# changelog

author: Miloslav Trmač <mitr@redhat.com> - 4.15-2.el5.1
changelog:
  - Fix "protocol = smtp"
    Resolves: #284801
  - Use a clearer error message if an unknown port is specified
    Resolves: #450344


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.1
changelog:
  - Drop java-1.6.0-openjdk-pstack.patch. 6310967, the upstream version, is applied in OpenJDK 6.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.2
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.38-1.13.10.0
changelog:
  - Add patch to replace -fno-strict-overflow with -fwrapv on older RHEL 5.11 GCC.
  - Resolves: rhbz#1295772


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.39-1.13.11.0
changelog:
  - Explictly required libXcomposite-devel for PR2868 as nothing else pulls it in
  - Resolves: rhbz#1325429


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Bump to 2.6.4 and u95b00.
  - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
  - Drop 8072932or8074489 patch as applied upstream in u91b01.
  - Resolves: rhbz#1295764


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Replace addition of -fno-strict-overflow to IndicRearrangementProcessor{,2}.cpp with -fwrapv
  - Resolves: rhbz#1295764


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Remove unneeded build dependencies on jakarta-commons-logging and prelink/execstack
  - Resolves: rhbz#1295764


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Resolves: rhbz#1320655


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Explictly required libXcomposite-devel for PR2867 as nothing else pulls it in
  - Resolves: rhbz#1320655


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-400.el5]
changelog:
  - [net] bridge: disable snooping if there is no querier (Frantisek Hrbata) [902454]
  - [s390] kernel: sysinfo: convert /proc/sysinfo to seqfile (Alexander Gordeev) [1131283]
  - [net] netlink: verify permisions of socket creator (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: store effective caps at socket() time (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Rename netlink_capable netlink_allowed (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Fix permission check in netlink_connect() (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix possible spoofing from non-root processes (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Make NETLINK_USERSOCK work again (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix for too early rmmod (Jiri Benc) [1094266] {CVE-2014-0181}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-402.el5]
changelog:
  - [block] virtio: Reset device after blk_cleanup_queue() (Stefan Hajnoczi) [1006536]
  - [block] virtio: Call del_gendisk() before disable guest kick (Stefan Hajnoczi) [1006536]
  - [block] virtio: Drop unused request tracking list (Stefan Hajnoczi) [1006536]
  - [fs] cifs: setfacl removes part of ACL when setting POSIX ACLs (Sachin Prabhu) [1105625]
  - [fs] splice: perform generic write checks (Eric Sandeen) [1155908] {CVE-2014-7822}
  - [fs] ext4: verify block bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: fix type declaration of ext4_validate_block_bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: error out if verifying the block bitmap fails (Lukas Czerner) [1034403]
  - [x86] traps: stop using IST for #SS (Petr Matousek) [1172809] {CVE-2014-9322}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-403.el5]
changelog:
  - [s390] zcrypt: Toleration of new crypto hardware (Hendrik Brueckner) [1182522]
  - [fs] cifs: Use pid from cifsFileInfo in wrt pages/set_file_size (Sachin Prabhu) [1169304]
  - [xen] x86: confine internally handled MMIO to solitary regions (Denys Vlasenko) [1164256] {CVE-2014-8867}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-404.el5]
changelog:
  - [infiniband] core: Prevent integer overflow in ib_umem_get (Doug Ledford) [1179353] {CVE-2014-8159}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-405.el5]
changelog:
  - [net] tcp: zero retrans_stamp if all retrans were acked (Marcelo Leitner) [1205521]
  - [net] tcp: fix retrans_stamp advancing in error cases (Marcelo Leitner) [1205521]
  - [net] tcp: Fix inconsistency source (Marcelo Leitner) [1205521]
  - [ipc] sem: fix the potential use-after-free in freeary() (Oleg Nesterov) [1124574]
  - [scsi] lpfc: Fix crash in device reset handler (Rob Evers) [1070964]
  - [mm] fix broken max_reclaims_in_progress memory reclaim throttle (Lachlan McIlroy) [1164105]
  - [x86_64] fpu: save_i387() must clr TS_USEDFPU along with stts() (Oleg Nesterov) [1193505]
  - [block] virtio: Call revalidate_disk() upon online disk resize (Stefan Hajnoczi) [1200855]
  - [block] virtio: fix config handler race (Stefan Hajnoczi) [1200855]
  - [block] virtio: allow re-reading config space at runtime (Stefan Hajnoczi) [1200855]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-406.el5]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Mateusz Guzik) [1203787] {CVE-2015-1805}


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-119
changelog:
  - Add support for newer L3 caches on x86-64 and correctly count
    the number of hardware threads sharing a cacheline (#1003420).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-121
changelog:
  - Fix return code when starting an already started nscd daemon (#979413).
  - Fix getnameinfo for many PTR record queries (#1020486).
  - Return EINVAL error for negative sizees to getgroups (#995207).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-123
changelog:
  - Remove gconv transliteration loadable modules support (CVE-2014-5119,
    - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,


author: Remi Collet <rcollet@redhat.com> - 5.3.3-17
changelog:
  - reorder security patches
  - add security fixes for CVE-2012-2688, CVE-2012-0831,
    CVE-2011-1398, CVE-2013-1643


author: Remi Collet <rcollet@redhat.com> - 5.3.3-23
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-25
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.23-5
changelog:
  - resolves: #1112151 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1112151 - CVE-2014-3493: DoS in smbd with unicode path names.


author: Guenther Deschner <gdeschner@redhat.com> - 3.6.23-10
changelog:
  - resolves: #1322685 - Fix CVE-2015-5370
  - resolves: #1322685 - Fix CVE-2016-2110
  - resolves: #1322685 - Fix CVE-2016-2111
  - resolves: #1322685 - Fix CVE-2016-2112
  - resolves: #1322685 - Fix CVE-2016-2115
  - resolves: #1322685 - Fix CVE-2016-2118 (Known as Badlock)


author: Adam Tkac <atkac redhat com> 30:9.3.6-20.P1
changelog:
  - zone->curmaster before return in dns_zone_setmasterswithkeys()
  - named could fail to send a uncompressable zone


author: Tomas Heinrich <theinric@redhat.com> 5.8.12-1
changelog:
  - rebase from rsyslog-3.22.1-7 to rsyslog-5.8.12
    fixing: #769599, #820396, #823778, #831539
  - add several directories for storing auxiliary data
  - drop unneeded patches


author: Peter Vrabec <pvrabec@redhat.com> 5.8.12-2
changelog:
  - prepare package for dual component situation in RHEL5
  - rename to rsyslog5
  - conflicts with rsyslog
    Resolves: #820396


author: Tomas Heinrich <theinric@redhat.com> 5.8.12-6.el5_11
changelog:
  - add patch 5 to prevent crashes when using multiple rulesets
    Resolves: rhbz#1194440
  - refresh Source0 URL


author: Tomas Heinrich <theinric@redhat.com> 5.8.12-7.el5_11
changelog:
  - adjust the init script to allow modification of the service
    shutdown timeout via /etc/sysconfig/rsyslog
    resolves: rhbz#1194440


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-5.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - renmoved upstreamed patch9, 1051245.patch
  - Resolves: rhbz#1085008


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - Resolves: rhbz#1115866


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148898


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Also includes PR2180, so patch dropped from RPM.
  - Resolves: rhbz#1180289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235149


author: Michal Novotny <minovotn@redhat.com> - kvm-83-264.el5
changelog:
  - kvm-kernel-KVM-Fix-for-buffer-overflow-in-handling-of-MSR_KVM_S.patch [bz#917019]
  - kvm-kernel-KVM-Convert-MSR_KVM_SYSTEM_TIME-to-use-kvm_write_gue.patch [bz#917023]
  - kvm-kernel-KVM-Fix-bounds-checking-in-ioapic-indirect-register-.patch [bz#917029]
  - kvm-kernel-do-not-GP-on-unaligned-MSR_KVM_SYSTEM_TIME-write.patch [bz#bz917019]
  - Resolves: bz#917019
    (CVE-2013-1796 kernel: kvm: buffer overflow in handling of MSR_KVM_SYSTEM_TIME [rhel-5.10])
  - Resolves: bz#917023
    (CVE-2013-1797 kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME [rhel-5.10])
  - Resolves: bz#917029
    (CVE-2013-1798 kernel: kvm: out-of-bounds access in ioapic indirect register reads [rhel-5.10])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-265.el5
changelog:
  - kvm-kernel-kvm-accept-unaligned-MSR_KVM_SYSTEM_TIME-writes.patch [bz#924597]
  - Resolves: bz#924597
    (RHEL.5.8.32 guest hang when installing)


author: Michal Novotny <minovotn@redhat.com> - kvm-83-266.el5
changelog:
  - Updated kversion to 2.6.18-348.4.1.el5
  - kvm-fix-l1_map-buffer-overflow.patch [bz#956511]
  - Resolves: bz#956511
    (qemu-kvm segfault in tb_invalidate_phys_page_range())


