1007719, #1009061
  - Resolves: bz #1018697, #1024604, #1054046, #1067102, #1072974, #1020556


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.76
changelog:
  - Add 0207-UPBZ-1027061-sg-read-use-buffsize.patch
    * make readsector0 checker calculate the number of blocks to read based
      on the buffer size and the block size
  - Add 0208-UPBZ-1028220-datacore-config.patch
    * Add support for DataCore Virtual Disk
  - Add 0209-RHBZ-999766-update-annotated.patch
    * update multipath.conf.annotated
  - Add 0210-UPBZ-1099932-fast-io-fail-iscsi.patch
    * and iscsi support for fast_io_fail_tmo
  - Add 0211-UPBZ-1088013-reorder-paths-for-round-robin.patch
    * make multipathd order paths for better throughput in round-robin mode
  - Add 0212-RHBZ-1086417-orphan-path-on_failed-add.patch
    * If multipathd fails to add path correctly, it now fully orphans the path
  - Add 0213-RHBZ-1069641-config-error-checking.patch
    * Improve multipath.conf error checking.
  - Resolves: bz #1027061, #1028220, #999766, #1099932, #1088013, #1086417
  - Resolves: bz #1069641


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.77
changelog:
  - Add 0214-RHBZ-1078485-configurable-prio-timeout.patch
    * checker_timeout now adjusts the timeouts of the prioritizers as well.
  - Add 0215-RHBZ-1054747-add-noasync-option.patch
    * Add a new defaults option, "force_sync", that disables the async mode
      of the path checkers. This is for cases where to many parallel checkers
      hog the CPU
  - Add 0216-RHBZ-1095868-multipathd-man-typo.patch
  - Add 0217-RHBZ-1101101-add-w-options.patch
    * multipath now includes the -w and -W options. -w makes multipath remove
      a wwid from the wwids file. -W removes all of the wwids, except for the
      ones belonging to the current multipath devices, from the bindings file.
  - Resolves: bz #1078485, #1054747, #1095868, #1101101


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.78
changelog:
  - Modify 0196-RHBZ-1012672-fix-sysdev.patch
    * remove unused function, and fix NULL ptr dereference
  - Modify 0211-UPBZ-1088013-reorder-paths-for-round-robin.patch
    * Fix some pointer errors
  - Modify 0213-RHBZ-1069641-config-error-checking.patch
    * Stop allocating extra memory in config parser.
  - Related: bz #1049637, #1069641, #1088013


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.79
changelog:
  - Modify 0198-RHBZ-1080052-orphan-paths-on-reload.patch
    * Fix case where pathlist wasn't getting updated properly
  - Related: bz #1080052


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80
changelog:
  - Add 0218-RHBZ-1117714-configure-missing-devs.patch
    * handle externally removed devices during configuration.
  - Resolves: bz #1117714


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80.1
changelog:
  - Add 0219-RHBZ-1136966-fix-partition-mapping-creation-race-with-kpartx.patch
    * Only run kpartx on device activation
  - Resolves: bz #1162265


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80.2
changelog:
  - Add 0220-RHBZ-1179728-add-wwid-option.patch
    * add multipath option "-a". To add a device's wwid to the wwids file
  - Add 0221-RHBZ-1179728-cmdline-wwid.patch
    * make multipathd read wwids specified by the kernel commandline mpath.wwid
      option on startup.
  - Resolves: bz #1179728


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80.3
changelog:
  - Add 0222-RHBZ-1187217-thread-safe.patch
    * only multipathd will keep a global cache of sysfs information
      for paths.
  - Resolves: bz #1187217


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.483.el6
changelog:
  - kvm-rtl8139-Fix-receive-buffer-overflow-check.patch [bz#1262866]
  - kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in.patch [bz#1262866]
  - Resolves: bz#1262866
    ([RHEL6] Package is 100% lost when ping from host to Win2012r2 guest with 64000 size)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.484.el6
changelog:
  - kvm-qga-flush-explicitly-when-needed.patch [bz#1210246]
  - kvm-qga-add-guest-set-user-password-command.patch [bz#1174181]
  - kvm-qcow2-Zero-initialise-first-cluster-for-new-images.patch [bz#1223216]
  - kvm-Documentation-Warn-against-qemu-img-on-active-image.patch [bz#1297424]
  - kvm-target-i386-warns-users-when-CPU-threads-1-for-non-I.patch [bz#1292678]
  - kvm-qemu-options-Fix-texinfo-markup.patch [bz#1250442]
  - kvm-qga-Fix-memory-allocation-pasto.patch []
  - kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work-.patch [bz#1268347]
  - Resolves: bz#1174181
    (RFE: provide QEMU guest agent command for setting root/administrator account password)
  - Resolves: bz#1210246
    ([virtagent]The 'write' content is lost if 'read' it before flush through guest agent)
  - Resolves: bz#1223216
    (qemu-img can not create qcow2 image when backend is block device)
  - Resolves: bz#1250442
    (qemu-doc.html bad markup in section 3.3 Invocation)
  - Resolves: bz#1268347
    (posix_fallocate emulation on NFS fails with Bad file descriptor if fd is opened O_WRONLY)
  - Resolves: bz#1292678
    (Qemu should report error when cmdline set threads=2 in amd host)
  - Resolves: bz#1297424
    (Add warning about running qemu-img on active VMs to its manpage)


author: Marek Kasik <mkasik@redhat.com> - 2.24.1-2
changelog:
  - Import gdk-pixbuf2 package from F16
  - Disable introspection
  - Add update-gdk-pixbuf-loaders
  - Resolves: #1103734


author: - Bastien Nocera <bnocera@redhat.com> - 1.2.0-3
changelog:
  - Make a few functions hidden, to try and avoid textrels
  - Disable optimisations on x86 for the same reason
    (#285961)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.2.1-2
changelog:
  - fix building with gcc-4.3 
  - reenable some assembly optimizations
  - hide private libFLAC symbols (#285961)
  - update license tag
  - add %check
  - remove -maltivec from CFLAGS


author: Miroslav Lichvar <mlichvar@redhat.com> 1.2.1-7
changelog:
  - fix buffer overflow when processing ID3v2 metadata (CVE-2014-8962)
  - fix buffer overflow with invalid blocksize (CVE-2014-9028)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-18.el6
changelog:
  - CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1149086)
  - Fix html serialization error and htmlSetMetaEncoding (rhbz#1004513)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-19.el6
changelog:
  - Stop parsing on entities boundaries errors
  - Fix missing entities after CVE-2014-3660 fix (rhbz#1149086)


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-20.1
changelog:
  - Fix a series of CVEs (rhbz#1286495)
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - Libxml violates the zlib interface and crashes


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-21.el6.8.1
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.50-1
changelog:
  - functions: improve killing loops
  - netfs: tweak nfs umount
  - sysctl.conf: mention sysctl -a
  - sysconfig.txt: document PPPOE_EXTRA and PPPD_EXTRA
  - spec: require plymouth
  - fix mangled sysconfig/init.s390
  - rc.sysinit: don't perform fsck twice with /.autorelabel
  - ifdown-eth: fix comparison
  - ifup-eth: if arping fails, output responding MAC
  - network-functions: fix change_resolv_conf after grep update
  - spec: add sysctl.d dir
  - rc.sysinit: fix typo in fs
  - rename_devices: comments need to have a blank before them
  - rename_device: remove comments and trailing whitespaces
  - bonding: warn if the ifup for slave device failed
  - clarify daemon() usage message
  - ifdown: clean ipv4 localhost addresses
  - ifup-post: check resolve.conf also with DNS2
  - ifup: add missing quotes
  - ifup-eth: some bridge options are applied later
  - init.d/halt: give init some time to reexecute
  - network-scripts: DEVICE and HWADRR could be quoted by apostrophe
  - ifup-wireless: fix calling of phy_wireless_device
  - rc.sysinit: apply quotas after system is relabeled


author: Marek Grac <mgrac@redhat.com> - 4.0.15-11
changelog:
  - fence_ipmilan: Revert power_wait values
    Resolves: rhbz#1273632
  - fence_apc: Support for firmware 6.x
    Resolves: rhbz#1259254
  - fence_ipmilan: Add 'diag' action
    Resolves: rhbz#1266600
  - fencing: Add '-list-status' action
    Resolves: rhbz#1183829


author: Marek Grac <mgrac@redhat.com> - 4.0.15-13
changelog:
  - fence_ipmilan: Do not print password to debug output
    Resolves: rhbz#1358064
  - fencing: Handle None as status properly
    Resolves: rhbz#1361623


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.15-13.2
changelog:
  - fence_rhevm: add "--api-path" and "--disable-http-filter" to be
    able to explicitly use oVirt API version 3
    Resolves: rhbz#1506694


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.8.1.el6]
changelog:
  - [netdrv] bonding: fix LACP PDU not sent on slave port sometimes (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: fix incorrect lacp mux state when agg not active (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: fix bond_open don't always set slave active flag (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: update bond carrier state when min_links option changes (Jarod Wilson) [1266366 1258446]
  - [netdrv] bonding: change AD_LINK_SPEED_BITMASK to enum to suport more speed (Jarod Wilson) [1266366 1258446]
  - [virt] kvm: ioapic: conditionally delay irq delivery duringeoi broadcast (Fam Zheng) [1266369 1199155]
  - [kernel] ipc, sem: fix use after free on IPC_RMID after a task using same semaphore set exits (Herton R. Krzesinski) [1266373 1233300]
  - [fs] xfs: extent size hints can round up extents past MAXEXTLEN (Leonardo Menezes Vaz) [1266372 1211110]
  - [fs] Remove BUG_ON in nfs_clear_inode (Frank Sorenson) [1266364 1224343]
  - [net] use address assign type "SET" (Jarod Wilson) [1266374 1225359]
  - [net] ethtool: set addr_assign_type to NET_ADDR_SET when addr is passed on create (Jarod Wilson) [1266374 1225359]
  - [net] rtnl: use dev_set_mac_address() instead of plain ndo_ (Jarod Wilson) [1266374 1225359]
  - [net] ipv4: inet_fragmentation: compute work more accurate (Hannes Frederic Sowa) [1246088 1235465]
  - [netdrv] bna: fix interrupts storm caused by erroneous packets (Ivan Vecera) [1260535 1241287]
  - [edac] pci: avoid negative reference count of edac_class (Herton R. Krzesinski) [1255492 1227845]
  - [kernel] percpu_counter: batch size aware __percpu_counter_compare (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: make percpu_counters_lock irq-safe (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: fix bad percpu counter state during suspend (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: unbreak __percpu_counter_add (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: fix __percpu_counter_add (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: make APIs irq safe (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: __this_cpu_write doesn't need to be protected by spinlock (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] lib/percpu_counter.c: enclose hotplug only variables in hotplug ifdef (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpucounter: Optimize __percpu_counter_add a bit through the use of this_cpu options (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu_counter: use this_cpu_ptr instead of per_cpu_ptr (Hannes Frederic Sowa) [1246088 1235465]
  - [kernel] percpu: fix list_head init bug in __percpu_counter_init (Hannes Frederic Sowa) [1246088 1235465]


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.7
changelog:
  - kvm-slirp-disable-tcp_emu.patch [bz#1791680]
  - kvm-slirp-add-slirp_fmt-helpers.patch [bz#1798966]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798966]
  - Resolves: bz#1791680
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-6])
  - Resolves: bz#1798966
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.8
changelog:
  - kvm-qemu-kvm-QEMU-usb-check-RNDIS-message-length.patch [bz#1869684]
  - kvm-qemu-kvm-QEMU-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869684]
  - Resolves: bz#1869684
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-6.10.z])


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.8
changelog:
  - Allow ipsec_mgmt_t to access netlink route socket and set attributes for /var/run/pluto directories.
  Resolves:#1289019


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.503.el6_9.6
changelog:
  - qemu-kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574067]
  - Resolves: bz#1574067
    (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-6.9.z])


author: Jan Rybar <jrybar@redhat.com> - 3.2.8-43
changelog:
  - Rework of patch 91 from 3.2.8-37, stripping removed permanently, no new option
  - Resolves: rhbz#1322111


author: Jan Grulich <jgrulich@redhat.com> - 1:0.97-86
changelog:
  - grub-install: add regex for partition and multipath when
    use_friendly_names is off
    Resolves: rhbz#1121321
  - Disable previous patch as it doesn't work properly


author: Jan Grulich <jgrulich@redhat.com> - 1:0.97-91
changelog:
  - Suppress failure message on EFI systems when loading splashscreen
    Resolves: rhbz#1129436
  - Return proper disk operation status
    Resolves: rhbz#1130209
  - Stick with default GOP mode unless resolution is absurdly small
    Resolves: rhbz#1130313


author: Jan Grulich <jgrulich@redhat.com> - 1:0.97-94
changelog:
  - Properly expand IPv6 address
    Resolves: bz#1177321
  - Support various types of DHCP IPv6 packet for MAC address extraction
    Resolves: bz#1206542