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83-267.el5
changelog:
  - KVM: x86: prevent cross page vapic_addr access (CVE-2013-6368) [bz#1032220]
  - Resolves: bz#1032220
    (CVE-2013-6368 kvm: cross page vapic_addr access [rhel-5.11])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83-268.el5
changelog:
  - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) [bz#1032217]
  - Resolves: bz#1032217
   (CVE-2013-6367 kvm: division by zero in apic_get_tmcct() [rhel-5.11])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83-269.el5
changelog:
  - KVM: x86: Improve thread safety in pit
  - Resolves: bz#1152985
   (CVE-2014-3611 kernel: kvm: PIT timer race condition)


author: Jeff E. Nelson <jen@redhat.com> - kvm-83-270.el5
changelog:
  - KVM: x86: Check non canonical addresses upon WRMSR
  - Resolves: bz#1152982
   (CVE-2014-3610 kernel: kvm: noncanonical MSR writes [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83.272.el5
changelog:
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219266]
  - Resolves: bz#1219266
    (kvm: qemu: floppy disk controller flaw [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83.273.el5
changelog:
  - kvm-pcnet-Properly-handle-TX-requests-during-Link-Fail.patch [bz#1225896]
  - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225896]
  - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225896]
  - Resolves: bz#1225896 
    (EMBARGOED CVE-2015-3209 kvm: qemu: pcnet: multi-tmd buffer overflow in the tx path [rhel-5.11.z)


author: Jeff E. Nelson <jen@redhat.com> - kvm-83.274.el5
changelog:
  - net-add-checks-to-validate-ring-buffer-pointers.patch [bz#1263272]
  - Resolves: bz#1263272
    (CVE-2015-5279 kvm: qemu: Heap overflow vulnerability in ne2000_receive() function [rhel-5.11.z])


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-412.el5]
changelog:
  - [s390] kernel: Fix tlb flushing with idte. (Hendrik Brueckner) [1350541]
  - [fs] Do not double unlock the dcache_lock in d_materialise_unique (Miklos Szeredi) [1198315]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-413.el5]
changelog:
  - [redhat] Disable 'Invalid version (double separator '-')' error (Alexander Gordeev) [1375746]
  - [fs] jbd: Fix oops in journal_remove_journal_head() (Lukas Czerner) [1067708]
  - [fs] jbd: Fix race between CP and journal_get_write_access() (Lukas Czerner) [1067708]
  - [fs] ecryptfs: prevent mounts backed by procfs (Mateusz Guzik) [1347100] {CVE-2016-1583}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-415.el5]
changelog:
  - [fs] gfs2: Initialize atime of I_NEW inodes (Andreas Grunbacher) [1374861]
  - [fs] gfs2: Update file times after grabbing glock (Andreas Grunbacher) [1374861]
  - Revert: [fs] gfs2: Only refresh newer in-memory timestamps (Andreas Grunbacher) [1374861]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-417.el5]
changelog:
  - [virt] hv: do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1391167]
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390044] {CVE-2016-7117}


author: Matt Wringe <mwringe@redhat.com> - 0:3.1-7jpp
changelog:
  - Add tomcat5 subpackage
  - Add versioning to provides and obsoletes
  - Move rm -rf %RPM_BUILD_ROOT from %prep to %install
  - Add missing maven dependencies


author: Jason Corley <jason.corley@gmail.com> 0:3.1-9jpp
changelog:
  - update copyright to contain current year
  - rebuild on RHEL4 to avoid broken jar repack script in FC6


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.97
changelog:
  - xserver-1.1.1-x86emu-1.13.patch: Sync x86emu bugfixes with upstream
    xserver. (#858014)
  - xserver-1.1.1-xkb-width-fix.patch: Fix a crash in XKB keymap resize
    across different RHELs. (#822438)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.100
changelog:
  - xserver-1.1.1-more-regen-leaks.patch: Cope with root cursor refcounting
    being differently broken in different DDXes. (#498357)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.104
changelog:
  - xserver-1.1.1-randr-config-timestamps.patch: Backport timestamp comparison
    fix from upstream RANDR code (#1006076)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.107
changelog:
  - CVE-2014-8091 denial of service due to unchecked malloc in client
    authentication (#1168680)
  - CVE-2014-8092 integer overflow in X11 core protocol requests when
    calculating memory needs for requests (#1168684)
  - CVE-2014-8097 out of bounds access due to not validating length or offset
    values in DBE extension (#1168705)
  - CVE-2014-8095 out of bounds access due to not validating length or offset
    values in XInput extension (#1168694)
  - CVE-2014-8096 out of bounds access due to not validating length or offset
    values in XC-MISC extension(#1168700)
  - CVE-2014-8099 out of bounds access due to not validating length or offset
    values in XVideo extension (#1168710)
  - CVE-2014-8100 out of bounds access due to not validating length or offset
    values in Render extension (#1168711)
  - CVE-2014-8102 out of bounds access due to not validating length or offset
    values in XFixes extension (#1168714)
  - CVE-2014-8101 out of bounds access due to not validating length or offset
    values in RandR extension (#1168713)
  - CVE-2014-8093 xorg-x11-server: integer overflow in GLX extension requests
    when calculating memory needs for requests (#1168688)
  - CVE-2014-8098 xorg-x11-server: out of bounds access due to not validating
    length or offset values in GLX extension (#1168707)


author: Milan Broz <mbroz@redhat.com> - 1.02.55-2
changelog:
  - Allocate buffer for reporting functions dynamically to support long outputs.
  - Fix regex optimiser not to ignore RHS of OR nodes in _find_leftmost_common.
    Resolves: #649710 #651349


author: Milan Broz <mbroz@redhat.com> - 1.02.67-1
changelog:
  - Update to latest upstream release, see WHATS_NEW_DM for detailed changelog.
    Resolves: #746300 #454618


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-407.el5]
changelog:
  - [utrace] check ->utrace != NULL in utrace_unsafe_exec() (Oleg Nesterov) [1226967]
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1238991]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-408.el5]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] ipv6/udp: Use correct var to determine non-blocking cond (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] SNMP: Restore Udp6InErrors incrementation (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-409.el5]
changelog:
  - [fs] ext4: limit group search loop for non-extent files (Lukas Czerner) [1301100]
  - [fb] vm: convert fb_mmap to vm_iomap_memory() helper (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [s390] add dummy io_remap_pfn_range() to asm-s390/pgtable.h (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [mm] vm: add vm_iomap_memory() helper function (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [sched] prevent division by zero x->cpu_power (Denys Vlasenko) [1209728]
  - [xen] x86: fully ignore segment override for register-only ops (Mateusz Guzik) [1200373] {CVE-2015-2151}


author: Miroslav Rezanina <mrezanin@redhat.com> - kvm-83.275.el5
changelog:
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1334173]
  - Resolves: bz#1334173
    CVE-2016-3710 kvm: qemu: incorrect banked access bounds checking in vga module [rhel-5.11.z]


author: Miroslav Rezanina <mrezanin@redhat.com> - 83-275.el5_11
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359723]
  - Resolves: bz#1359723
    CVE-2016-5403 kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-5.11.z]


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-30
changelog:
  - fix CVE-2014-0221 - recursion in DTLS code leading to DoS
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-33
changelog:
  - fix CVE-2014-8275 (without introduction of CVE-2015-0286) - various
    certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Kai Engert <kaie@redhat.com> 0.9.8e-34
changelog:
  - Rebase ca-bundle.crt to the upstream version 2.4 with legacy
    modifications. For compatibility reasons, several CA certificates with
    RSA sizes of 1024 bits are still included.
  - Add a patch to the source RPM that documents the changes from the
    upstream version.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-35
changelog:
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.0
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1325424


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.0
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (S8161262 (8147466_wrapv) and PR2939 (fontpath)) applied upstream.
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350038


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.1
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Remove unneeded AArch64 environment variable setting.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.0
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate RH1022017 against 2.6.9.
  - Resolves: rhbz#1410612