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:0.97-94.el6_7.1
changelog:
  - Fix the ineffectiveness when loading fragmented initramfs from Ext4 filesystem
    Resolves: #1311474


author: Jan Vcelak <jvcelak@redhat.com> 0.2.19-7
changelog:
  - fix: apply scheduler settings to vd* devices (#725497)
  - enhancement: add virtual-host profile (#740976)
  - enhancement: add virtual-guest profile (#740977)
  - fix: diskdevstat and netdevstat command line error handling (#747210)


author: Jan Vcelak <jvcelak@redhat.com> 0.2.19-8
changelog:
  - fix: poor ping latency in 'latency-performance' profile (#714180)
  - fix: ktune breaks disks when pecifying just the device for ELEVATOR_TUNE_DEVS (#784308)
  - fix: should not disable barriers on devices with write back cache (#801561)
  - fix: /var/run/tuned/tuned.pid created with insecure permissions (#845336)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-10
changelog:
  - fix: virtual-guest profile should not deploy the nobarrier option
    resolves: rhbz#886956
  - fix: disable transparent hugepages in latency-performance profile
    resolves: rhbz#887355


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-12
changelog:
  - fix: tuned incorrectly sets readahead values when new device is inserted
    resolves: rhbz#905077
  - fix: there is a race when multiple devices are inserted
    resolves: rhbz#904062


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-13
changelog:
  - add support for upstream THP
    resolves: rhbz#912788
  - added sap profile, backported features it needs
    resolves: rhbz#910838
  - made elevator settings customizable
    resolves: rhbz#987547
  - fixed usb_autosuspend and bluetooth functions
    resolves: rhbz#982756
  - increased kernel.sched_migration_cost in virtual-host profile
    resolves: rhbz#969491
  - documented virtual-guest and virtual-host profiles
    resolves: rhbz#964187
  - fixed typo in tuned-adm help
    resolves: rhbz#963821
  - modified latency-performance profile to lock CPU to C1
    resolves: rhbz#961792
  - added support for /etc/sysctl.d
    resolves: rhbz#959732
  - fixed permissions of /var/run/tuned/pmqos-static.pid
    resolves: CVE-2013-1820
  - fixed diskdevstat labels
    resolves: rhbz#885080
  - quiet errors when remounting FS with nobarriers
    resolves: rhbz#838512


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-15
changelog:
  - dynamically changing symlinks excluded from the RPM verification
    resolves: rhbz#1017366
  - reversed reading of sysctl configuration in SYSCTL_POST to follow
    RHEL-6 behavior
    resolves: rhbz#1036049
  - fixed typo in latency-performance profile regarding SYSCTL_POST
    resolves: rhbz#1064062
  - added support for s390 block devices (/dev/dasd)
    resolves: rhbz#1129936
  - added support for Xen VS devices (/dev/xvd)
    resolves: rhbz#1159963
  - increased vm.max_map_count in sap-netweaver profile
    resolves: rhbz#1174253


author: Olivier Fourdan <ofourdan@redhat.com> 1.17.4-3
changelog:
  - Add missing hw/xfree86/Xorg.sh.in to xorg-x11-server-source package.
    This is needed to build packages depending on xorg-x11-server-source
    (e.g. tigervnc), otherwise the build will fail.


author: Adam Jackson <ajax@redhat.com> 1.17.4-7
changelog:
  - Add bug-compatibility for exposure event generation for backing store's
    Always mode, and re-enable the feature


author: Soren Sandmann <ssp@redhat.com> 1.4.5-3
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Benjamin Tissoires <btissoir@redhat.com> 1.4.5-4
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.4
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298045]
  - Resolves: bz#1298045
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-6.7.z])


author: Bill Nottingham <notting@redhat.com> 1.3.49.1-1
changelog:
  - backport LSB fixes from head
  - fixes: #693202/#771455, #649227/#771452, #750446/#771454, #701573/#771741, #696305 (<jbastian@redhat.com>)


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.73
changelog:
  - Add 0194-RHBZ-997570-no-sync-turs-on-pthread_cancel.patch
    * If async tur checker fails on threads, don't retry with the sync version
  - Resolves: bz #997570


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-13
changelog:
  - Resolves: #1230753 - insufficient check for running service in condrestart
    and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-14
changelog:
  - Related: #1248855 - After updating to squid-3.1.23-9.el6,
    service squid {reload,restart} fails with "Operation not permitted"
  - Related: #1230753 - insufficient check for running service in condrestart 
    and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.1
changelog:
  - Resolves: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.2
changelog:
  - Related: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.3
changelog:
  - Resolved: #1334489 - CVE-2016-4554 CVE-2016-4556 squid: various flaws
  - Related: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-1
changelog:
  - Update to upstream release 1.1.12-rc3
  - The CIB has O(2) better performance and updates are applied with greater reliablity
  - Transient attributes are now recorded in a truely atomic manner
  - Supports fencing agents that need the host to be unfenced at startup
  - CIB ACLs have been reimplemented and are now enabled 
  - Various bugs squashed

  - Resolves: rhbz#1020210 rhbz#1036631 rhbz#1069279
  - Resolves: rhbz#1069795 rhbz#1071995


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-2
changelog:
  - Bug rhbz#1054307 - cname pattern match should be more restrictive in init script
      Resolves: rhbz#1054307


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-3
changelog:
  - Fix: crmd: avoid double free caused by nested hash table removal
  - Fix: ignore SIGPIPE with gnutls is in use
  - Fix: cib: cl#5222 - Prevent assert in xml_calculate_changes() on performing cib operations
      Resolves: rhbz#1071995


author: David Vossel <dvossel@redhat.com> - 1.1.12-5
changelog:
  - Properly clear shutdown transient attribute after node leaves
    membership.

    Resolves: rhbz#1198638


author: David Vossel <dvossel@redhat.com> - 1.1.12-6
changelog:
  - Fixes invalid free in attrd
  - Fixes crm_mon -E option for external script.
  - Fixes acl read-only access role assignment.

    Resolves: rhbz#1205292
    Resolves: rhbz#1208896
    Resolves: rhbz#1207621


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-7
changelog:
  - Ensure relevant components clear cache entries are cleared when peers leave the cluster

    Resolves: rhbz#1193499


author: David Vossel <dvossel@redhat.com> - 1.1.12-8
changelog:
  - Reduce log severity for style upgrade notice.
   - Properly export pacemaker related sysconfig variables
   - Remove warning during yum update of pacemaker packages.

    Resolves: rhbz#1163982
    Resolves: rhbz#1177821
    Resolves: rhbz#1210291


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-3
changelog:
  - prevent setfacl --restore from SIGSEGV on malformed restore file (#576512)
  - run the test-suite if possible


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-5
changelog:
  - clarify that removing a non-existent acl entry is not an error (#674883)
  - update project URL in package specification (#702638)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-6
changelog:
  - add function acl_extended_file_nofollow() (#720318)
  - build with partial RELRO support as a security enhancement (#723998)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-7
changelog:
  - fix SIGSEGV of getfacl -e on overly long group name (#1025246)
  - fix test-suite failure on a repeated run (#743847)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-2.b11
changelog:
  - Fix a number of bad bug identifiers (PR3546 should be PR3578, PR3456 should be PR3546)
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-2.b11
changelog:
  - Remove build flags exemption for aarch64 now the platform is more mature and can bootstrap OpenJDK with these flags.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b04
changelog:
  - Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-2.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Doug Ledford <dledford@redhat.com> - 1.0.15-1
changelog:
  - Update to latest upstream release (adds FDR support and fixes 696019 the
    upstream way)
  - Include fixes in git not yet in a release
  - Related: bz750609
  - Resolves: bz700289


author: Doug Ledford <dledford@redhat.com> - 1.0.17-0.git4b5c1aa
changelog:
  - Pre-release version of 1.0.17
  - Resolves a CVE vulnerability between librdmacm and ibacm
  - Fixes various minor bugs in sample programs
  - Resolves: bz866221, bz816074


author: Doug Ledford <dledford@redhat.com> - 1.0.17-1
changelog:
  - Official 1.0.17 release
  - The fix to bug 866221 got kicked back as incomplete last time, fix
    it for real this time.
  - Intel adapters that use the qib driver don't like using inline data,
    so use a memory region that is registered instead
  - Resolves: bz866221, bz828071


author: Doug Ledford <dledford@redhat.com> - 1.0.19.1-1
changelog:
  - Update to latest upstream release
  - Drop patches that upstream has folded in
  - Resolves: bz1119108


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-13
changelog:
  - RHEL-6.6 erratum
    - don't retry authentication when ctrl-c pressed
    - fix double-quote processing in Defaults options
    - fix sesh login shell argv[0]
    - handle the "(none)" hostname correctly
    - SSSD: fix ipa_hostname handling
    - SSSD: fix sudoUser netgroup specification filtering
    - SSSD: list correct user when -U <user> -l specified
    - SSSD: show rule names on long listing (-ll)
    Resolves: rhbz#1065415
    Resolves: rhbz#1078338
    Resolves: rhbz#1052940
    Resolves: rhbz#1083064
    Resolves: rhbz#1033703
    Resolves: rhbz#1006447
    Resolves: rhbz#1006463
    Resolves: rhbz#1070952


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-14
changelog:
  - RHEL-6.6 erratum
    - SSSD: fixed netgroup filter patch
    - SSSD: dropped serparate patch for #1006463, the fix is now part
      of the netgroup filter patch
    Resolves: rhbz#1006463
    Resolves: rhbz#1083064


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-15
changelog:
  - RHEL-6.6 erratum
    - SSSD: dropped the ipahostnameshort patch, as it is not
      needed. rhbz#1033703 is a configuration issue.
    Related: rhbz#1033703


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-16
changelog:
  - RHEL-6.7 erratum
    - added zlib-devel build required to enable zlib compression support
    - fixed two typos in the sudoers.ldap man page
    - fixed a hang when duplicate nss entries are specified in nsswitch.conf
    - SSSD: implemented sorting of the result entries according to the
            sudoOrder attribute
    - LDAP: fixed logic handling the computation of the "user matched" flag
    - fixed restoring of the SIGPIPE signal in the tgetpass function
    - fixed listpw, verifypw + authenticate option logic in LDAP/SSSD
    Resolves: rhbz#1106433
    Resolves: rhbz#1138267
    Resolves: rhbz#1147498
    Resolves: rhbz#1138581
    Resolves: rhbz#1142122
    Resolves: rhbz#1094548
    Resolves: rhbz#1144448


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-17
changelog:
  - RHEL-6.7 erratum
    - added patch for CVE-2014-9680
    - added BuildRequires for tzdata
    Resolves: rhbz#1200253


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-19
changelog:
  - RHEL-6.7 erratum
    - modified the authlogicfix patch to fix #1144448
    - fixed a bug in the ldapusermatchfix patch
    Resolves: rhbz#1144448
    Resolves: rhbz#1142122


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.448.el6_6.3
changelog:
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219267]
  - Resolves: bz#1219267
    (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-6.6.z])


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11-15-92
changelog:
  - Release 1.2.11.15-92
  - Resolves: Bug 1543798 - EMBARGOED CVE-2018-1054 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11-15-93
changelog:
  - Release 1.2.11.15-93
  - Resolves: Bug 1544415 - CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c
  - Resolves: Bug 1543798 - EMBARGOED CVE-2018-1054 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11-15-94
changelog:
  - Release 1.2.11.15-94
  - Resolves: Bug 1544415 - CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (fix cherry-pick error)


author: Jan Zeleny <jzeleny@redhat.com> - 1.4-2
changelog:
  - cleanup of spec file (mixed tabs-and-spaces, specific version
    for explicit obsoletes, file attributes)


author: Petr Stodulka <pstodulk@redhat.com> - 1.4-4
changelog:
  - Fixed troubles with SSl connection
  - Fixed adding of broken symlink when 'copy -A'
  - Fixed permissions for */hgk - Thanks to Dave Johanse <davejohansen@gmail.com>
    Resolves: #784079 #928301 #1006457


author: Avesh Agarwal <avagarwa@redhat.com> - 4.29-1
changelog:
  - New upstream realease 4.29
  - Updated authpriv and sample patches for the new release
  - Modified spec file to include dist tag


author: Miroslav Lichvar <mlichvar@redhat.com> 2:2.6.6-1
changelog:
  - update to 2.6.6 (#588781)
  - move sasl config to /etc/sasl2 (#574439)
  - drop sasl v1 support
  - require Date::Calc for pflogsumm (#588726)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.6.6-6.1
changelog:
  - Backported patch to use long integers for message_size_limit,
    mailbox_size_limit and virtual_mailbox_limit
    Resolves: rhbz#1263265


author: <dwalsh@redhat.com> - 3.0.47-3
changelog:
  - Sedispatch is not handling audit messages correctly, 
    this fix allows setroubleshoot to process alerts.
  Resolves: #575686


author: Miroslav Grepl <mgrepl@redhat.com> - 3.0.47-4
changelog:
  - Make sealert working if description contains parenthesis
  - Remove -H from man page
  Resolves:#788196


author: Thomas Wörner <twoerner@redhat.com> 0.2.19-5
changelog:
  - fixed handling of stdin/stdout/stderr during daemon creation (rhbz#695480)
  - fixed device type determination (rhbz#707079)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.3
changelog:
  - Use installed directory in check section and remove duplicate tests in build
  - Resolves: rhbz#1190835