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-16
changelog:
  - fixed snmpd showing wrong UCD-SNMP-MIB::ssCpuIdle after 30 days of uptime
    on 32-bit platforms (#663789)
  - fixed parsing of OID argument of 'smuxpeer' configuration option (#751235)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-18
changelog:
  - added support of ocfs2, tmpfs and reiserfs in hrStorageTable
    (#754652, #755958, #822061)
  - updated documentation of '-c' option of snmptrapd (#760001)
  - fixed endless loop after truncating 64bit int (#783892)
  - fixed snmpd exiting shortly after startup due to incoming signal (#799699)
  - fixed decoding of COUNTER64 values from AgentX (#803585)
  - fixed engineID of outgoing traps if 'trapsess -e <engineID>' is used in
    snmpd.conf (#805689)
  - fixed CVE-2012-2141, an array index error in the extension table (#815813)
  - fixed snmpd showing "failed to run mteTrigger query" when 'monitor'
    config option is used (#830042)
  - added support for port numbers in 'clientaddr' configuration option
    (#828691)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-19
changelog:
  - fixed support for port numbers in 'clientaddr' configuration option
    (#840861, #845974)
  - added support of cvfs filesystem hrStorageTable (#846391)
  - removed various error log messages when IPv6 is disabled (#845155)
  - removed various error log messages related to counte64 expansions
    (#846905)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20
changelog:
  - fixed error message when the address specified by clientaddr option
    is wrong or cannot be bound (#840861)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20.1
changelog:
  - Fixed CVE-2012-6151: snmpd crashing when AgentX subagent disconnects in
    the middle of request processing (#1073224)
  - Fixed CVE-2014-2285: snmptrapd crash when using a trap with empty community
    string (#1073224)


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d 
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: - Andreas Schneider <asn@redhat.com> - 3.6.23-3
changelog:
  - resolves: #1100658 - Allocate the server_info on the correct context.
  - resolves: #1101922 - Add config variables to set spoolss os version.


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-1
changelog:
  - upgrade to 1.0.15
  - http://www.wireshark.org/docs/relnotes/wireshark-1.0.15.html
  - fixes CVE-2010-2287 CVE-2010-2284
  - Related: #612239


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-1.4
changelog:
  - fix few security issues
  - Resolves: CVE -2011-0024 CVE-2011-0538 CVE-2011-1139 CVE-2011-1140
    CVE-2011-1141 CVE-2011-1143 #612240


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-2
changelog:
  - fixed tshark -s option (#580513)
  - fixed tshark exit code when dumpcap fails (#580510)
  - fixed editing of columns in Wireshark preferences (#493693)
  - added netdump protocol dissector (#484999)
  - fixed tshark / Wireshark automatic filter when started in ssh connection
    over IPv6 (#438473)


author: Jan Safranek <jsafrane@redhat.com> 1.0.15-3
changelog:
  - fixed various flaws: CVE-2011-1959 CVE-2011-2175 CVE-2011-1958 
    CVE-2011-2698 CVE-2011-4102 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066
    CVE-2012-0067


author: Peter Hatina <phatina@redhat.com> 1.0.15-6
changelog:
  - security patches
  - Resolves: CVE-2012-6056
              CVE-2012-6060
              CVE-2012-6061
              CVE-2012-6062
              CVE-2013-3557
              CVE-2013-3559
              CVE-2013-4081
              CVE-2013-4083
              CVE-2013-4927
              CVE-2013-4931
              CVE-2013-4932
              CVE-2013-4933
              CVE-2013-4934
              CVE-2013-4935
              CVE-2013-5721
              CVE-2013-7112
              CVE-2014-2281
              CVE-2014-2299


author: Peter Hatina <phatina@redhat.com> 1.0.15-7
changelog:
  - security patches
  - Resolves: CVE-2014-6421
              CVE-2014-6423
              CVE-2014-6425
              CVE-2014-6428
              CVE-2014-6429


author: David Cantrell <dcantrell@redhat.com> - 1.0.10-14
changelog:
  - Add directive for dhcp6s.conf that lets users enable the 'only
    send option 23 for ADVERTISE messages' setting
    Related: rhbz#426899


author: David Cantrell <dcantrell@redhat.com> - 1.0.10-15
changelog:
  - Allow users to configure dhcp6s to return only option 24 for
    ADVERTISE and REPLY messages
    Related: rhbz#426899


author: David Cantrell <dcantrell@redhat.com> - 1.0.10-16
changelog:
  - Remove the ADVERTISE/REPLY patch for option 24 as it is unnecessary,
    the problem was in our test driver scripts for the TAHI suite
    Resolves: rhbz#426899


author: Jiri Popelka <jpopelka@redhat.com> - 1.0.10-18
changelog:
  - Get new address when moving into a new link (bug #466251).
  - Windows 2008 interoperability fix in dhcp6c (bug #476974).
  - Check DAD necessity by the interface type to prevent dhcp6c
    from segfaulting when run for second time (bug #515644).


author: Jiri Popelka <jpopelka@redhat.com> - 1.0.10-19
changelog:
  - Server correctly parses Relay-Forward message (bug #512399).
  - Client correctly handles NotOnLink error in REPLY (bug #511323).
  - Server doesn't send NotOnlink error in REPLY
    when more range statements configured (bug #598439).


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-28
changelog:
  - Proper region tag validation on package/header read (CVE-2012-0060)
  - Double-check region size against header size (CVE-2012-0061)
  - Validate negated offsets too in headerVerifyInfo() (CVE-2012-0815)


author: Florian Festi <ffesti@redhat.com> - 4.4.2.3-29
changelog:
  - Add DWARF 3 and 4 support to debugedit (#808547)
  - No longer add \n to group tag in Python bindings (#783451)
  - Fix typos in Japanese rpm man page (#760552)
  - Bump Geode compatibility up to i686 (#620570)


author: Florian Festi <ffesti@redhat.com> - 4.4.2.3-30
changelog:
  - Document -D and -E options in man page (#814602)
  - Require matching arch for freshen on colored transactions (#813282)


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-33
changelog:
  - Account for excludes and hardlinks wrt payload max size (#716853)
  - Fix payload size tag generation on big-endian systems (#648516)


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-34
changelog:
  - Fix segfault on rpmdb addition when header unload fails (#706935)
  - Fix segfault on invalid OpenPGP packet (#743203)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-35
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163057)


author: - Andreas Schneider <asn@redhat.com> - 3.6.22-2
changelog:
  - related: #976637 - More cleanup for 'force user' with 'security = ads'.
  - resolves: #1069571 - Fix memory leak reading printer list.
  - resolves: #1067608 - Fix wbinfo -i with one-way trusts.


author: Petr Mensik <pemensik@redhat.com> - 30:9.3.6-25.P1.12
changelog:
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.7-5
changelog:
  - change permissions of deliver and dovecot.conf to prevent possible password exposure
  - Resolves: #436287


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.7-7
changelog:
  - permissions of deliver and dovecot.conf from 1.0.7-5 reverted
  - password can be stored in different file readable only for root now
  - Resolves: #436287, CVE-2008-4870


author: Simo Sorce <ssorce@redhat.com> 3.0.33-3.33.el5
changelog:
  - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694,
    CVE-2011-2522, CVE-2011-1678, CVE-2011-2724
  - resolves: #722553


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.0
changelog:
  - Update to IcedTea 1.13.12 & OpenJDK 6 b40.
  - Depend on mailcap for /etc/mime.types (PR2800)
  - Use configure macro and disable long-running JTreg & SystemTap tests from make check
  - Remove redundant patch-ecj target invocation for bootstrap build.
  - Add check section to run the new tests introduced in 1.13.12.
  - Add RHEL version of b40 tarball.
  - Require mailcap at build time as well, so configure finds /etc/mime.types
  - No need to require openssl at run time.
  - Drop old_gcc patch as this is now supported upstream (S8161262)
  - Resolves: rhbz#1350043


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.1
changelog:
  - Separate bootstrap option as it should not be tied to the JDK used.
  - Enable bootstrapping on JIT architectures going forward.
  - Temporarily enable bootstrapping on all architectures to work around RH1334465/PR2956.
  - Resolves: rhbz#1350043


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.1
changelog:
  - Introduce bootstrapping variable to test whether we are bootstrapping or not.
  - Add build requirement of xsltproc when bootstrapping.
  - Resolves: rhbz#1350043


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Retagging to fix an inconsitency in the release tags
  - Resolves: rhbz#1002641 - Rebase RHEL 5 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-1
changelog:
  - Update to nspr-4.10.2
  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Remove an unused patch
  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200921 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269359 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption [rhel-5.11.z]


author: Adam Tkac <atkac redhat com> 30:9.3.6-18.P1
changelog:
  - document `dig` return codes
  - bind-chroot-admin: don't create symlinks with double "//" in the paths
  - nslookup failed to resolve name in certain cases


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d:
    - The Egyptian Cabinet announced that DST will be cancelled for 2015.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style. This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Fix shell syntax error on nss/tests/all.sh
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Enable additional ssl test cycles and document why some aren't enabled
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Copy PayPalICA.cert and PayPalRootCA.cert to nss/tests/libpkix/certs
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Kai Engert <kaie@redhat.com> - 3.18.0-6
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-7
changelog:
  - Pick up upstream patch from nss-3.19.1
  - Resolves: Bug 1236954 - CVE-2015-2730 NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)
  - Resolves: Bug 1236967 - CVE-2015-2721 NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-1
changelog:
  - Rebase nss to 3.19.1
  - Pick up upstream fix for client auth. regression caused by 3.19.1
  - Revert upstream change to minimum key sizes
  - Remove patches that rendered obsolote by the rebase
  - Update existing patches on account of the rebase


author: Deepak Bhole <dbhole@redhat.com> - 1:3.0-6jpp_1fc
changelog:
  - Added conditional native compilation.
  - Disable certain ssl related tests that are known to fail with libgcj.


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss 3.21
  - Resolves: Bug 1297944 - Rebase RHEL 5.11.z to NSS 3.21 in preparation for Firefox 45


author: Dave Anderson <anderson@redhat.com> - 4.1.2-3.el5
changelog:
  - Fix for the "bt" command on an ia64 "INIT" process that interrupted
    a task that was running in user space, but was unable to modify the
    original (interrupted) task's stack.  Without the patch, the "INIT"
    task's backtrace would not display the task that was interrupted,
    and would display the error message "bt: unwind: failed to locate
    return link (ip=<user-virtual-address>)!".  With the patch, the
    interrupted task information is displayed in the same manner as if
    the original stack had been modified.
  - Resolves: rhbz#553353


author: Dave Anderson <anderson@redhat.com> - 4.1.2-4.el5
changelog:
  - Fix for very large xendump core files whose ELF sections are located
    beyond a file offset of 4GB.
  - Resolves: rhbz#561767


author: Dave Anderson <anderson@redhat.com> - 4.1.2-5.el5
changelog:
  - Fix for backtrace of x86 NMI-interrupted task with a user exception frame
    from a syscall exception that had not called the requested system call 
    function.
    Fix for backtrace when a newly-forked x86 task's resumption EIP address 
    value is set to the "ret_from_fork" entry point by copy_thread().
    Resolves: rhbz#572605
  - Fix for segmentation violation with the "mach -m" command option on x86 
    or x86_64 systems whose BIOS-provided e820 map contains EFI-related memory
    type value that has not been mapped to an E820 type.
    Resolves: rhbz#569164
  - Fix for the "kmem -s list" command option to prevent it from attempting
    to gather a slab cache name string from the "cache_chain" list_head.
    Resolves: rhbz#580589
  - Change the ppc64 cpu count displayed by the initial system banner
    and by the "sys" and "mach" commands to be the number of cpus online.
    Resolves: rhbz#580599
  - Fix for backtrace of an x86_64 NMI-interrupted task which had not 
    swapped its RSP from the user-space stack to the kernel stack.
    Resolves: rhbz#593066


author: Dave Anderson <anderson@redhat.com> - 4.1.2-6.el5
changelog:
  - Support for "__rhel5" marker device in KVM dumpfile header.
    Resolves: rhbz#603027
  - Fix for the x86 "bt" command to generically recognize the end of trace
    condition for user-space tasks without having to hardwire any more 
    kernel entry point function names.
    Resolves: rhbz#608714
  - Fix for the x86_64 "bt" command if the kdump-generated NMI interrupts
    a multi-threaded task that has just entered kernel space but has not
    changed the RSP stack pointer register from its user-space per-thread
    stack location to the kernel stack.
    Resolves: rhbz#608171


author: Dave Anderson <anderson@redhat.com> - 4.1.2-7.el5
changelog:
  - Fix for the x86 "bt" command for potential backtrace error of a
    NMI-interrupted idle task.
    Resolves: rhbz#653288
  - Fix for the x86 "bt" command to fix Xen hypervisor backtrace errors 
    generated when a NMI-interrupted VCPU is running within the hypercall
    entry point, and when a NMI-interrupted VCPU is running within an
    interrupt handler entry point.
    Resolves: rhbz#653823


author: Dave Anderson <anderson@redhat.com> - 4.1.2-8.el5
changelog:
  - Fix for potential segmentation violation in glibc malloc/free when 
    running "kmem -s" on a large, active, live system.
    Resolves: rhbz#659593


author: Dave Anderson <anderson@redhat.com> - 5.1.8-1.el5
changelog:
  - Rebase to upstream version 5.1.8.
    Resolves: rhbz#715072

  - Fix for the x86_64 "bt" command if the shutdown NMI is issued to a
    32-bit task that has executed a "sysenter" instruction and the RSP
    still contains the zero value loaded from the MSR_IA32_SYSENTER_ESP
    register.  The backtrace issued a warning message indicating 
    "WARNING: possibly bogus exception frame", and was unable to make a 
    transition from the NMI exception stack back to the process stack. 
    Resolves: rhbz#676408

  - Fix for the x86 "bt" command for several backtraces of non-crashing
    active tasks that fail with "bt: cannot resolve stack trace" errors
    due to the failure to properly transition from the shutdown NMI stack 
    back to the process stack.
    Resolves: rhbz#713050

  - Fix to more correctly determine the KVM I/O hole size and location.
    The I/O hole size to this point in time is either 1GB or 512MB, but
    its setting is hardwired into the Qemu code that was used to create 
    the dumpfile.  The dumpfile is a "savevm" file that is designed to be
    used for guest migration, and since inter-version save/load is not 
    supported, the I/O hole information does not have to be encoded into the
    dumpfile.  Without the patch, the I/O hole for dumpfiles created by 
    older Qemu version was not being set to 1GB, so if the KVM guest was 
    configured with more than 3GB of memory, the crash session would 
    typically display numerous "read error" messages during session 
    initialization.
    Resolves: rhbz#715070

  - Fix for KVM dumpfiles from guests that were provisioned with more
    than 3.5GB of RAM.  KVM virtual systems contain an I/O hole in the
    physical memory region from 0xe0000000 to 0x100000000 (3.5GB to 4GB).
    If a guest is provisioned with more than 3.5GB of RAM, then the
    memory above 3.5GB is "pushed up" to start at 0x100000000 (4GB).
    But the "ram" device headers in the KVM dumpfiles do not reflect
    that, and so without the patch, numerous error messages would be
    displayed during invocation, and in all probability, the session
    would fail.
    Resolves: rhbz#716327


author: Dave Anderson <anderson@redhat.com> - 5.1.8-2.el5
changelog:
  - Fix to handle xen dom0 dumpfiles created with "makedumpfile -d1" on very
    large systems, where the ELF vmcore may be mistakenly determined to be
    an old-style netdump vmcore.  
    Resolves: rhbz#876046


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-72.el5
changelog:
  - add part-backported fix to avoid possible use-after-free when encrypting
    delegated creds (Jatin Nansi, #1004632)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-73.el5
changelog:
  - incorporate backported upstream patch for remote crash of KDCs which serve
    multiple realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800,