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Bump to 2.6.0 and u80b32.
  - Drop upstreamed patches and separate AArch64 HotSpot.
  - Add dependencies on pcsc-lite-devel (PR2496) and lksctp-tools-devel (PR2446)
  - Only run -Xshare:dump on JIT archs other than power64 as port lacks support
  - Update remove-intree-libraries script to cover LCMS and PCSC headers.
  - Resolves: rhbz#1235157


author: Ales Ledvinka <aledvink@redhat.com> - 1.8.11-23
changelog:
  - (#1194420) Fix DDR4 SDR crash.
  - (#1170266) Wrong version reported.
  - (#1162175) Extra dependency.
  - (#1126333) Very slow response from SDR owner type SW ID
  - (#903019)  SDR lists x4600m2 fan units as unspecified


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-24
changelog:
  - Apply two patches from upstream
  - Resolves: rhbz#1105382 - nslcd: error reading from client: Success


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-25
changelog:
  - Resolves: rhbz#917876 - [patch] Retry on zero length buffers rather than
                            declaring source unavailable


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-26
changelog:
  - Apply patches in prep
  - Resolves: rhbz#917876 - [patch] Retry on zero length buffers rather than
                            declaring source unavailable


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-27
changelog:
  - Resolves: rhbz#1240388 - nslcd fails to fetch member of group if that
                             members name has 19 or more character in its name


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-30
changelog:
  - Resolves: rhbz#1293564 - Segmentation fault during upstream make check
  - Also fix regressions in the tio.c module revealed by subsequent testing


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-31
changelog:
  - Resolves: rhbz#1293564 - fix doc to describe actual uri format
                             in nslcd.conf


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-32
changelog:
  - Don't double-close the socket
  - Resolves: rhbz#1309364 - Use-after-free in case resolving hosts or
                             networks fail


author: Kamil Dudka <kdudka@redhat.com> - 4.3.11-7
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)


author: Caolan McNamara <caolanm@redhat.com> - 4.2.1-9
changelog:
  - Resolves: rhbz#596171 drop icu.icu6284.strictalias.patch and use
    -fno-strict-aliasig as upstream has added a pile more and doesn't look
    interested in proposed patchs


author: Peng Wu <pwu@redhat.com> - 4.2.1-15
changelog:
  - Apply icu.13634.integer.overflow.patch
  - Apply icu.20958.segv.mapper.patch
  - Resolves: rhbz#1809876


author: Jaromír Končický <jkoncick@redhat.com> - 12:4.1.1-40.P1
changelog:
  - Fix handling of UDP packets with checksum 0xffff. (#1015997)
  - Add GUIDs in the DHCP logs for IPoIB. (#1064416)


author: Jaromír Končický <jkoncick@redhat.com> - 12:4.1.1-41.P1
changelog:
  - Fix dhcpd.leases reverting to root:root on every dhcpd start (#1067142)
    New patch "paranoia" merged with older "paranoia-pid" patch
  - Add init script for dhcrelay IPv6 version (#1053155)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-43.P1.1
changelog:
  - dhcpd generates spurious responses when seeing requests
    from vlans on plain interface (#1184333)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-13
changelog:
  - added new options to configure retransmissions on lan/lanplus interfaces
    (#748073)
  - updated dellem command (#739358)
  - fixed exit code of ipmitool -o list (#715615)
  - improved checking of command line arguments (#725993)


author: Harald Hoyer <harald@redhat.com> 147-2.58
changelog:
  - do not print error, if /sys/class/firmware/timeout does
    not exist (yet)
  Resolves: rhbz#1140336
  - always call modprobe, even when a driver is bound to the device
  Resolves: rhbz#1084513
  - fixed for every modprobe locked worker, increase max_childs
    use ncnt instead of zcnt
  Resolves: rhbz#1164960
  - print warning in start_udev, if udevlog is used
  Resolves: rhbz#876535


author: Harald Hoyer <harald@redhat.com> 147-2.60
changelog:
  - ata_id - fixup all 8 not only 6 bytes of the fw_rev string
  Resolves: rhbz#794561
  - udev: properly handle symlink removal by 'change' event
  Resolves: rhbz#1018171


author: Michal Sekletar <msekleta@redhat.com> - 147-2.63.1
changelog:
  - also limit the additional modprobe locked workers (#1281469)
  - 80-drivers.rules: only make an exception for ipmi for modprobe with DRIVER set (#1281467)


author: Petr Šabata <contyk@redhat.com> - 2.6.32-24
changelog:
  - Don't hang on rtnl_send() in a confined domain (#985526)
  - Run lnstat indefinitely if -c was not specified (#977845)
  - lnstat manpage SEE ALSO path fixes (#974694)
  - Document tc's force and batch options (#950122)
  - Fix include/linux/if_link.h to get in line with upstream again (#903228)
  - Add support for the IPv6 tokenized interface (#950400)
  - Handle ip-route rto_min parameters correctly (#859145)
  - Add VXLAN support (#929313, #908155)
  - Add mdb subcommand to bridge (#885977)
  - tc now supports the -OK option (#851371)


author: Petr Pisar <ppisar@redhat.com> - 2.6.32-29
changelog:
  - Document tc -OK option (#851371)
  - Document "bridge mdb" and "bridge monitor mdb" (#885977)
  - Document bridge unsupported features (#929313)


author: Petr Šabata <contyk@redhat.com> - 2.6.32-31
changelog:
  - Removed the unsporrted features from the bridge(8) manpage and
    document bridge fdb replace (#929313)


author: Petr Šabata <contyk@redhat.com> - 2.6.32-32
changelog:
  - Fix a floating point exception regression introduced with the
    incorrect fix of #859145 (#1045200)


author: Lyude Paul <cpaul@redhat.com> 7.6.1-2
changelog:
  - Fix annoying trailing whitespace after %description
  - Update firmware license
  - Added missing firmware file TAHITI_vce.bin (#1310823)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-32
changelog:
  - fix: in a login shell "( cmd & )" does nothing (#1217236)
  - multibyte character string after $1-9 was not expanded correctly (#1256495)
  - case in a for loop inside a subshell caused syntax error (#1241013)


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-36
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1454804


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.0-11.1.13.4
changelog:
  - Add fix for ArrayIndexOutOfBoundsException when certain glyphs are processed
  - Regenerate rpath patch to apply after upstreamed patch.
  - Resolves: rhbz#1112806


author: Klaus Wenninger <kwenning@redhat.com> - 1.1.14-1.0
changelog:
  - Update to upstream release 1.1.14
   - added README_RGManager_porting to document replacement of
       ccs2cib, ccs_flatten & disable_rgmanager
   - added patchset (0100-0111) from master to implement graceful
       stop of pacemaker_remote
   - require minimum-version 0.17.0 of libqb

    Resolves: rhbz#1193499
    Resolves: rhbz#1195500
    Resolves: rhbz#1200853
    Resolves: rhbz#1215809
    Resolves: rhbz#1219103
    Resolves: rhbz#1235316
    Resolves: rhbz#1246490
    Resolves: rhbz#1246563
    Resolves: rhbz#1252206
    Resolves: rhbz#1257333
    Resolves: rhbz#1275223
    Resolves: rhbz#1287535
    Resolves: rhbz#1297564


author: Paul Howarth <paul@city-fan.org> - 1.35-7
changelog:
  - update to svn trunk (rev 252), needed due to omission of MD2 functionality
    from OpenSSL 1.0.0 (CPAN RT#48916)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.3
changelog:
  - Revise PR2323 to use header defines to mark whether GLib types have been defined or not
  - Resolves: rhbz#1190835


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.3
changelog:
  - Revise PR2323 to account for different glibconfig.h define used on RHEL 6
  - Resolves: rhbz#1190835


author: Daniel Mach <dmach@redhat.com> - 0.9.9-5
changelog:
  - Update Intel Haswell events.
  - Add support for Intel Silvermont (Avoton).
  - Add support for Intel Broadwell.
  - Add support for aarch64.
  - Update IBM power8 events.


author: Ivana Varekova <varekova@redhat.com> - 2.31-4
changelog:
  - fix "zip does not honor umask setting when creating archives"
  - fix "zip segfaults by attempt to archive big file"
  - spec file cleanup


author: Karel Klic <kklic@redhat.com> - 3.0-1
changelog:
  - New upstream version
  - Removed zip23.patch, because ZMEM is not used anyway
  - Removed zip-2.31-install.patch, problem solved in upstream
  - Removed zip23-umask.patch, upstream uses mkstemp which solves the problem
  - Removed zip-2.31-near-4GB.patch, because upstream version 
    handles large files well
  - Removed zip-2.31-configure.patch, configure is better in the current version
  - Removed zip-2.3-sf.patch, the error message doesn't exist in upstream anymore
  - Removed zip-2.31-umask_mode.patch, which fixes also removed near-4GB patch
  - Updated zip-2.31-time.patch for zip 3.0
  - Updated exec-shield.patch for zip 3.0
  - Updated zip-2.3-currdir.patch for zip 3.0


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-2
changelog:
  - Added dfa-optimize-period patch (speedup for . patterns in UTF-8)
  - Added glibc-matcher-fallback patch (speedup for [a-z] patterns in UTF-8)
  - Added mmap-option-fix patch
  - Added dfa-convert-to-wide-char patch (speedup for -m and remove quadratic
    complexity when going to glibc)
  - Added dfa-speedup-digit-xdigit patch (speedup for [[:digit:]] [:xdigit:]])


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.6.3-4
changelog:
  - Fixed crash on grep -Fif /dev/null (fif-null-fix patch)
    Resolves: rhbz#797934
  - Fixed heap overrun on specific REs (dfa-heap-overrun-fix patch)
    Resolves: rhbz#715295
  - Fixed -i (case insensitive matching)
    Resolves: rhbz#826997


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-1
changelog:
  - New version
    Resolves: rhbz#1064668
    Resolves: rhbz#982215
    Resolves: rhbz#1126757
    Resolves: rhbz#1167766
    Resolves: rhbz#1171806
  - Fixed \w and \W behaviour in multibyte locales
    Resolves: rhbz#799863
  - Documented --fixed-regexp option
    Resolves: rhbz#1103270


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-2
changelog:
  - Fixed invalid UTF-8 byte sequence error in PCRE mode
    (by pcre-backported-fixes patch)
    Resolves: rhbz#1193030
  - Fixed buffer overrun for grep -F
    Resolves: CVE-2015-1345
  - Fixed bogus date in the changelog


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20-5
changelog:
  - Added support for environmental variable GREP_LEGACY_R to enhance
    backward compatibility of -r switch behavior
    Resolves: rhbz#1367309


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-9
changelog:
  - Change permissions of /etc/cron.d/raid-check to 600
  - Resolves bz1012505
  - Avoid double close() issue reported by Coverity
  - Resolves bz991041


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-10
changelog:
  - Fix problem of IMSM platform capabilities not being detected in UEFI
    mode when only the second SATA controller is enabled.
  - Resolves bz1075529


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-11
changelog:
  - Fix problem where mdadm would crash if trying to create an IMSM array with
    missing drives.
  - Resolves bz1059307


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3-2
changelog:
  - Fix problem with path=* policy not working, due to lack of /dev/disk/by-path/
  - Resolves bz1059193


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3-6
changelog:
  - Fix problem with reshape of IMSM RAID arrays failing to start
  - Disallow IMSM arrays spanning multiple controllers
  - Fix problem with reshape failing to restart when reassembling IMSM RAID
  - Resolves bz1136880, bz1136891, bz1136903


author: Tomas Hozza <thozza@redhat.com> 1.12-5
changelog:
  - Fix the parsing of weblink when doing recursive retrieving (#960137)
  - Fix errors found by static analysis of source code (#873216)


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-1
changelog:
  - rebase to rsyslog 5.8.10
    Resolves: #803550
    Resolves: #805424
    Resolves: #813079
    Resolves: #813084
  - consider lock file in 'status' action
    Resolves: #807608
  - add impstats and imptcp modules
  - include new license text files
  - specify which versions of sysklogd are obsoleted


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-2
changelog:
  - add patch to update information on debugging in the man page
    Resolves: #820311
  - add patch to prevent debug output to stdout after forking
    Resolves: #820996
  - add patch to support ssl certificates with domain names longer than 128 chars
    Resolves: #822118


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-5
changelog:
  - add a patch to permit RFC3339 timestamps in messages comming from
    the local log socket, patch taken from upstream - commit:
    bfae69d68b0032a383821a54bc52aeff36a90e52
    Resolves: #886004


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-6
changelog:
  - the previous patch to enable RFC3339 timestamps revealed a bug
    in the upstream code - adding another patch
    Resolves: #886004


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-7
changelog:
  - add a patch to support large groups in the $FileGroup directive
    resolves: #924754
  - add a patch to fix 'pri-text' property format
    resolves: #951727
  - add a patch to fix the behavior of the *QueueMaxFileSize directives
    resolves: #963942