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-74.el5
changelog:
  - add patch based on one from Filip Krska to not call poll() with a negative
    timeout when the caller's intent is for us to just stop calling it (#1089732)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-75.el5
changelog:
  - pull in backported fix for denial of service by injection of malformed
    GSSAPI tokens (CVE-2014-4341, #1121509)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-78.el5
changelog:
  - gssapi: pull in upstream fix for a possible NULL dereference in spnego
    (CVE-2014-4344, #1121509)


author: Thomas Woerner <twoerner@redhat.com> 8.13.7-3
changelog:
  - using new syntax for access database (#177566)
  - fixed failure message while shutting down sm-client (#119429)
    resolution: stop sm-client before sendmail
  - fixed method to specify persistent queue runners (#126760)
  - removed patch backup files from sendmail-cf tree (#152955)
  - fixed missing dnl on SMART_HOST define (#166680)
  - fixed wrong location of aliases and aliases.db file in aliases man page
    (#166744)
  - enabled CipherList config option for sendmail (#172352)
  - added user chowns for /etc/mail/authinfo.db and move check for cf files
    (#184341)
  - fixed Makefile of vacation (#191396)
    vacation is not included in this sendmail package
  - /var/log/mail now belongs to sendmail (#192850)


author: Miroslav Lichvar <mlichvar@redhat.com> 8.13.8-6.el5
changelog:
  - fix verification of SSL certificate with NUL in name (#553618, CVE-2009-4565)
  - do not accept localhost.localdomain as valid address from smtp (#449391)
  - skip colon separator when parsing service name in ServiceSwitchFile (#512871)
  - exit with non-zero error code when free space is low (#299951)
  - fix -qG description in man page (#250552)
  - fix comments in sendmail.mc to use correct certs path (#244012)
  - add MTA to provides (#494408)
  - fix %dist macro use (#440616)
  - compile with -fno-strict-aliasing
  - skip t-sem test as it doesn't allow parallel testing


author: Jan Vcelak <jvcelak@redhat.com> 2.3.43-20
changelog:
  - fix: OpenLDAP packages lack debug data (#684630)
  - doc: Document preferred use of TLS_CACERT instead of TLS_CACERTDIR to specify Certificate Authorities (#699652)
  - fix: libldap ignores a directory of CA certificates if any of them can't be read (#609722)
  - fix: Migration: migrate_all_offline.sh can't handle duplicate entries (#563148)
  - fix: Init script is working wrong if database recovery is needed (#604092)


author: Jan Vcelak <jvcelak@redhat.com> 2.3.43-23
changelog:
  - new feature update: honor priority/weight with ldap_domain2hostlist (#733435)
  - fix: initscript marked as %config incorrectly (#738768)


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.3-86
changelog:
  - mod_proxy: ignore EINTR when polling in proxy_connect (#976465)
  - mod_ssl: do not cache CRL lookups (#1058426)
  - mod_ldap: fix crash in uldap_cache_getattrvals (#1047319)
  - mod_authnz_ldap: fix setting up environment variables for auth only (#1038276)


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.7-10
changelog:
  - fix bug when unselect command on proxy mode caused segmentation fault (#679253)
  - fix lmtp ignorequota on ia64 (#584088)
  - replace instances of #!/usr/bin/env python with #!/usr/bin/python (#521338)
  - don't require lm_sensors-devel, net-snmp-devel is enough (#437999)
  - fix file descriptor leak when moving mailbox folder with quota set (#253854)
  - document that client ignores mupdate_port option (#504813)


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.7-14
changelog:
  - fix CVE-2011-3481: NULL pointer dereference via crafted 
    References header in email (#738391)
  - fix CVE-2011-3372: nntpd authentication bypass (#740822)


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-0.1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297943 - Rebase RHEL 5.11.z to NSPR 4.11 in preparation for Firefox 45


author: Remi Collet <rcollet@redhat.com> - 5.1.6-45
changelog:
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
  - xmlrpc: fix buffer overflow in date parser #1155607


author: Kai Engert <kaie@redhat.com> - 3.16.1-4
changelog:
  - Adjust softokn patch to be compatible with legacy softokn API.
  - Resolves: Bug 1145430 - CVE-2014-1568


author: <jdennis@redhat.com> - 2.0.2-1
changelog:
  - Resolve bug #428252: Problem with update/remove old version
  	- Add code to validate xml database version, if file is incompatible it is not read,
  	  the next time the database is written it will be in the new version format.
  	  This means the database contents are not preserved across database version upgrades.
  	- Remove postun trigger from spec file used to clear database between incompatible versions
  	  the new database version check during database read will handle this instead
  	- bullet proof exit status in init script and rpm scriptlets
  	- Resolve bug #247302: setroubleshoot's autostart .desktop file fails to start under a KDE session
  	- Resolve bug #376041: Cannot check setroubleshoot service status as non-root
  	- Resolve bug #332281: remove obsolete translation
  	- Resolve bug #344331: No description in gnome-session-properties
  	- Resolve bug #358581: missing libuser-python dependency
  	- Resolve bug #426586: Renaming translation po file from sr@Latn to sr@latin
  	- Resolve bug #427260: German Translation
  	- enhance the sealert man page


author: John Dennis <jdennis@redhat.com> - 2.0.5-2
changelog:
  - Resolve: bug #437857: python error in system shutdown
  	- Resolve: bug #436564: socket.getsockopt() on ppc generates exception


author: John Dennis <jdennis@redhat.com> - 2.0.5-3
changelog:
  - Resolve: bug #436564: socket.getsockopt() on ppc generates exception
  	  Fix typo in original setroubleshoot-get_credentials.patch


author: Soren Sandmann <ssp@redhat.com> 1.2.2-1.0.5.el5
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Benjamin Tissoires <btissoir@redhat.com> 1.2.2-1.0.6
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.4
changelog:
  - Set install directories in configure so that @prefix@ is substituted correctly in tapset
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.40-1.13.12.4
changelog:
  - Require a JDK with RH1334465/PR2956 fixed and turn off bootstrapping for Zero architectures.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Update to IcedTea 1.13.13 & OpenJDK 6 b41.
  - Fix context for rpath patch following PR3213.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.41-1.13.13.0
changelog:
  - Update to new 1.13.13 tarball with PR3275 and PR3276 fixes.
  - Ignore any xz tarballs as RHEL 5.11 does not support them.
  - Resolves: rhbz#1381990


author: Harald Hoyer <harald@redhat.com> 095-14.29
changelog:
  - set time for wait_for_sys to 10 seconds (was 3)
  Resolves: rhbz#769169
  - fixed sas path_id for hot-remove/add
  Resolves: rhbz#812286


author: Harald Hoyer <harald@redhat.com> 095-14.30
changelog:
  - unignore device mapper devices
  Resolves: rhbz#214639
  - fixed grammar in man page
  Resolves: rhbz#481349
  - report syntax errors in rules
  Resolves: rhbz#573785
  - improved network interface renaming
  Resolves: rhbz#520722


author: Honza Horak <hhorak@redhat.com> 5.5.31-10
changelog:
  - Fix service status for unprivileged user
    Resolves: #975117
  - Add README.mysql-devel to document how -devel package should be used
    Resolves: #975119


author: Honza Horak <hhorak@redhat.com> 5.5.32-1
changelog:
  - Update to MySQL 5.5.32, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html
    Resolves: #975113
  - Use man pages from 5.5.30 due to license change
    Resolves: #975785
  - Fix issues found by Coverity
    Resolves: #975904


author: Honza Horak <hhorak@redhat.com> 5.5.32-2
changelog:
  - Fix text in mysql-readme-devel for RHEL-5
    Resolves: #975119
  - Fix misleading error message when uninstalling built-in plugins
    Resolves: #985402
  - Do not use pie linker flags, they don't work in RHEL-5
    Resolves: #985418


author: Honza Horak <hhorak@redhat.com> 5.5.36-1
changelog:
  - Update to MySQL 5.5.36, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-36.html
    Including fixes for CVE-2014-0412, CVE-2014-0437, CVE-2013-5908,
    CVE-2013-5807, CVE-2014-0420, CVE-2014-0393, CVE-2013-5891,
    CVE-2014-0386, CVE-2013-3839, CVE-2014-0401, CVE-2014-0402,
    CVE-2014-0001
    Resolves: #1055876


author: Honza Horak <hhorak@redhat.com> - 5.5.37-1
changelog:
  - Update to MySQL 5.5.37, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html
    Includes fixes for: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432
    CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1089203


author: Matej Muzila <mmuzila@redhat.com> - 5.5.40-1
changelog:
  - Rebase to 5.5.40
    Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464
    CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
    CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564
    Resolves: #1160514


author: Matej Muzila <mmuzila@redhat.com> - 5.5.45-1
changelog:
  - Rebase to 5.5.45
    Includes fixes for: CVE-2014-6568 CVE-2015-0374
    CVE-2015-0381 CVE-2015-0382 CVE-2015-0391 CVE-2015-0411 CVE-2015-0432
    CVE-2015-0501 CVE-2015-2568 CVE-2015-0499 CVE-2015-2571 CVE-2015-0433
    CVE-2015-0441 CVE-2015-0505 CVE-2015-2573 CVE-2015-2582 CVE-2015-2620
    CVE-2015-2643 CVE-2015-2648 CVE-2015-4737 CVE-2015-4752 CVE-2015-4757
    Resolves: #1247020