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-8
changelog:
  - drop patch 5 which introduced a regression
    resolves: #927405
    reverts: #847568
  - add a patch to prevent 'RepeatedMsgReduction' causing missing hostnames
    resolves: #893197
  - add a patch to enable specifying UID/GID as a number
    resolves: #886117
  - add a patch to prevent a segfault in gssapi
    resolves: #862517


author: Tomas Heinrich <theinric@redhat.com> 5.8.10-10.el6_6
changelog:
  - add a patch to fix a segfault in the regex module
    resolves: #1172165
  - explicitly disable systemd service file generation
  - turn on verbose make output


author: Petr Oros <poros@redhat.com> - 1:1.17-27
changelog:
  - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04
  - Add amd microcode_amd_fam17h.bin data file
  - Resolves: #1527354


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-55
changelog:
  - Resolves: #1372315 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-102
changelog:
  - Resolves: rhbz#1413589 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402664 CVE-2016-6816 tomcat6: tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-105
changelog:
  - Related: rhbz#1402664 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-encoded characters
  - Related: rhbz#1402664 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.2
changelog:
  - fix integer overflows leading to heap overflow in file2strvec()
  - Resolves: CVE-2018-1124 CVE-2018-1126


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.3
changelog:
  - drop leftover assignment in fix for CVE-2018-1124 causing a severe regression
  - Resolves: CVE-2018-1124


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.9.1.el6]
changelog:
  - [mm] hugetlb: fix race in region tracking (Herton R. Krzesinski) [1274599 1260755]
  - [mm] hugetlb: improve, cleanup resv_map parameters (Herton R. Krzesinski) [1274599 1260755]
  - [mm] hugetlb: unify region structure handling (Herton R. Krzesinski) [1274599 1260755]
  - [mm] hugetlb: change variable name reservations to resv (Herton R. Krzesinski) [1274599 1260755]
  - [fs] dcache: Log ELOOP rather than creating a loop (Benjamin Coddington) [1272858 1254020]
  - [fs] dcache: Fix loop checks in d_materialise_unique (Benjamin Coddington) [1272858 1254020]


author: Jan Horak <jhorak@redhat.com> - 60.1.0-8
changelog:
  - Fixed homepage and bookmarks (rhbz#1606778)
  - Fixed missing file associations in RHEL6 (rhbz#1613565)


author: Jan Horak <jhorak@redhat.com> - 60.1.0-9
changelog:
  - Do not set user agent (rhbz#1608065)
  - GTK dialogs are localized now (rhbz#1619373)
  - JNLP association works again (rhbz#1607457)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-24
changelog:
  - cd to directory without execution permission can't fail silently (#1160923)
  - current directory could differ from PWD (#1168611)
  - declaration of a two dimemsional associatve array could add an extra 0 element (#1173668)
  - exporting fixed with variable corrupted its data (#1188377)
  - fixes memmory leak on unset of associative array (#1189294)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-26
changelog:
  - fix segfault when handling a trap (#1117404)
  - closing a file descriptor in a command substitution caused loss of the output (#1116072)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-300
changelog:
  - Allow sblim_reposd_t domain to read cert_f files
  Resolves:rhbz#1392382
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1392406


author: Eduardo Habkost <ehabkost@redhat.com> - gpxe-0.9.7-6.6.el6
changelog:
  - gpxe-Revert-Support-underlying-UNDI-devices-that-don-t-su.patch [bz#661840]
    (patch is broken)
  - Related: bz#661840
    (undi polling fix for Emulex NICs)


author: Eduardo Habkost <ehabkost@redhat.com> - gpxe-0.9.7-6.7.el6
changelog:
  - gpxe-Add-SUPPORTED_-constants-to-pxe_api.h.patch [bz#661840]
  - gpxe-Support-underlying-UNDI-devices-that-don-t-support-i-reapply.patch [bz#661840]
  - Resolves: bz#661840
    (undi polling fix for Emulex NICs)


author: Michal Novotny <minovotn@redhat.com> - gpxe-0.9.7-6.8.el6
changelog:
  - gpxe-Replace-virtio-net-with-native-gPXE-driver.patch [bz#743893]
  - gpxe-Fix-DEBUG-builds-for-filenames-with-hyphens.patch [bz#743893]
  - Resolves: bz#743893
    (Failed to PXE boot when using Virtio)


author: Michal Novotny <minovotn@redhat.com> - gpxe-0.9.7-6.10.el6
changelog:
  - gpxe-Provide-fetch_setting_origin.patch [bz#972671]
  - gpxe-Use-next-server-from-filename-s-settings-block.patch [bz#972671]
  - Resolves: bz#972671
    (pxe boot fails if next-server details come from a different dhcp server)


author: Jeff E. Nelson <jen@redhat.com> - 0.9.7-6.11.el6
changelog:
  - gpxe-Avoid-setting-PSH-flag-when-SYN-flag-is-set.patch [bz#1105189]
  - gpxe-Set-PSH-flag-only-on-packets-containing-data.patch [bz#1105189]
  - Resolves: bz#1105189
    (HTTP request generated by gPXE has wrong TCP flag (SYN & PSH) in first packet in session)


author: Jeff E. Nelson <jenelson@redhat.com> - gpxe-0.9.7-6.12.el6
changelog:
  - gpxe-Add-init_pci_busdevfn.patch [bz#1057249]
  - gpxe-Enable-infrastructure-to-specify-an-autoboot-device-lo.patch [bz#1057249]
  - gpxe-Allow-prefix-to-specify-a-PCI-autoboot-device-location.patch [bz#1057249]
  - gpxe-Store-boot-bus-dev.fn-address-as-autoboot-device-locat.patch [bz#1057249]
  - gpxe-Ignore-PCI-autoboot-device-location-if-set-to-00-00.0.patch [bz#1057249]
  - Resolves: bz#1057249
    (NIC boot order use device PCI address order instead of device boot order)


author: Jeff E. Nelson <jen@redhat.com> - 0.9.7-6.13.el6
changelog:
  - gpxe-Add-support-for-local-configuration-files.patch [bz#968474]
  - gpxe-Extract-timing-parameters-out-to-config-dhcp.h.patch [bz#968474]
  - gpxe-Use-spec-compliant-timeouts.patch [bz#968474]
  - Resolves: bz#968474
    ([RFE] option to increase gpxe retry timeout)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.9.7-6.14.el6
changelog:
  - gpxe-Fix-timeouts.patch [bz#1206042]
  - Resolves: bz#1206042
    (Connection time out when install vm through network)


author: Jeff E. Nelson <jen@redhat.com> - 0.9.7-6.15.el6
changelog:
  - gpxe-Include-port-in-HTTP-Host-header-as-needed.patch [bz#1231931]
  - Resolves: bz#1231931
    (gPXE 'Host' header being transferred without port)


author: Yash Mankad <ymankad@redhat.com> - 0.9.7-6.15.el6_8.1
changelog:
  - gpxe-netdevice-Strip-802.1Q-VLAN-0-priority-tags.patch [bz#1408391]
  - gpxe-Fix-fragment-reassembly.patch [bz#1408390]
  - Resolves: bz#1408390
    (gPXE gets stuck if it receives fragmented IP multicast packets [rhel-6.8.z])
  - Resolves: bz#1408391
    (Properly Handle 8021.Q VID 0 Frames, as new vlan model in linux kernel does.)


author: Albert Uchytil <auchytil@redhat.com> 20120827-14
changelog:
  - updated man pages
  - changed debuginfo package handling (#1071834)
  - added capability of dynamically registering and deregistering collections (#1099394)


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-76
changelog:
  - Remove "username" and "password" options from yum.conf man page.
  - Resolves: bug#1367861
  - Fix reget problems with simple md filenames.
  - Resolves: bug#1155687


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-77
changelog:
  - Filter duplicate packages from different repos in doPackageLists(pkgnarrow='obsoletes').
  - Resolves: bug#1272828


author: Eric Sandeen <sandeen@redhat.com> 3.0.4-4
changelog:
  - Add /var/lib/xfsdump/inventory to file list (was created runtime) (#1055655)
  - Preserve file capabilities on restore (#905585)


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-279.el6_7.9
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  Related: #1322688


author: Dave Anderson <anderson@redhat.com> - 6.0.9-1.el6
changelog:
  - Fix for "crash: cannot resolve: xtime" session invocation failure.
    Resolves: rhbz#843093
  - Enhance "struct" command to accept -o option with an address argument.
    Resolves: rhbz#834260
  - Rebase to upstream version 6.0.9.
  - Support for compressed/filtered ppc64 firmware-assisted dump (fadump).
    Resolves: rhbz#840051


author: Dave Anderson <anderson@redhat.com> - 6.1.0-4.el6
changelog:
  - Compressed kdump 46-bit physical memory support
    Resolves: rhbz#1006622
  - Fix incorrect backtrace for dumps taken with "virsh dump --memory-only"
    Resolves: rhbz#1017930
  - Fix cpu number display on systems with more than 254 cpus
    Resolves: rhbz#1019483


author: Dave Anderson <anderson@redhat.com> - 7.1.0-2.el6
changelog:
  - Support new sadump format that can represent more than 16 TB physical memory space
    Resolves: rhbz#1195596


author: Dave Anderson <anderson@redhat.com> - 7.1.0-3.el6
changelog:
  - Fortify the error handling of task gathering from the pid_hash[]
    chains during session initialization to prevent an endless loop if
    data structures have been corrupted.
    Resolves: rhbz#1208557


author: Dave Anderson <anderson@redhat.com> - 7.1.0-3.el6_7
changelog:
  - crash fails to read or wrongly reads some parts of memory in sadump vmcore format
    Resolves: rhbz#1284762


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-27.1
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-28.1
changelog:
  - Fix unbound-1.4.20-amplifying-an-incoming-query.patch patch so it won't produce compiler warnings
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-29.1
changelog:
  - Fix segfault in unbound-1.4.20-amplifying-an-incoming-query.patch
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Chris Feist <cfeist@redhat.com> - 0.16.2-75.2
changelog:
  - ricci: disable SSLv2/SSLv3 by default, added '-x' option to enable SSLv2/3
  - Resolves: rhbz#1222411


author: Kalev Lember <kalev@smartlink.ee> 3.0.1-16
changelog:
  - Reintroduce a patch for CVE-2009-1885
  - Don't build static library
  - Use parallel make
  - Spec file clean up


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-21
changelog:
  - fixfiles verify: do not relabel /tmp and /var/tmp dirs
  Resolves: rhbz#1113083
  - Fix semanage -S <store> -o <output>
  Resolves: rhbz#1122850


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-23
changelog:
  - Move python scripts in /usr/share/system-config-selinux to policycoreutils-python
  Resolves: rhbz#995778


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-26
changelog:
  - restorecond: treat root as a regular user
  Resolves: rhbz#1281877
  - semanage: don't skip reserver_port_t
  Resolves: rhbz#1225806
  - semanage: check if a store exists
  Resolves: rhbz#1208801
  - fixfiles: check the SELinux status
  Resolves: rhbz#1240788


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-27
changelog:
  - sandbox: Improve comments in sysconfig file
  Resolves: rhbz#1159336
  - secon, newrole: fix inconsistence between --help and man page
  Resolves: rhbz#1278811, rhbz#1278913


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
changelog:
  - copy digest algorithm when handling SNI context switch
  - improve documentation of ciphersuites - patch by Hubert Kario
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-285
changelog:
  -Allow munin apache scripts to manage munin logs and talk with httpd over unix stream socket. 
  Resolves:#1286052
  -Allow httpd to send generic signal to httpd suexec if htpasswd is invoked. Resolves:#1286007
  -Dontaudit httpd running as piranha_web_t accesses to snmp mib indexes. 
  Resolves:#1285674
  -Allow ipsec running as ipsec_t to create pluto.log with correct labeling.
  Resolves:#1267212
  -Allow whack executed by sysadm SELinux user to access /var/run/pluto/pluto.ctl. It fixes "ipsec auto --status" executed by sysadm_t. 
  Resolves:#1257591
  -Dontaudit attemps to write generic tmp_t dirs if gnome-keyring-daemon runs under passwd_t domain. 
  Resovles:#1131531


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-260.el6_6.3
changelog:
  - Allow passenger to accept connection.
  - Update passenger rules from RHEL7.
  Resolves:#1211706
  - Allow mysqld_t to use pam
  - Allow mysqld_t to send audit messages
  Resolves:#1214023
  - Back port labeling for /etc/my.cnf.d dir.
  Resolves:#1212976
  - Add labeling for mariadb log/pid files/dirs.
  Resolves:#1212846
  - Add support for mogos service.
  Resolves:#1212972


author: Tomas Hozza <thozza@redhat.com> - 1.4.20-20
changelog:
  - Install tmpfiles configuration into /usr/lib/tmpfiles.d (#1180995)
  - Fix root key management to comply to RFC5011 (#1180267)


author: Petr Menšík <pemensik@redhat.com> - 1.4.20-23.4
changelog:
  - Update trust anchors (#1458345)
  - Update managed keys from trigger
  - Fix periodic updates of root.key


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-20
changelog:
  - rgmanager: clusvcadm: If service doesn't exist, try
    Resolves: rhbz#952729
  - rgmanager: Don't crash if a resource agent does not
    Resolves: rhbz#1018079
  - rgmanager: Fix rg_test exit status on failures
    Resolves: rhbz#1033162
  - rgmanager: resrules: make expand_time buffer-less
    Resolves: rhbz#1036652
  - rgmanager: Fix error logging when building the resource
    Resolves: rhbz#1053739


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-22
changelog:
  - rgmanager: Fix potential NULL ptr deref in clustat
    Resolves: rhbz#1079207
  - rgmanager: Log a warning when the non-critical flag is
    Resolves: rhbz#1128877
  - rgmanager: Don't restart locally if failover domain
    Resolves: rhbz#1151199


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-25
changelog:
  - rgmanager: Fix bash syntax error in clunfslock
    rgmanager: clunfslock: copy state info if it exists
    Resolves: rhbz#1278943


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.1
changelog:
  - rgmanager: Reload the resource tree after quorum is regained
    if central processing is enabled.
    Resolves: rhbz#1335412


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.2
changelog:
  - rgmanager: Forget that we were transition master if quorum is dissolved
    rgmanager: Re-init the vf key callbacks after losing and recovering quorum
    Resolves: rhbz#bz1335412
  - rgmanager: Check for NULL when attempting to access the member list
    Resolves: rhbz#bz1343345


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.3
changelog:
  - rgmanager: Exit more gracefully if cman stops first when cpg locks are used
    Resolves: rhbz#1344640


author: Jan Pacner <jpacner@redhat.com> - 5:1.5.20-5.20091214hg736b6a
changelog:
  - Resolves: #1083524 (segmentation fault when sending an e-mail from a command
    line)
  - Resolves: #750929 (SIGSEGV Crash while parsing certificates file)
  - Resolves: #690409 (mutt crash; seg fault in mx_update_context)
  - Resolves: #674271 (SIGSEGV when browsing pop account)


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.20-8.20091214hg736b6a
changelog:
  - Resolves #1196787 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1212646 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.4-10
changelog:
  - Minor source hardening (bz 878001)
  - Migrating algorithm fix (bz 1031230)
  - Introducing deepestcache option (bz 1052166)
  - Debug option behavior fix (bz 1096392)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - Unused variable removed (bz 1119404)
  - Warning when started as non-root (bz 749651)
  - More robust signal handling (bz 1158932)
  - Fixed manpage hostname (bz 1162247)
  - Fixed memleak (bz 1178247)
  - Fixed help message typo (bz 1178903)


author: Baoquan He <bhe@redhat.com> - 2.0.0-300.2
changelog:
  mkdumprd: Allow findmodule() to add dependency for lsmod output, resolves bug 1403699
  mkdumprd: Kill useless code in moduledep(), resolves bug 1403699


author: Matthias Saou <http://freshrpms.net/> 8.1.0-2
changelog:
  - Update to 8.1.0.
  - Merge back changes from Paul Howarth.
  - Make sure the scriplets never return a non-zero exit status.


author: Lumír Balhar <lbalhar@redhat.com> - 8.2.0-7
changelog:
  - Fix CVE-2020-10108 HTTP request smuggling when presented with two Content-Length headers
  Resolves: rhbz#1813439
  - Remove useless macros definitions


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-4
changelog:
  - Fix spice-server crash when client sends a password which is too long
    Resolves: rhbz#999839 (CVE-2013-4282)


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-5
changelog:
  - Make sure we build with -Wl,-z,relro. We used to be getting that flag
    from openssl, but this is no longer the case, and rpmdiff gave a huge
    warning about it being gone
    Related: rhbz#999839 (CVE-2013-4282)


author: Kai Engert <kaie@redhat.com> - 2014.1.98-65.2
changelog:
  - Add an alternative version of the "Thawte Premium Server CA" root,
    which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
    which contain that version of the root certificate (rhbz#1138230).
    This change doesn't add trust for another key, because both versions
    of the certificate use the same public key.


author: Kai Engert <kaie@redhat.com> - 2015.2.3-65.1
changelog:
  - Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
  - Add a patch to the source RPM that documents the changes from the
    upstream version.
  - Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
    configuration file.
  - The new scriptlets require the coreutils package.
  - Remove the obsolete blacklist.txt file.


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.7.3-1
changelog:
  - Update to 0.7.3 - for nl80211 and background scanning (rh #713280)
  - Drop upstreamed and backported patches


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-95
changelog:
  - Bump version to 1.2.11-15-95
  - Resolves: Bug 1562152 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch


author: Jiri Vanek <jvanek@redhat.com> - 1.1-2
changelog:
  - package now "installs" also during pretrans, so pretrasn scripts can use it
  - pretrasn "install" is removed in postrans


author: Jiri Vanek <jvanek@redhat.com> - 1.2-1
changelog:
  - initial import to rhel6
  - commented out lua-posix
  - the work horse file changed to 644 (as it do not work without lua-posix)
  - Resolves: rhbz#1391735


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-14
changelog:
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1066589)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-16
changelog:
  - do not resend signal on termination (#1075635)
  - fix argv rewrite (#1047506)
  - fix brace expansion on/off (#1078698)
  - fix incorrect rounding of numsers 0.5 < |x| <1.0 in printf (#1070350)
  - fix parser errors related to the end of the here-document marker (#1036931)
  - ksh hangs when command substitution fills out the pipe buffer (#1062296)
  - using typeset -l with a restricted variabled caused segmentation fault (#1083713)
  - ksh stopped on read when monitor mode was enabled (#1023109)
  - monitor mode was documented incorrectly (#1019334)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-17
changelog:
  - do not crash when unsetting running function from another one (#1105138)
  - should report an error when trying to cd into directory without execution bit (#1102627)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-18
changelog:
  - job locking mechanism did not survive compiler optimization (#1112306)
  - wrong return code from a pipe in command substitution (#1117316)


author: Ryan O'Hara <rohara@redhat.com> - 1.4.24-1
changelog:
  - Rebase to upstream version 1.4.24.
    Resolves: rhbz#947987
  - Rewrite rules flaw can lead to arbitrary code execution (CVE-2013-1912).
    Resolves: rhbz#947701
  - Fix possible crash when using negative header occurrences (CVE-2013-2175).
    Resolves: rhbz#974263
  - Enable TPROXY support.
    Resolves: rhbz#921064


author: Ian Kent <ikent@redhat.com> - 5.0.5-124
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - wait for master map available at start.
    - add master read wait option.
  - Resolves: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-125
changelog:
  - bz703846 - Incorrect autofs.schema
    - update and add README for old autofs schema
  - Resolves: rhbz#703846


author: Ian Kent <ikent@redhat.com> - 5.0.5-126
changelog:
  - bz1384404 - Automounter does not fetch maps from AD
    - work around sss startup delay.
    - add sss master map wait config option.
  - Resolves: rhbz#1384404


author: Ian Kent <ikent@redhat.com> - 5.0.5-127
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - fix included master map not found return.
    - dont exit on master map read fail timeout.
    - set sane default master read wait timeout.
  - Related: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-128
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - don't return until after master map retry read.
  - Related: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-129
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - make lookup_nss_read_master() return nss status.
  - Related: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-130
changelog:
  - bz703846 - Incorrect autofs.schema
    - fix autofs.schema.new not copied to package.
  - Resolves: rhbz#703846


author: Ian Kent <ikent@redhat.com> - 5.0.5-133.el6_9
changelog:
  - bz1501922 - Autofs processes hung while waiting for the release of an
    entry master_lock that is held by another thread waiting on a bind mount
    - only take master map mutex for master map update.
  -Resolves: rhbz#1501922


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-60.0
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.3
changelog:
  - Intel CPU microcode update to 20180703
  - Add infrastructure for handling kernel-version-dependant microcode
  - Resolves: #1574593


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.54-1
changelog:
  - specfile: require newer lvm
  - ifdown-eth: add timeout for when flushing global scope
  - functions: support boolean values in is_true() & is_false()
  - ifup-aliases: do not return with error when arping fails
  - netconsole: resolve domain name via 'getent' instead of 'hosts'


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.55-1
changelog:
  - ipcalc: detect invalid mask
  - ifup-aliases: send gratuitous ARPs when adding addresses
  - network: treat other tunnel interfaces (fixes ifdown stage)
  - kexec-disable.conf: release kexec memory properly
  - network-functions: do not send hostname via dhclient everytime
  - sysconfig/network: NO_DHCP_HOSTNAME option introduced
  - ipv6_add_addr_on_device: replace the existing address on NIC


author: Adam Tkac <atkac redhat com> - 0.17-60
changelog:
  - merge review related fixes (#226379)
  - remove unused patches
    - netkit-rsh-0.16-pamfix.patch
    - netkit-rsh-0.16-jbj2.patch
    - netkit-rsh-0.16-jbj3.patch


author: Michal Ruprich <mruprich@redhat.com> - 0.17-64.1
changelog:
  - Resolves: #1450821 - rlogin fails to connect rsh-server after updating util-linux-ng from version 2.17.2-12.18.el6 to 2.17.2-12.24.el6


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.101
changelog:
  - Add 0268-RHBZ-1447328-fix-reserve.patch
    * stop waiting for threads that weren't successfully created
  - Resolves: #1447328


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.102
changelog:
  - Add 0269-RHBZ-1442369-fix-check-partitions.patch
    * fix crash when partition minor starts with all the digits of the
      multipath device number
  - Add 0270-RHBZ-1408287-remove-long-def-timeout.patch
    * make all timeouts use checker_timeout if set and default to 60 sec.
  - Add 0271-RHBZ-1444193-fix-hang-on-resume.patch
    * resume again if an invalid table left the device suspended
  - Add 0272-RHBZ-1525217-3PAR-config.patch
  - Resolves: #1408287, #1442369, #1444193, #1525217


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.104
changelog:
  - Add 0273-RHBZ-1550069-fix-messages.patch
    * change error messages to warning messages, if adding or updating a
      multipath device fails because the device is missing from sysfs
  - Resolves: #1550069


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.105
changelog:
  - Add 0274-RHBZ-1573463-uevent-socket.patch
    * retry binding socket and close it immediately when cancelled.
  - Resolves: #1573463


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.106
changelog:
  - Modify 0272-RHBZ-1525217-3PAR-config.patch
    * revert path selector to round-robin
  - Resolves: #1578515


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.106.1
changelog:
  - Add 0275-RHBZ-1589741-fix-crash.patch
    * revert crashing code from 0274-RHBZ-1573463-uevent-socket.patch
  - Resolves: #1589741


author: Petr Šabata <contyk@redhat.com> - 0.9.45-4
changelog:
  - The devel subpackage now properly requires the base package to avoid
    multilib conflicts (#869633)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-6
changelog:
  - Willing SUT retains PFC operational state from peer after peer
    stops transmitting TLV (#870578)
  - Unable to query configured PFC priorities under IEEE DCBX (#870576)


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-1
changelog:
  - Switch over to using the "distribute" project; rebase to 0.6.10 (rhbz:570350)
  - Remove svn patch as upstream has chosen to go with an easier change for now.
  - Move easy_install back into the main package as the needed files have been
    moved from python-devel to the main python package.