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Adam Tkac <atkac redhat com> 32:9.7.0-13.P2
changelog:
  - fixed various bind-chroot packaging errors (#829823)
  - generate rndc.key during `service named start` (#829827)
  - nslookup: return non-zero exit code when fail to get answer (#829829)
  - named could fail to send a uncompressable zone


author: Miroslav Rezanina <mrezanin@redhat.com> - 83-277.el5_11
changelog:
  - kvm-Fix-hardware-accelerated-video-to-video-copy-on-Cirr.patch [bz#1421564]
  - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop.patch [bz#1421564]
  - kvm-cirrus-fix-blit-region-check.patch [bz#1421564]
  - kvm-cirrus-don-t-overflow-CirrusVGAState-cirrus_bltbuf.patch [bz#1421564]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1421564]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1421564]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1421564]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1421564]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1421564]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1421564]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1421564]
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1421564]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1421564]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1421564]
  - Resolves: bz#1421564
    (CVE-2017-2615 kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-136.el5
changelog:
  - qemu-dm/e1000: bounds packet size against buffer size (rhbz 786941)
  - Use correct expansion in xen-network-common.sh (rhbz 772639)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-139.el5
changelog:
  - xm: Prevent to offline all vcpus (rhbz 716924)
  - xenconsoled: replace gettimeofday with clock_gettime (rhbz 753796)
  - Coverity fix #02 (rhbz 749776)
  - Coverity fix #12 (rhbz 749776)
  - Coverity fix #29 (rhbz 749776)
  - Coverity fix #30 and #31 (rhbz 749776)
  - Coverity fix #35 (rhbz 749776)
  - Coverity fix #45 (rhbz 749776)
  - Coverity fix #49 & #66 (rhbz 749776)
  - Coverity fix #56 (rhbz 749776)
  - Coverity fix #67 & #68 (rhbz 749776)
  - Coverity fix #69, #70, #71, #72, #80, #81, #82, #83 (rhbz 749776)
  - Coverity fix #73 (rhbz 749776)
  - Coverity fix #87 & #88 (rhbz 749776)
  - Coverity fix #100 (rhbz 749776)
  - Coverity fix #101, #102, #103 & #104 (rhbz 749776)
  - Coverity fix #105, #107 & #108 (rhbz 749776)
  - Coverity fix #116 (rhbz 749776)
  - Coverity fix #119 (rhbz 749776)
  - Coverity fix #120 & #121 (rhbz 749776)
  - Coverity fix #125 (rhbz 749776)
  - Coverity fix #131 (rhbz 749776)
  - Coverity fix #140, #141 & #142 (rhbz 749776)
  - Coverity fix #143, #144 & #145 (rhbz 749776)
  - Coverity fix #156 (rhbz 749776)
  - Coverity fix #162 & 165 (rhbz 749776)
  - Coverity fix #170, #171 & #172 (rhbz 749776)
  - Coverity fix #181 (rhbz 749776)
  - pygrub: Fix handling entry edition for grub2 (rhbz 766483)
  - Add option to pause guest on restore (rhbz 769613)
  - Handle correctly network device names containing capital letters only (rhbz 771617)
  - Do not store invalid disk format (rhbz 803181)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-140.el5
changelog:
  - pygrub: Improve handling of big files (rhbz 821705)
  - customize migration parameters (rhbz 831122)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-142.el5
changelog:
  - Properly close logfile of console daemon on error (rhbz 749776)
  - Fix leaks in block-qcow driver (rhbz 749776)
  - Avoid bogus use of NULL pointer in hvmloader (rhbz 749776)
  - qemu-dm: fix unregister_iomem (rhbz 861349)
  - Backport a single hunk from qemu-xen-unstable commit 13669683 (rhbz 861349)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-143.el5
changelog:
  - libxc: move error checking next to the function which returned the error (rhbz 870413)
  - libxc: builder: limit maximum size of   kernel/ramdisk (rhbz 870413)
  - e1000: discard packets that are too long if !SBP and !LPE (rhbz 910844)
  - e1000: discard oversized packets based on SBP|LPE (rhbz 910844)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-144.el5
changelog:
  - xm: Fix vcpu-pin complain for CPU number out of range (rhbz 955656)
  - libxc: Support set affinity for more than 64 CPUS (rhbz 955656)
  - libxc: Fixes for "support affinity for more than 64 CPUS" (rhbz 955656)
  - xend: Fix bug of a cpu affinity vcpu-pin under ia32pa (rhbz 955656)
  - libxc: Fix cpu number overflow for vcpu-pin (rhbz 955656)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-146.el5
changelog:
  - xen-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch
  - xen-FDC-Fix-buffer-overflow-Herv-Poussineau.patch
  - Resolves: bz#1219333
   (xen: qemu: floppy disk controller flaw [rhel-5.11.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-147.el5
changelog:
  - net: add checks to validate ring buffer pointers 
  - Resolves: bz#1263273
    (xen: qemu: Heap overflow vulnerability in ne2000_receive() function)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-135.el5
changelog:
  - Fix valid cdrom image check (rhbz 737851)
  - pygrub: add more grub2 config file names (rhbz 746602)
  - pygrub: read all MSDOS partitions (rhbz 746602)
  - pygrub: read all GPT partitions (rhbz 746602)
  - pygrub: parse more grub2 config file constructs (rhbz 746602)
  - fix SCSI buffer overflow, disable SCSI CD-ROMs (rhbz 736291)


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST (BZ #1425223)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab to the install files. (BZ #1427696)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.85-2.6.1.3
changelog:
  - Check return value of gio_init in gsettings_init and return false if necessary.
  - Re-enable the use of system GConf.
  - Only ifdef g_type_init&g_free if USE_SYSTEM_GIO and USE_SYSTEM_GCONF are undefined.
  - Resolves: rhbz#1242587


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-419.el5]
changelog:
  - [net] dccp: Use AF-independent rebuild_header routine (Hannes Frederic Sowa) [1424751]
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424633] {CVE-2017-6074}
  - [redhat] kernel.spec.template: disable autoloading for dccp proto (Hannes Frederic Sowa) [1425177]


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.67
changelog:
  - Free libxml2 bindings in cluster plugin
    Resolves: bz773350
  - Suppress libxml2 debug output in cluster plugin
    Resolves: bz782588
  - Update URLs in README and RPM metadata
    Resolves: bz783423
  - Collect mcelog in hardware plugin
    Resolves: bz810701
  - Add brctl show and brctl showstp output to networking
    Resolves: bz833406
  - Fix installed-rpms formatting for long package names
    Resolves: bz978444
  - Make ethernet interface detection more robust
    Resolves: bz980177
  - Do not collect kerberos keytab files
    Resolves: bz1029017


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.68
changelog:
  - Add SSSD plugin to collect configuration and logs
    Resolves: bz1018407
  - Update sos UI text to match later releases
    Resolves: bz1065468


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.70
changelog:
  - Do not verify cluster.conf for each mounted gfs2 file system
    Resolves: bz1098793
  - Fix insecure temporary files usage in gfs2 plugin
    Resolves: bz1099151
  - Suppress libxml2 debug output in gfs2 plugin
    Resolves: bz1098793


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.73
changelog:
  - Strip passwords from grub.conf and /etc/fstab
    Resolves: bz1107751
  - Limit the default set of logs collected for directory server
    Resolves: bz1086736


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-34.el5
changelog:
  - Avoid double free of nested loop variable (RT#70660). Back-ported from
    perl-5.10.1. Reverts code of perl-5.8.8-bug24254.patch as it provides better
    solution. (Resolves: rhbz#625746)


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-35.el5
changelog:
  - Define number of tests in ext/threads/t/libc.t (Related: rhbz#676050)
  - Redirect CGI::Cookie->bake test output to error output not to pollute TAP
    protocol (Related: rhbz#702389)
  - Reenable tests for s390x and ia64 (Related: rhbz#675863)


author: Marcela Mašláňová <mmaslano@redhat.com> - 4:5.8.8-37.el5
changelog:
  - 527275 remove h2ph patch, which didn't work
  - 702389 change rebase of CGI into upstream patch
  - 593752 NDBM_File needs change in Configure to be able find ndbm.h
  - Related: rhbz#702389, rhbz#593752


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-40
changelog:
  - Fix CVE-2012-5195 heap buffer overrun at repeatcpy (Resolves: rhbz#915691)
  - Fix CVE-2012-5526 newline injection due to improper CRLF escaping in
    Set-Cookie and P3P headers (Resolves: rhbz#915691)
  - Fix CVE-2012-6329 possible arbitrary code execution via Locale::Maketext
    (Resolves: rhbz#915691)
  - Fix CVE-2013-1667 DoS in rehashing code (Resolves: rhbz#915691)


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-42
changelog:
  - Fix perl segfaults with custom signal handle (Resolves: rhbz#991854)
  - Reorder AnyDBM_File back-end preference (Resolves: rhbz#1018721)
  - Fix backslash interpolation in Locale::Maketext (Resolves: rhbz#1029016)
  - Enable year 2038 for Time::Local on 64-bit platforms (Resolves: rhbz#1057047)


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-43
changelog:
  - Do not extend allowable epoch values in Time::Local::timelocal to remove
    useless warning on 64-bit platforms (Resolves: rhbz#1149375)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - Remove libxslt and mercurial dependencies pulled in from IcedTea builds.
  - Reduce redhat-lsb dependency to redhat-lsb-core (lsb_release)
  - Resolves: rhbz#1235155


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.80-2.6.0.0
changelog:
  - The RHEL 5 version of libsctp is too old for the OpenJDK SCTP implementation.
  - Resolves: rhbz#1235155


author: James Antill <jantill@redhat.com> - 4.2.6-3
changelog:
  - Fix reused pids bug
  - Resolves: rhbz#465455
  - Fix comments in $() edge case syntax parsing error
  - Resolves: rhbz#484348


author: James Antill <jantill@redhat.com> - 4.2.6-6
changelog:
  - Queue signals before fork.
  - Resolves: rhbz#733582
  - Fix deadlock for terminated suspended jobs.
  - Resolves: rhbz#706029
  - Allow greater than 3 commands to use a completion service.
  - Resolves: rhbz#700722


author: James Antill <jantill@redhat.com> - 4.2.6-7
changelog:
  - Parser error attempts to execute assignment expressions.
  - Resolves: rhbz#758681
  - Subversion completion broken.
  - Resolves: rhbz#788050


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-38
changelog:
  - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
  - disable SSLv2 in the generic TLS method (can be reenabled
    by setting environment variable OPENSSL_ENABLE_SSL2)


author: Christine Caulfield <ccaulfie@redhat.com> - 2.0.116-124
changelog:
  - qdisk: Make qdiskd warn if not all nodes are running qdiskd
    Resolves: rhbz#994187
  - qdisk: Waits tko cycles to complete initialization instead of tko_up
    Resolves: rhbz#1029191


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.0.116-124.3
changelog:
  - fence_cisco_ucs: default to TLSv1.3 as SSLv3 is being deprecated in the
    latest firmware due to security concerns

    Resolves: rhbz#1321592


author: Tomas Smetana <tsmetana@redhat.com> - 3:2.1.9-4
changelog:
  - fix #252185 init script prevents proper SELinux domain transitions
  - fix #242672 wrong init script return value


author: Jan Kaluza <jkaluza@redhat.com> - 3:2.1.9-5
changelog:
  - fix #290661 - use relative symlink in /etc/smrsh
  - fix #461707 - break CC field correctly
  - fix #453377 - don't parse problematic mails many times, but isolate them
  - fix #521888 - fix instances of #!/usr/bin/env python in mailman
  - fix #515157 - fixed traceback when changing email address globally


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-5
changelog:
  - add group audio to sound devices when no console user owns them (#244688)
  - resolve pam access origin entry only when it makes sense (#459057)
  - silence the strict-aliasing warnings (#462647)
  - pam_keyinit: save old uid so we can revert to it (#466411)
  - pam_filter: make it use pty subsystem (#473970)
  - add pam_faildelay module to be able to set the failure delay (#476217)
  - pam_tty_audit: fix double free when open_only option is used (#476833)
  - allow root to change users passwords when helper is needed (#476904)
  - make package's requires more correct (#497570)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-8
changelog:
  - fix insecure dropping of priviledges in pam_xauth
    and pam_mail - CVE-2010-3316 (#637898), CVE-2010-3435 (#641335)
  - fix insecure executing of scripts with user supplied environment
    variables in pam_namespace - CVE-2010-3853 (#643043)


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-9
changelog:
  - distinguish groups and users with the () syntax in pam_access
    if nodefgroup option is specified
  - do not truncate /var/log/faillog and /var/log/tallylog on upgrade
  - remove superfluous plurals in .po files


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-10
changelog:
  - optimize pam_listfile to use pam_modutil_user_in_group_nam_nam() (#551312)
  - export environment variables in pam_exec (#554518)
  - fix user name matching in pam_unix remember feature (#768087)
  - added pam_cracklib options maxclassrepeat and gecos_check
  - pam_pwhistory now always saves the old password even for root


author: Tomas Mraz <tmraz@redhat.com> 0.99.6.2-12
changelog:
  - better keep also the regular environment variables for backwards
    compatibility with old pam_exec scripts


author: Jakub Hrozek <jhrozek@redhat.com> - 253-45
changelog:
  - fix a regression caused by patch #39 - SRV records processing
    would crash if there was no basedn set (#705841)


author: Jakub Hrozek <jhrozek@redhat.com> - 253-46
changelog:
  - Require openldap libs with a fix for #609722 - libldap ignores a directory
    of CA certificates if any of them can't be read (#593242)
  - when closing a context, clean it up so that we won't try to issue an abandon
    when we go to use it again for something else (#696707)


author: Jakub Hrozek <jhrozek@redhat.com> - 253-50
changelog:
  - Free ldap_result when search does not return anything (#835555)
  - Use contents of ldap.secret even if it does not contain a newline (#797410)


author: Jakub Hrozek <jhrozek@redhat.com> - 253-52
changelog:
  - Add a patch by Gino LV. Ledesma to catch leaking sockets
  - Resolves: rhbz#772273 - (slow) socket leak in nss_ldap


author: Jakub Hrozek <jhrozek@redhat.com> - 253-52.1
changelog:
  - Use TLS_X_CALLBACK to terminate idle SSL connections after ldc_timeout
    seconds
  - Resolves: rhbz#1035945: nss_ldap does not reconnect to alternate ldap
                            server when using SSL


author: Jakub Hrozek <jhrozek@redhat.com> - 253-52.2
changelog:
  - Only set the TLS_X_CALLBACK if timeout is > 0
  - Related: rhbz#1035945: nss_ldap does not reconnect to alternate ldap
                            server when using SSL


author: Archit Shah <ashah@redhat.com> 0:1.2.1-2jpp_1fc
changelog:
  - remove unnecessary build dependencies on jacorb and jonathan-rmi
  - include fix to Axis bug 2142
  - merge from upstream 2jpp


author: Permaine Cheung <pcheung@redhat.com> - 0:1.2.1-2jpp.7
changelog:
  - Add missing connection hostname check against X.509 certificate name
  - Resolves: CVE-2012-5784
  - Add patches to build with java 1.6


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.18.el5
changelog:
  - Fix parser local buffers size problems (rhbz#843740)
  - Fix entities local buffers size problems (rhbz#843740)
  - Fix an error in previous commit (rhbz#843740)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.20.el5
changelog:
  - Implement some default limits in the XPath module (CVE-2011-1944)
  - Change the XPath code to percolate allocation errors (CVE-2011-1944)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.22.el5
changelog:
  - fix validation issues with some XSD (rhbz#877348)
  - xmlDOMWrapCloneNode discards namespace of the node parameter (rhbz#884707)


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.24.el5
changelog:
  - fixed one regexp bug and added a (rhbz#922450)
  - Another small change on the algorithm for the elimination of epsilon (rhbz#922450)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-148.el5_11
changelog:
  - xen-qemu-ioport-array-overflow.patch [bz#1401521]
  - Resolves: bz#1401521
    (CVE-2016-9637 xsa199 xen: qemu ioport array overflow (XSA-199) [rhel-5.11.z])


author: Michal Novotny <minovotn@redhat.com> - kvm-83-263.el5
changelog:
  - kvm-e1000-Discard-packets-that-are-too-long-if-SBP-and-L.patch [bz#910840]
  - kvm-e1000-Discard-oversized-packets-based-on-SBP-LPE.patch [bz#910840]
  - Resolves: bz#910840
    (CVE-2012-6075  qemu (e1000 device driver): Buffer overflow when processing large packets when SBP and LPE flags are disabled [rhel-5.10])


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-24
changelog:
  - Try to avoid overwriting text with page labels (STR #3415,
    bug #527187).
  - Reverted patch for bug #572338 as that and related bugs need a
    solution that can guarantee no regressions.