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-2
changelog:
  - delete stray ".orig" file
  - change %define to %global ; use %{buildroot} rather than env var
  - move %check lower down
  - explicitly list executables


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-3
changelog:
  - cherrypick upstream patch for easy_install (ignore locally installed
  packages: patch0)
  - provide "python-distribute"
  - add README.txt and other .txt documentation files to the payload
  Resolves: rhbz#613138


author: Jan Kaluza <jkaluza@redhat.com> 3:2.1.12-20
changelog:
  - fix #745409 - do not set Indexes in httpd configuration for public archive
  - fix #1008139 - fix traceback when list_data_dir is not a child of var_prefix


author: Jan Kaluza <jkaluza@redhat.com> 3:2.1.12-23
changelog:
  - fix #1095359 - handle update when some mailing lists have been created
    by newer Mailman than this one


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.4
changelog:
  - Resolves: #1412733 - CVE-2016-10002 squid34: squid: Information disclosure
    in HTTP request processing


author: Ian Kent <ikent@redhat.com> - 5.0.5-113
changelog:
  - bz1201195 - autofs: MAPFMT_DEFAULT is not macro in lookup_program.c
    - fix macro usage in lookup_program.c.
  - Resolves: rhbz#1201195


author: Ian Kent <ikent@redhat.com> - 5.0.5-115
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - add dependent patch series.
    - add aditional bug fix patches, including updated error handling on ldap bind fail.
    - add reinit method and change lookup to use reinit instead of reopen for its shared
      libraries.
  - Resolves: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-116
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - fix mistake in the updated error handling on ldap bind fail patch.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-117
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - fix error handling on ldap bind fail patch again.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-118
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - fix unbind external mech.
    - fix sasl connection concurrancy problem.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-119
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - rework sasl connection concurrancy problem patch.
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-120
changelog:
  - bz1161031 - RFE: autofs MAP_HASH_TABLE_SIZE description
    - update map_hash_table_size description.
  - bz1248798 - Request to add a configuration option to force use of the map entry
    hostname for mounts
    - add configuration option to use fqdn in mounts.
  - also update changelog with patches include from other bugs in rev 115 to support
    changes for bug 1243525.
    - fix left mount count return from umount_multi_triggers() (1227496).
    - fix return handling in sss lookup module (1227496).
    - move query dn calculation from do_bind() to do_connect() (1227496).
    - make do_connect() return a status (1227496).
    - make connect_to_server() return a status (1227496).
    - make find_dc_server() return a status (1227496).
    - make find_server() return a status (1227496).
    - fix return handling of do_reconnect() in ldap module (1227496).
    - fix race accessing qdn in get_query_dn() (1084254).
    - init qdn before use in get_query_dn() (1084254).
    - fix direct mount stale instance flag reset (1232074).
  - bz1263505 - Heavy program map usage can lead to a hang
    - fix out of order call in program map lookup.
  - bz1238605 - On every system boot automount needs a restart to access NIS map
    - fix lsb service name in init script.
  - bz1097864 - Duplicate mounts created or leftovers in mtab
    - revert special case cifs escapes.
  - bz1203139 - Similar but unrelated NFS exports block proper mounting of
    "parent" mount point
    - remove unused offset handling code.
    - fix mount as you go offset selection.
  - bz1222522 - Parent directory in nested mount gets unmounted while the child
    remains mounted
    - guard against incorrect umount return.
  - bz1233057 - Direct map does not expire if map is initially empty
    - fix direct map expire not set for initail empty map.
  - Resolves: rhbz#1161031 rhbz#1248798 rhbz#1227496 rhbz#1084254 rhbz#1232074
  - Resolves: rhbz#1263505 rhbz#1238605 rhbz#1097864 rhbz#1203139 rhbz#1222522
  - Resolves: rhbz#1233057


author: Ian Kent <ikent@redhat.com> - 5.0.5-121
changelog:
  - bz1243525 - double free or corruption (fasttop) causes abort in ldap_int_tls_destroy
    - Some Coverity identified fixes for recent changes for this bug.
    - fix memory leak in nisplus lookup_reinit().
    - fix memory leak in ldap do_init().
    - fix use after free in sun parser parse_init().
    - fix use after free in open_lookup().
    - fix typo in autofs_sasl_bind().
  - Related: rhbz#1243525


author: Ian Kent <ikent@redhat.com> - 5.0.5-122
changelog:
  - bz1233057 - Direct map does not expire if map is initially empty
    - don't schedule new alarms after readmap.
  - Related: rhbz#1233057


author: Ian Kent <ikent@redhat.com> - 5.0.5-123
changelog:
  - bz1333777 - RHEL6.7: shutdown / reboot hangs with findmnt in a readlink
    system call, doing path_walk and stuck in autofs4_wait
    - always set direct mounts catatonic at exit.
    - fix error handing in do_mount_indirect().
    - check negative cache much earlier.
    - log pipe read errors.
    - fix handle_mounts() termination condition check.
  - Resolves: rhbz#1333777


author: Nils Philippsen <nils@redhat.com> - 0.95-1
changelog:
  - ignore whitespace and empty lines when checking /etc/hosts
  - use mktemp to create temporary host file
  - add release numbers to changelog entries


author: Jan Grulich <jgrulich@redhat.com> - 0.98-1
changelog:
  - add Man-Page
  - correctly detect VMware virtual guest
  - do not write to /etc/security/limits.conf directly
  - correctly edit /etc/hosts


author: Jan Grulich <jgrulich@redhat.com> - 0.98-5
changelog:
  - add information about KVM to manpage 
    resolves: bz#1123917
  - set correct vm.max_map_count value
    resolves: bz#1168422
  - do not wait for input from keyboard and read from file instead
    resolves: bz#1173861
  - add information about sapconf version
    resolves: bz#1174321


author: Jay Fenlason <fenlason@redhat.com> - 1.5-2
changelog:
  - Build the 1.1 version as well, so we have the old library for backward
    compatability.
    Resolves: rhbz1070347


author: Michal Schmidt <mschmidt@redhat.com> - 1.5-3
changelog:
  - Make libhwloc.so point to the current library version, not the compat one.
    Resolves: rhbz1135040


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.0
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1325425


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-11
changelog:
  - Resolves: #1248855 - After updating to squid-3.1.23-9.el6,
    service squid {reload,restart} fails with "Operation not permitted"


author: Tim Waugh <twaugh@redhat.com> - 4.0.3-10
changelog:
  - Removed old explicit provides for perl(Foomatic::GrovePath).
  - Fixed macro in changelog.
  - Avoid mixed spaces and tabs.
  - Ship COPYING files.
  - Added comments for sources.
  - Use Requires not PreReq (bug #225768).


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-1
changelog:
  - Updated to 4.0.4 (bug #570234).  No longer buildrequires
    ghostscript-devel (but requires ghostscript) or
    foomatic-filters-int-options patch.


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-2
changelog:
  - Applied patch to fix improper sanitization of command line options
    (CVE-2011-2964, bug #727016).


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-3
changelog:
  - Too few arguments for format in a debugging string (bug #726385).
  - Fixed perl installation locations for build (bug #661770).


author: Jiri Popelka <jpopelka@redhat.com> - 4.0.4-5
changelog:
  - Also consider back tick and semicolon as illegal shell escape characters.
  - CVE-2015-8327, CVE-2015-8560


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-45
changelog:
  - fixed potential memory leak on realloc failure when processing 'extend'
    option (#893119)
  - added precise enumeration of configuration files searched to
    snmp_config(5) man page (#907571)
  - set permissions of snmpd.conf and snmptrapd conf to 0600 (#919239)
  - fixed kernel threads in hrSWRunTable (#919952)
  - fixed various error codes in Python module (#955771)
  - fixed snmpd crashing in the middle of agentx request processing when
    a subagent disconnects (#955511)
  - allow 'includeFile' and 'includeDir' options in configuration files
    (#917816)
  - fixed netlink message size (#927474)
  - fixed IF-MIB::ifSpeedHi on systems with non-standard interface speeds
    (#947973)
  - fixed BRIDGE-MIB::dot1dBasePortTable not to include the bridge itself
    as a port (#960568)
  - fixed snmpd segfault when 'agentaddress' configuration options is used
    and too many SIGHUP signals are received (#968898)
  - updated UCD-SNMP-MIB::dskTable to dynamically add/remove disks
    if 'includeAllDisks' is specified in snmpd.conf (#922691)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)


author: Steve Dickson <steved@redhat.com> - 0.2.0-10
changelog:
  - Make is_loopback check more permissive (bz 731542)
  - Removed the rpcbind(3) reference in the man page (bz 813898)


author: Dave Anderson <anderson@redhat.com> - 6.0.3-1.el6
changelog:
  - Support sadump dumpfile formats for Fujitsu Stand Alone Dump facility.
    Resolves: rhbz#736884
  - Support s390x ELF-kdump and s390x compressed-kdump dumpfiles.
    Resolves: rhbz#738865 
  - Display an early warning message if any part of the kernel has been 
    erased/filtered by the makedumpfile facility.
    Resolves: rhbz#739096
  - Fix for the "runq" command for kernels that are configured with
    CONFIG_FAIR_GROUP_SCHED.
    Resolves: rhbz#754291
  - Fix for the x86_64 "bt" command to handle a recursive entry into
    the NMI exception stack.
    Resolves: rhbz#768189
  - Fix for an x86_64 "bt" command segmentation violation if the number
    of ELF_PRSTATUS notes in a compressed-kdump do not match the number
    of cpus running when the system crashed.
    Resolves: rhbz#782837 
  - Rebase to upstream version 6.0.3.
    Resolves: rhbz#767257


author: Dave Anderson <anderson@redhat.com> - 6.0.4-2.el6
changelog:
  - Fix s390x "vm -p" to properly handle swapped-out and unmapped
    user pages.
  - Fix s390x "bt -[tT]" on a live system.
    Resolves: rhbz#817247
    Resolves: rhbz#817248


author: Dave Anderson <anderson@redhat.com> - 6.1.0-6.el6
changelog:
  - Support new sadump format that can represent more than 16 TB physical memory space
    Resolves: rhbz#1209241


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 1.4.5-5
changelog:
  - CVE-2015-1802: missing range check in bdfReadProperties (bug 1258892)
  - CVE-2015-1803: crash on invalid read in bdfReadCharacters (bug 1258892)
  - CVE-2015-1804: out-of-bounds memory access in bdfReadCharacters (bug 1258892)


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - Update description
  - Remove other distros from SPEC
  - Changed license
  - Change Source0 to Sourceforge
  - Resolves: #981637


author: Miloslav Trmač <mitr@redhat.com> - 2.9.16-1
changelog:
  - Update to tmpwatch-2.9.16.
  - Exclude /tmp/hsperfdata_*.
    Resolves: #527425
  - Preserve timestamps where possible.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
changelog:
  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
  - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
    is called prematurely by application (#546707)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
changelog:
  - fix CVE-2009-3555 - support the safe renegotiation extension and
    do not allow legacy renegotiation on the server by default (#533125)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
changelog:
  - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
    in the RHEL-5 and newer versions will crash in such case (#569774)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-20.1
changelog:
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server
  - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
  - disable SSLv2 in the generic TLS method


author: Ian Kent <ikent@redhat.com> - 5.0.5-140.el_6_10.1
changelog:
  - bz1197622 - automount segfaults in error code path (reproducible
    PRErrorTableList corruption)
    - nss workaround.
  - Resolves: rhbz#1197622


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-5
changelog:
  - Correctly mark the LDAP default password value as encrypted (CVE-2011-0002)
    Resolves: #668021
  - Default LDAP cn to username if gecos is empty
    Resolves: #670151
  - Preserve setuid and setgid bits when copying files from /etc/skel
    Resolves: #724987
  - Fix segfault when reading database files with certain sizes
    Resolves: #788521


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-7
changelog:
  - Don’t use 512-bit RSA private keys in tests
    Related: #1235518
  - Fix testsuite failures if more than one architecture is building concurrently
    Related: #1235518


author: Lon Hohberger <lhh@redhat.com> - 5.5-8
changelog:
  - Add watchdog.d handling
    (bz657750-1-add-watchdog-d.patch)
    This makes the scripts in /etc/watchdog.d behave slightly differently
    (bz657750-2-script-handling.patch)
    Add test-directory to configuration file
    (bz657750-3-add_test_directory_to_configuration_file.patch)
    Log which binaries fail
    (bz657750-4-Log-binary-names.patch)
    Resolves: rhbz#657750


author: Lon Hohberger <lhh@redhat.com> - 5.5-9
changelog:
  - Add man page information on test-directory
    (bz657750-5-man_page_information_for_test_directory.patch)
    Resolves: rhbz#657750


author: Richard W.M. Jones <rjones@redhat.com> - 5.5-10
changelog:
  - Import watchdog initscript from Rawhide, includes some LSB-compliance
    fixes.
    Resolves: rhbz#584701


author: Ales Ledvinka <aledvink@redhat.com> - 5.6-4
changelog:
  - With no value provided for watchdog-timeout do not attempt
    to set it. Avoid conflict with custom module parameter.
  - Resolves: rhbz#1099604


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-22
changelog:
  - allow larger DH parameters length(#1230258)
  - don't check client PID in non-login auth sockets (#1281670)
  - messages containing a CP932 character were not shown in a search result (#1275233)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-22.1
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1752708)


author: Robert Relyea <rrelyea@redhat.com> - 1.0.8-14
changelog:
  - Fix 'Bugzilla Bug #797358 - mod_nss fails debug assertion' by removing
    'mod_nss-no_shutdown_if_not_init.patch' and applying
    'mod_nss-no_shutdown_if_not_init_2.patch' instead
  - The 'mod_nss-no_shutdown_if_not_init_2.patch' patch also fixes
    Bugzilla Bug #797326 - File descriptor leak after "service httpd reload"
    or httpd doesn't reload


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-15
changelog:
  - Fixes Bugzilla Bug #749408 - PK11_ListCerts called to retrieve all user
    certificates for every server (mod_nss-PK11_ListCerts.patch)
  - Fixes Bugzilla Bug #749409 - Add '--enable-ecc' option to %configure
    line under %build section of RHEL 6 spec file


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-16
changelog:
  - Fixes Bugzilla Bug #769906 - mod_nss insists on Required value
    NSSCipherSuite not set. (mod_nss-proxyvariables.patch)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-17
changelog:
  - Fixes Bugzilla Bug #816394 - [RFE] Provide Apache 2.2 support for TLS v1.1
    via NSS through mod_nss . . .
  - Bumped version build/runtime requirements for NSPR and NSS


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-18
changelog:
  - Fixes Bugzilla Bug #835071 - [RFE] Support ability to share mod_proxy with
    other SSL providers (w/jorton, nkinder, & rcritten)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-19
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #1030265 - mod_nss: incorrect handling of NSSVerifyClient in
    directory context [rhel-6.5.z]


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-20
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #1030267 - mod_nss: incorrect handling of NSSVerifyClient in
    directory context [rhel-6.6]


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-21
changelog:
  - Bumped version build/runtime requirements for 'nspr' and 'nss'
  - Added runtime dependency for 'nss-softokn'
  - Bugzilla Bug #1002733 - Apache core generated with sig 5
  - Bugzilla Bug #1016628 - mod_nss httpd segfaulting regularly
  - Bugzilla Bug #866703 - Memory error in mod_nss (eol_memmove.patch)


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-9.el6_7.1
changelog:
  - Fixed session and cookies processing
  - Fixed command injection vulnerability
  - Resolves: rhbz#1253287 rhbz#1253291


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - removed defaults option requiretty from /etc/sudoers
    - backported pam_service and pam_login_service defaults options
    - implemented a new defaults option for changing netgroup processing
      semantics
    - fixed visudo's quiet cli option
    Resolves: rhbz#1248695
    Resolves: rhbz#1247231
    Resolves: rhbz#1241896
    Resolves: rhbz#1197885
    Resolves: rhbz#1233205


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2
changelog:
  - krshd: don't limit user names to 16 chars when utmp can handle names
    at least a bit longer than that (#632442, RT#6773)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2.1
changelog:
  - ftpd: add candidate patch to detect setegid/setregid/setresgid and check
    for errors when calling them (MITKRB5-SA-2011-005, CVE-2011-1526, #713342)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-3
changelog:
  - drop calls to pam_selinux from the gssftp PAM configuration (#713459)
  - reference password-auth instead of system-auth in the gssftp and kshell
    PAM configurations


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-4
changelog:
  - increase the size of the ftp client's command line input buffer (#665834)
  - incorporate patch to correct parsing errors with "restrict" lines in
    ftpusers (#713521, RT#6889)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-7
changelog:
  - add Siddhesh Poyarekar's patch to ensure that when performing an "mdir"
    or "mls" operation, that the FTP client always passes an actually-terminated
    string as the open mode for fopen() (#773538, RT#7079)


author: Marek Grac <mgrac@redhat.com> - 1.1.12-12
changelog:
  - Displays Logical Volumes without filesystem under 'Unitialized'
  - Resolves: rhbz#791153
  - s-c-lvm traceback on parsing "dmsetup ls" output 
  - Resolves: rhbz#815921


author: Marek Grac <mgrac@redhat.com> - 1.1.12-13
changelog:
  - s-c-lvm crash after startup on machine with many LV
  - Resolves: rhbz#840070
  - s-c-lvm crash when encounter RAID 1 created in LVM
  - Resolves: rhbz#852864
  - s-c-lvm crash on mirrored LV with mirrorlog
  - Resolves: rhbz#852864


author: Marek Grac <mgrac@redhat.com> - 1.1.12-14
changelog:
  - s-c-lv crash after startup on machine with many LV
    Resolves: rhbz#840070
  - s-c-lvm crash when encounter RAID1 created in LVM
    Resolves: rhbz#852864


author: Marek Grac <mgrac@redhat.com> - 1.1.12-17
changelog:
  - s-c-lvm crases with thin volumes
    Resolves: rhbz#878253
  - s-c-lvm GUI can not be opened from some OS
    Resolves: rhbz#953071
  - s-c-lvm does not allow online extend of ext3 fs
    Resolves: rhbz#1029755


author: Ian Kent <ikent@redhat.com> - 5.0.5-101
changelog:
  - bz1059549 - autofs negative cache not working for included map
    - fix fix negative status being reset on map read.
    - and adjust dependent patches later in series.
  - Related: rhbz#1059549


author: Ian Kent <ikent@redhat.com> - 5.0.5-102
changelog:
  - bz994217 - RFE: RHEL6: Add am-utils RPM or equivalent am-utils functionality
    to other packages
    - fix expire when server not responding.
  - Related: rhbz#994217


author: Ian Kent <ikent@redhat.com> - 5.0.5-103
changelog:
  - bz994217 - RFE: RHEL6: Add am-utils RPM or equivalent am-utils functionality
    to other packages
    - fix ldap_uri config update.
    - fix typo in conf_load_autofs_defaults().
    - fix hash on confg option add and delete.
    - add plus to path match pattern.
    - fix multi entry ldap option handling.
    - cleanup options in amd_parse.c.
    - allow empty value for some map options.
    - allow empty value in macro selectors.
  - Related: rhbz#994217


author: Ian Kent <ikent@redhat.com> - 5.0.5-104
changelog:
  - bz1081285 - automount segfaults in tlsm_deferred_init
    - add serialization to sasl init.
  - Resolves: rhbz#1081285


author: Ian Kent <ikent@redhat.com> - 5.0.5-105
changelog:
  - bz1081479 - autofs service fails to start when scheduling through satellite
    via remote command
    - dont allocate dev_ctl_ops too early.
  - Resolves: rhbz#1081479


author: Ian Kent <ikent@redhat.com> - 5.0.5-106
changelog:
  - bz994217 - RFE: RHEL6: Add am-utls RPM or equivalent am-utils functionality
    to other packages
    - Covarity motivated corrections.
      - fix leak in cache_push_mapent().
      - fix config entry read buffer not checked.
      - fix FILE pointer check in defaults_read_config().
      - fix memory leak in conf_amd_get_log_options().
      - fix signed comparison in inet_fill_net().
      - fix buffer size checks in get_network_proximity().
      - fix leak in get_network_proximity().
      - fix buffer size checks in merge_options().
      - check amd lex buffer len before copy.
      - add return check in ldap check_map_indirect().
      - check host macro is set before use.
      - check options length before use in parse_amd.c.
      - fix some out of order evaluations in parse_amd.c.
      - fix copy and paste error in dup_defaults_entry().
      - fix leak in parse_mount().
      - add mutex call return check in defaults.c.
  - Related: rhbz#994217


author: Ian Kent <ikent@redhat.com> - 5.0.5-107
changelog:
  - bz994217 - RFE: RHEL6: Add am-utls RPM or equivalent am-utils functionality
    to other packages
    - force disable browse mode for amd format maps.
    - fix hosts map options check in lookup_amd_instance().
  - Related: rhbz#994217


author: Ian Kent <ikent@redhat.com> - 5.0.5-108
changelog:
  - bz1130833 - Memory leak in get_exports
    - fix memory leak in create_client().
    - fix memory leak in get_exports().
  - Resolves: rhbz#1130833


author: Ian Kent <ikent@redhat.com> - 5.0.5-109
changelog:
  - bz994217 - RFE: RHEL6: Add am-utls RPM or equivalent am-utils functionality
    to other packages
    - fix memory leak in get_defaults_entry().
    - fix out of order clearing of options buffer.
    - fix reset amd lexer scan buffer.
    - ignore multiple commas in options strings.
  - Related: rhnz#994217


author: Ian Kent <ikent@redhat.com> - 5.0.5-109.el6_6.1
changelog:
  - bz1170887 - Autofs unable to mount indirect after attempt to mount wildcard
    - make negative cache update consistent for all lookup modules.
    - ensure negative cache isn't updated on remount.
    - dont add wildcard to negative cache.
  - Resolves: rhbz#1170887


author: <dwalsh@redhat.com> - 3.0.45-1
changelog:
  - Patch from Mgrepl to stop printable from crashing if None is passed in
  - Update to latest translations


author: Olivier Fourdan <ofourdan@redhat.com> 2.28.2-29
changelog:
  - wacom: Update input transformation matrix on monitor changes (#861890)
    wacom: Re-fix LED as per latest discussions on linuxwacom-devel (#805064)
    Resolves: #805064 #861890


author: Ray Strode <rstrode@redhat.com> - 2.28.2-35.2
changelog:
  - Another smartcard update to support drivers that don't
    announce already inserted smartcards at startup
    Related: #1299992


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 4.3.3-3
changelog:
  - allow 'Open Folder in Tabs' in Konsole to support SSH bookmarks (kde#177637)
    (upstream patch backported from 4.4)


author: Than Ngo <than@redhat.com> - 6:4.3.4-5
changelog:
  - Resolves: bz#631481, Undecodable sequence message starting konsole
  - Resolves: bz#609039, Password & User account becomes non responding


author: Than Ngo <than@redhat.com> - 6:4.3.4-6
changelog:
  - Resolves: bz#608007, "Show menu bar" is always checked
  - Resolves: bz#729307, not possible to set default konsole size


author: Jan Grulich <jgrulich@redhat.com> - 6:4.3:4-7
changelog:
  - Resolves: bz#1305833 - System wide plasma-desktop-appletsrc settings not reflected in user profile


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.2-4
changelog:
  - Fix problem where mdadm allowed the creation of more arrays than
    supported by the BIOS.
  - Resolves bz1211564


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.3
changelog:
  - Retry reading sync_completed state to avoid a reshape not continuing after
    restarting a reshape
    This is an additional patch to resolve this bug.
  - Resolves bz1331331


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.4
changelog:
  - Fix problem with mdadm large device names overflowing an internal buffer,
    potentially leading to segfaults.
  - Resolves bz1347808


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.5
changelog:
  - Fix problem with reshaping IMSM arrays, where a new reshape could be
    launched before the first reshape had fully completed, leading to
    unpected results.
  - Resolves bz1348544


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-6
changelog:
  - don't require logrotate (#922769)
  - move pppd database to /var/run/ppp to prevent SELinux AVCs (#968398)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-7
changelog:
  - ignore unrecognised radiusclient configuration directives (#906912)
  - add missing l2tp support (#815128)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-8
changelog:
  - prevent running into issues caused by undefined behavior (pointers of incompatible types aliasing the same object)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.448.el6_6.4
changelog:
  - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225886]
  - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225886]
  - Resolves: bz#1225886
    (EMBARGOED CVE-2015-3209 qemu-kvm: qemu: pcnet: multi-tmd buffer overflow in the tx path [rhel-6.6.z])


author: Anton Arapov <anton@redhat.com> - 1:2.11-7
changelog:
  - Add "PXE" to HP OEM Type 209 record output
  - Properly print the hexadecimal value of invalid string characters


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 12.3-1
changelog:
  - Place mailx to /bin/mailx, to avoid extra symlink in redhat-lsb package
  - /bin/mailx is now a base binary, another symlinked to it.


author: Peter Schiffer <pschiffe@redhat.com> - 12.4-7
changelog:
  - resolves: #857120
    fixed incorrect return code when TMPDIR points to invalid path
  - resolves: #845098
    added support for alternatives


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Jiri Skala <jskala@rehat.com> - 2.2.2-9
changelog:
  - Resolves: #785084 - vsftpd can not handle square brackets in ls
  - Resolves: #785061 - vsftpd child terminates when listing files with UID/GID larger than signed in
  - Resolves: #717411 - Connection failures during upload using PORT not handled cleanly
  - Resolves: #752954 - Disabling Reverse DNS lookups in VSFTPd
  - Resolves: #745133 - vsftpd: documentation for 'max_per_ip' default setting is wrong
  - Resolves: #765757 - SITE HELP offers CHMOD even when it is disabled/unavailable
  - Resolves: #701300 - vsftpd.conf lists incorrect default value for xferlog_file
  - Resolvse: #785642 - Invalid error recovery in vsf_privop_pasv_listen()


author: Martin Osvald <mosvald@rehat.com> - 2.2.2-14
changelog:
  - Resolves: #1092877 - The vsftpd hangs in a SIGCHLD handler when the pam_exec.so is used in pam.d configuration


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-15
changelog:
  - Handle pending signals before flush so that the the .history file
    does not get truncated
  - Implement file locking using shared readers, exclusive writer
    to prevent any .history file data corruption


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 6.17-16
changelog:
  - Revert exit status regression with it's opt-out variable $anyerror,
    added by "Fix status of pipelined/backquoted/list of commands" and
    opt-in the POSIX-like exit status behaviour by $status_posix_value
    variable instead (#784510)


author: Roman Kollar <rkollar@redhat.com> 6.17-21
changelog:
  - Fix dosource() calls after history file locking patch, requested release number bump
    Resolves: #847102


author: Roman Kollar <rkollar@redhat.com> 6.17-22
changelog:
  - Fixed .history patch issue breaking upstream multibyte tests
    Resolves: #821796
  - Revert history handling in loops
    Resolves: #814069


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-10
changelog:
  - updated 'delloem setled' command to indicate SES status and drive
    activities for a PCI-e SSD (#727314)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-10
changelog:
  - added -Y option for ipmitool to hide Kg key from cmdline (#698647)
  - added 'channel setkg' command to set Kg encryption key on remote machine
    (#726390)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-11
changelog:
  - fixed delloem powermonitor on bigendian systems (#731718)
  - fixed memory leak in Serial-over-Lan module (#731977)


author: Jaroslav Kysela <jkysela@redhat.com> 1.0.22-2
changelog:
  - updated to 1.0.22 final
  - added alsaloop utility and alsa-delay script
  - updated the alsa-info.sh script
  - Resolves: rhbz#650113