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-25
changelog:
  - Applied patch to fix cupsd memory corruption vulnerability
    (CVE-2010-2941, STR #3648, bug #624438).
  - Fix latent privilege escalation vulnerability (CVE-2010-2431,
    STR #3510, bug #605397).


author: Jiri Popelka <jpopelka@redhat.com> 1:1.3.7-28
changelog:
  - Web interface didn't show completed jobs for printer (STR #3436, bug #625900)
  - Serial backend didn't allow a raw job to be canceled (STR #3649, bug #625955)
  - Fixed condition in textonly filter to create temporary file
    regardless of the number of copies specified. (bug #660518)


author: Jiri Popelka <jpopelka@redhat.com> 1:1.3.7-29
changelog:
  - The imageto* filters could crash with bad GIF files
    (CVE-2011-2896, STR #3867, STR #3914, bug #752118).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-31
changelog:
  - Applied patch to fix CVE-2012-5519 (privilege escalation for users
    in SystemGroup or with equivalent polkit permission).  This prevents
    HTTP PUT requests with paths under /admin/conf/ other than that for
    cupsd.conf, and also prevents such requests altering certain
    configuration directives such as PageLog and FileDevice (bug #875898).


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-32
changelog:
  - New SSLOptions directive to enable SSL3 and/or RC4, which are now
    disabled by default (bug #1161218).


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-35
changelog:
  - add missing 'ed' builddep
  - set LDFLAGS and CPPFLAGS so that our local copy of DB is more likely to be
    found by the configure script


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-35.2
changelog:
  - when setting file contexts for creation of new files, only fail outright
    if we were in enforcing mode and the file needed to be given a specific
    label (#368281)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2-36
changelog:
  - import Kees Cook's patch to fix accidental leakage of part of ./DB_CONFIG
    (#580543, CVE-2010-0826)


author: Benjmain Marzinski <bmarzins@redhat.com> 0.4.7-56.el5
changelog:
  - Added bz827016.patch
  - Added bz860185.patch
  - Added bz910585.patch
  - Added bz916630.patch
  - Added bz839983.patch
  - Resolves: bz #827016, #860185, #910585, #916630, #839983


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.7-61.el5
changelog:
  - Added bz489499.patch
    * update multipathd man page
  - Added bz852011.patch
    * fixed typo in multipath.conf.annotated
  - Added bz1004179.patch
    * updated multipath.conf.defaults
  - Added bz798543.patch
    * changed rpm build flags
  - Added instructions to get upstream tarball
  - Resolves: bz #489499, #560955, #798543, #852011, #1004179


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.7-62.el5
changelog:
  - Added bz1086949.patch
    * make multipathd block sighup until after it finishes starting-up
  - Resolves: bz #1086949


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.7-63.el5
changelog:
  - Added bz1092603.patch
    * don't free memory needed by other threads during shutdown, to avoid
      races ending in use after free corruption.
  - Resolves: bz #1092603


author: Jiri Skala <jskala@redhat.com> 7:2.6.STABLE21-1
changelog:
  - Resolves: #297521 update to the latest upstream STABLE21
  - Resolves: #245304 changed init script to be LSB compliant
  - Resolves: #250572 using refresh_stale_hit don't cause "clock going backwards"
  - Resolves: #436135 ported init script bug fixign of RHEL-4 to RHEL-5
  - Resolves: #442108 added define -D_FORTIFY_SOURCE=2
  - Resolves: #454255 fixed -g parameter handling of unix_group helper
  - Resolves: #448086 changed security context of /usr/local/squid to squid ownership:w
  - Resolves: #451923 solved repeated SIGABRTs


author: Jiri Skala <jskala@redhat.com> 7:2.6.STABLE21-4
changelog:
  - Resolves: #521926 - squid 'stop after stop' is not LSB compliant
  - Resolves: #496170 - Add arp filter option
  - Resolves: #516245 - negotiate support not enabled in squid
  - Resolves: #538738 - Squid accelerator mode works only if port 80 is opened
  - Resolves: #470843 - Squid 'error_map' does not work when used 'Accep-Encoding: gzip'


author: Michal Luscon <mluscon@redhat.com> 7:2.6.STABLE21-7
changelog:
  - Resolves: #1134976 - CVE-2013-4115 buffer overflow when processing overly long DNS names
  - Resolves: #1134976 - CVE-2014-3609 assertion failure in header processing


author: Jason Vas Dias <jvdias@redhat.com> - 3.1.8-81
changelog:
  - rebuild for new gcc, glibc, glibc-kernheaders
  - workaround new refusal of /usr/bin/install to chown


author: Peter Vrabec <pvrabec@redhat.com> 3.22-17
changelog:
  - fix truncation of mailbox when running into a disk quota or a
    full partition. Patch from Solar Designer.


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-11.el5
changelog:
  - fix buffer overflow when parsing Autokey association message 
    (#500784, CVE-2009-1252)
  - fix buffer overflow in ntpq (#500784, CVE-2009-0159)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-13.el5
changelog:
  - don't crash with more than 512 local addresses (#661934)
  - add -I option (#528799)
  - fix -L option to not require argument (#460434)
  - move ntpd and ntpdate to /sbin and start earlier on boot (#470945, #689636)
  - increase memlock limit (#575874)
  - ignore tentative addresses (#489835)
  - print synchronization distance instead of dispersion in ntpstat (#679034)
  - fix typos in ntpq and ntp-keygen man pages (#664524, #664525)
  - clarify ntpd -q description (#591838)
  - don't verify ntp.conf (#481151)
  - replace Prereq tag


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-15.el5
changelog:
  - revert init script priority (#470945, #689636)
  - drop tentative patch (#489835)
  - move restorecon call to %posttrans


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-18.el5
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-2
changelog:
  - New upstream release
  - Use the upstream xattr patch instead of mine.  This closes
    bz#190208 CVE-2006-2083 rsync buffer overflow issue


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-3
changelog:
  - Add my xattrs_bug patch to fix a bug where xattrs don't get sent correctly.
  - Add BuildRequires to make sure libattr-devel and libacl-devel are avaliable
  - replace --with... with --enable... so they actually work
  - Add make, autoconf and gcc to BuildRequires


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 3.0.6-1
changelog:
  - Rebase to upstream version 3.0.6
    Resolves: #339971, #471182, #575022, #616093
  - Make "-d, --dirs options" behaviour backward-compatible with 2.6.8
    Resolves: #339971 (comment #5)
  - Truncate a copied sparse file at the end of transaction (-S, --sparse option)
    Resolves: #530866
  - Add -fno-strict-aliasing to CFLAGS
  - Remove obsolete rsync-2.6.8-xattr_bug.patch
  - Switch license to GPLv3+ (upstream change beginning with 3.0.0)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 3.0.6-2
changelog:
  - Remove BuildRequires dependency on popt-devel, until the package
    is being shipped with RHEL-5 (resolve build issues)


author: Vojtech Vitek <vvitek@redhat.com> - 3.0.6-3
changelog:
  - Add upstream patch to fix CVE-2011-1097 - Incremental file-list
    corruption due to temporary file_extra_cnt increments
    Resolves: #688923


author: Roman Rakus <rrakus@redhat.com> - 3.2-28
changelog:
  - Fix the memory leak in read builtin
    Resolves: #618393
  - Don't append slash to non-directories
    Resolves: #583919


author: Roman Rakus <rrakus@redhat.com> - 3.2-33
changelog:
  - Fixed a bug that caused trap handlers to be executed recursively,
    corrupting internal data structures.
    Resolves: #964753


author: Neil Horman <nhorman@redhat.com> - 0.55-7
changelog:
  - Fixed cpu parsing bugs (bz 311341)
  - Added docs/config for irqbalance env. vars. (bzs 339551 339571 339581)


author: Steve Dickson <steved@redhat.com> 1.0.9-64
changelog:
  - Fixed umounts when MOUNTD_NFS_V2=no (bz 804681)
  - Fixed typo in nfs init script (bz 819373)
  - Fixed rpc.idmapd warning with v4 mounts (bz 708253)
  - Fixed rpc.gssd warning with v4 mounts (bz 769744)
  - Make sure statd's backup dir has correct permissions (bz 782455)


author: Harshula Jayasuriya <harshula@redhat.com> 1.0.9.68
changelog:
  - Need to use /var/lock/subsys/nfs not /var/lock/subsys/nfsd.
    Use "status -l nfs nfsd" for status check. The "-l" option
    was introduced in initscripts >= 8.45.43. (bz 873307)


author: Steve Dickson <steved@redhat.com> 1.0.9-70
changelog:
  - Have showmount try the highest mount version first (bz 947552)
  - Switch the mount version umount tries first (bz 947552)