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.5-1
changelog:
  - v1.7.5 (Ernest) 19jul09
  - -----------------------
  -  * added support for ARC4 cipher and CTR block chaining (Denis Bernard)
  -  * made transport threads daemonize, to fix python 2.6 atexit behavior
  -  * support unicode hostnames, and IP6 addresses (Maxime Ripard, Shikhar
  -    Bhushan)
  -  * various small bug fixes


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server mode
    (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 1.10: https://gist.github.com/stevebeattie/0eb190004e10ba0926ad8782f89676ad
    Resolves #1557140


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-4
changelog:
  - Fix and enable tests (%check).
  - Backport a change which makes tests exit with nonzero status when they fail.
  - Add a fix for upstream tests for CVE-2018-7750 (broken in previous).


author: Filip Krska <fkrska@redhat.com> = 3.2-57
changelog:
  [policies] get package list without a timeout
    [policies/redhat] make missing 'filesystem' package non-fatal
    Resolves: bz1506596


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 3.1.7-7
changelog:
  - Fix double free in free_wstr (#648906)
  - Prevent overflows by increasing YYMAXDEPTH and YYSTACKSIZE
    byacc/bison parameters (#743343)
  - Preserve argv by copying the strings (#740673)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 3.1.7-10.el6_7.2
changelog:
  - Man & info pages fixed to describe the '--posix' usage correctly,
    as discussed in #1271443 (comments #1 and #2)


author: Shane Bradley <sbradley@redhat.com> = 3.2-26
changelog:
  - [cluster] Scrub password from crm_report data.
    Resolves: bz1206581
  - [networking] Use the correct options for nmcli.
    Resolves: bz1206661


author: Stef Walter <stefw@redhat.com> - 0.7.4-1
changelog:
  - Update to upstream point release 0.7.4
  - Correctly handle truncating long host names [#1001667]
  - Try to contact all available addresses for discovery [#1004442]
  - Build fixes [#1004823]


author: Stef Walter <stefw@redhat.com> - 0.7.5-1
changelog:
  - Update to upstream point release 0.7.5
  - Workaround for discovery via IPv6 address [#1004442]
  - Correctly put IPv6 addresses in temporary krb5.conf


author: Simo Sorce <simo@redhat.com> 0.7.0-4
changelog:
  - Backport of useful patches from upstream
    - Better handling of IDP reported errors
    - Better handling of session data storage size


author: Simo Sorce <simo@redhat.com> 0.8.0-1
changelog:
  - New upstream realease version 0.8.0
  - Upstream moved to github
  - Drops patches as they have been all included upstream


author: Marek Grac <mgrac@redhat.com> - 3.0.15-40
changelog:
  - fencing: Add option --ssh-options
    Resolves: rhbz#1069618
  - fence_vmware_soap: python exception when user does not have privileges
    Resolves: rhbz#1018263
  - fence_wti: Add support for delay
    Resolves: rhbz#1079291
  - fence_ilo: Unable to enter password with "
    Resolves: rhbz#990537
  - fencing: Fence agent uses key authentication when it should use password
    Resolves: rhbz#1048842


author: Marek Grac <mgrac@redhat.com> - 3.0.15-41
changelog:
  - fence_brocade ported to fencing library
    Resolves: rhbz#641632 rhbz#642232 rhbz#841556
  - fence_rsb fails to power devices on with certain firmwares
    Resolves: rhbz#1110428


author: Marek Grac <mgrac@redhat.com> - 3.0.15-43
changelog:
  - fix quoes in fence_ilo
    Resolves: rhbz#990537
  - fix delay support for agents without off/reboot
    Resolves: rhbz#641632


author: Marek Grac <mgrac@redhat.com> - 3.0.15-44
changelog:
  - fence_brocade: fix default action
    Resolves: rhbz#1114559
  - fence_brocade: add support for list to allow monitor
    Resolves: rhbz#1114528


author: Miroslav Lichvar <mlichvar@redhat.com> 1.24-4.20100428git73d775
changelog:
  - update to 20100428git73d775
  - replace initstepslew directive with makestep in default config
  - add NetworkManager dispatcher script
  - add dhclient script
  - retry server/peer name resolution at least once to workaround
    NetworkManager race condition on boot
  - don't verify chrony.keys


author: Miroslav Lichvar <mlichvar@redhat.com> 1.25-1
changelog:
  - update to 1.25
  - link with -Wl,-z,relro,-z,now options
  - use iburst, four pool servers, rtcsync, stratumweight in default config
  - suppress install-info errors


author: Miroslav Lichvar <mlichvar@redhat.com> 1.25-3
changelog:
  - fix buffer overflow when processing crafted command packets (CVE-2012-4502)
  - don't send uninitialized data in command replies (CVE-2012-4503)


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.25
changelog:
  - Update Intel CPU microcode to microcode-20200520 release (#1839193):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.26
changelog:
  - Update Intel CPU microcode to microcode-20200602 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795353, #1795357, #1827186):
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.27
changelog:
  - Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision
    0xdc, use 0xd6 by default (#1846134).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.28
changelog:
  - Enable 06-55-04 (SKL-X/W) caveat by default.
  - Enable 06-2d-07 (SNB-E/EN/EP) caveat by default (#1846024).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.29
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826590):
    - Fixed a typo in the release note file.


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-17
changelog:
  - fix #841520 - do not try to change owner of log if it is not needed
  - fix #848131 - fix bad umask value while creating temp file
  - fix #920030 - set SELinux context before compress files creation
  - fix #922169 - remove temp files on error
  - fix #847338 - do not overwrite create directive value by ACL setting
  - fix #847339 - fix race condition between fchmod and acl_set_fd


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-18
changelog:
  - fix #722209 - do not redirect output of logrotate to /dev/null, mark
    logrotate.conf as config
  - fix #1117189 - sort logs according to dateformat when removing the old one
  - fix #625034 - update logrotate.status atomically
  - fix #984965 - fix possible overflow in "create" directive parsing
  - fix #1012485 - use permissions 0700 for cron.daily script


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-19
changelog:
  - fix #1047899 - add support for "maxsize" directive
  - fix #1125769 - add support for "createolddir" directive


author: Tomas Mraz <tmraz@redhat.com> - 2.0.13-3
changelog:
  - drop s390 specific ifnarchs as all the previously missing dependencies
    are now there
  - split out gpgsm into a smime subpackage to reduce main package dependencies


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.13-4
changelog:
  - Explicitly BR libassuan-static in accordance with the Packaging
    Guidelines (libassuan-devel is still static-only).


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-3
changelog:
  - initialize small amount of secmem for list of algorithms in help (#598847)
    (necessary in the FIPS mode of libgcrypt)


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-5
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.14-8
changelog:
  - fix aborts and default algorithms when running in FIPS mode (#1078957, #966493)
  - add missing initialization of libgcrypt in gpgv
  - properly encode s2k iteration count in gpg-agent (#638635)


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.146-1
changelog:
  - Rebased to latest upstream packages
  - Rubygems built with RELRO
  - Resolves: rhbz#1260021 rhbz#1242158


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.148-1
changelog:
  - Rebased to latest upstream packages
  - Fixed crashes on one-node clusters
  - Resolves: rhbz#1260021 rhbz#1283627


author: Ivan Devat <idevat@redhat.com> - 0.9.148-2
changelog:
  - Moved DISABLED_GUI option to /etc/sysconfig/pcsd
  - Added backend support for new cluster properties form in web UI
  - Fixed multilib .pyc/.pyo issue
  - Resolves: rhbz#1297782 rhbz#1298163


author: Ivan Devat <idevat@redhat.com> - 0.9.148-3
changelog:
  - Fixed updating cluster properties from older version of web UI
  - Fixed syntax error in utilization attributes functions
  - Resolves: rhbz#1298163
  - Related: rhbz#1260021


author: Jiri Popelka <jpopelka@redhat.com> - 0.7.0-2
changelog:
  - enable to specify disks with path to device file or
    with symbolic link to the device file (#766443)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 0.7.0-3
changelog:
  - fix the error message for '--gpfs-ops --gpfs' options (#989779)
  - fix the invalid syntax when '--mysql5-conn' is used (#766806)


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.10-43
changelog:
  - 630019 set correct (f)pie build flags
  - 615104 fix double echo in initscript
  - 589099 Wrong file permissions for atd configuration
  - Resolves: rhbz#630019, rhbz#615104, rhbz#589099


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-1
changelog:
  - Rebased to latest upstream packages
  - Fixed constraints removal and node standby/unstandby using remote GUI
  - Fixed displaying of fence / resource agent metadata in GUI
  - Added Pacemaker Resource defaults and Op defaults to 'pcs config' output
  - Fixed 'pcs resource clear' used on cloned group
  - Added support for scope option in cib commands
  - Added warning when creating a cluster with UDPU transport
  - Reload cluster.conf after node addition / removal
  - Resolves: rhbz#1185738 rhbz#1168982 rhbz#1174793 rhbz#1187488 rhbz#1190167 rhbz#1190168 rhbz#1191898 rhbz#1193433


author: Karel Klic <kklic@redhat.com> - 6.0-1
changelog:
  - Rebase to upstream 6.0
    Resolves: #594860
  - Fixed a buffer overflow (rhbz#532380, unzip-6.0-attribs-overflow.patch)
  - Generate debuginfos (rhbz#540220, unzip-6.0-nostrip.patch)
  - New upstream version
  - Compiled using `make generic_gcc` (includes asm)
  - Removed unzip542-rpmoptflags.patch, because RPM_OPT_FLAGS 
    are provided using command line
  - Removed unzip-5.51-link-segv.patch, because the link file 
    is not reopened in the current version
  - Removed unzip-5.51-link-segv2.patch, the bug was already fixed 
    in open_outfile in 5.52
  - Removed unzip-5.52-toctou.patch (CAN-2005-2475), the vulnerability 
    is fixed in the current version
  - Removed unzip-5.52-near-4GB.patch, unzip-5.52-near-4GB2.patch, 
    unzip-5.52-4GB3.patch, and unzip-5.52-4GB_types.patch, because 
    the current version supports large files
  - Removed unzip-5.52-long-filename.patch, the current version
    fixes the vulnerability by checking the length of command line 
    arguments in unzip.c
  - Removed unzip-5.52-makefile.patch, because we no longer create
    the link manually
  - Removed unzip-5.52-open.patch, the current version uses umask.
  - Removed unzip-5.52-cve-2008-0888.patch, the current version
    fixes this vulnerability
  - Ported unzip-5.52-249057.patch to current version (unzip-6.0-close)


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-2
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196132 #1196120 #1196124 #1196128


author: Peter Vrabec <pvrabec@redhat.com> - 2:4.1.4.2-10
changelog:
  - support ACLs under skel directory
  - refer to PAM in /etc/login.defs
  - userdel option to remove Linux login <-> SELinux login mapping
  - useradd special exit value if SELinux user mapping is invalid
  - usermod special exit value if SELinux user mapping is invalid
  - fix gshadow functions from shadow utils
  - fix find_new_uid/gid for big UID/GID_MAX
  - don't show users who were not logged in lastlog
    Resolves: #586796 #629277 #639900 
    Resolves: #639975 #639976 #667593 #672510
    Resolves: #693377 #706321


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.4.2-16
changelog:
  - document that parent of a new user's home directory must exist
  - avoid skipping 2nd consecutive failures in pwconv grpconv (#787742)
  - avoid segfault when merging group entries in useradd
  - properly report that userdel found process with user's uid
  - improve date parsing and error detecting in chage
  - avoid full group database scanning in newgrp in most common case
  - mention that PAM is not configured with login.defs in the man page
  - create new shadow entry if missing in usermod (#1016516)
  - report error if usermod asked for moving homedir and it does not
    exist (#1089666)
  - fix various typos and mistakes in useradd manpage (#907837)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.4.2-19.1
changelog:
  - allow removal of expiration or last password change dates
    by using -1 as chage date argument again (#1183638)


author: Adam Tkac <atkac redhat com> - 2.0-0.1.20120925git072225
changelog:
  - rebase to the latest 2.0 snapshot
  - patches merged
    - 0001-Fix-ticket-55-BIND-cannot-be-shutdown-correctly-if-p.patch
    - 0001-Fix-crash-on-reload-without-any-zones.patch
    - 0001-Fix-SOA-record-update.patch
    - 0001-Find-A-AAAA-delegation-glue-records-correctly.patch
    - bind-dyndb-ldap11-CVE-2012-2134.patch
    - 0001-Add-proper-DN-escaping-before-LDAP-library-calls.patch
    - bind-dyndb-ldap-CVE-2012-3429.patch


author: Petr Spacek <pspacek redhat com> - 2.3-4
changelog:
  - update-policy with match type 'zonesub' lead to crash (#921167)
  - zones without idnsUpdatePolicy attribute produced error messages (#908780)


author: Tim Waugh <twaugh@redhat.com> 2.6-1
changelog:
  - 2.6.  No longer need stderr, suffix, stripcr, parse, allow-spaces,
    ifdef, program_name, or posix-backup patches.


author: Tim Waugh <twaugh@redhat.com> 2.6-2
changelog:
  - Applied upstream patch to prevent incorrect filename being chosen
    when adding a new file (bug #550319).


