# changelog

author: Jay Fenlason <fenlason@redhat.com> 3.2-3.el6
changelog:
  - Build using new mvapich, mvapich2, and openmpi.
    Add support for the -psm variants of the three mpi stacks.
    Related: rhbz725016


author: Jay Fenlason <fenlason@redhat.com> 3.2-5.el6
changelog:
  - Rebuild against newer infinipath-psm, openmpi, mvapich, mvapich2
    This removes the openmpi-psm subpackage, as openmpi now switches between
     psm and non- at runtime.
  - Correct version numbers for IMB and OSU benchmarkes in the description.
  - Update spec file to fix pkgwrangler warnings.
    Resolves: rhbz557803
    Related: rhbz739138


author: Jay Fenlason <fenlason@redhat.com> 3.2-7
changelog:
  - include BuildRequires: hwloc-devel from RHEL-7.0
  - Add win_free patch to close
    Resolves: rhbz734023


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.21.1.el6]
changelog:
  - [kvm] mmu: fix incorrect check of guest cr4 bits (Bandan Das) [1103821 1007164]
  - [drm] nouveau: fix nasty bug which can clobber SOR0's clock setup (Ben Skeggs) [1100574 1095796]
  - [net] tcp: tsq: restore minimal amount of queueing (Jiri Pirko) [1103825 1044053]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.22.1.el6]
changelog:
  - [fs] cifs: Check if prefixpath starts with '\' in cifs_parse_mount_options (Sachin Prabhu) [1107503 1104268]
  - [virt] kvm: enable PCI multiple-segments for pass-through device (Michael S. Tsirkin) [1103972 1103471]
  - [fs] GFS2: Lock i_mutex and use a local gfs2_holder for fallocate (Robert S Peterson) [1102313 1061910]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.23.1.el6]
changelog:
  - [net] ip_tunnel: fix ip_tunnel_find to return NULL in case the tunnel is not there (Jiri Pirko) [1107931 1104503]
  - [netdrv] bnx2x: Fix kernel crash and data miscompare after EEH recovery (Michal Schmidt) [1109269 1029600]
  - [netdrv] bnx2x: Adapter not recovery from EEH error injection (Michal Schmidt) [1109269 1029600]
  - [scsi] qla2xxx: Don't check for firmware hung during the reset context for ISP82XX (Chad Dupuis) [1110658 1054299]
  - [scsi] qla2xxx: Clear loop_id for ports that are marked lost during fabric scanning (Chad Dupuis) [1110658 1054299]
  - [scsi] qla2xxx: Issue abort command for outstanding commands during cleanup when only firmware is alive (Chad Dupuis) [1110658 1054299]
  - [scsi] qla2xxx: Reduce the time we wait for a command to complete during SCSI error handling (Chad Dupuis) [1110658 1054299]
  - [scsi] qla2xxx: Avoid escalating the SCSI error handler if the command is not found in firmware (Chad Dupuis) [1110658 1054299]
  - [scsi] qla2xxx: Set host can_queue value based on available resources (Chad Dupuis) [1110658 1054299]
  - [net] filter: prevent nla extensions to peek beyond the end of the message (Jiri Benc) [1096778 1096779] {CVE-2014-3144 CVE-2014-3145}
  - [net] bridge: add empty br_mdb_init() and br_mdb_uninit() definitions (Vlad Yasevich) [1106472 1097915]
  - [net] bridge: Correctly unregister MDB rtnetlink handlers (Vlad Yasevich) [1106472 1097915]
  - [net] rds: prevent dereference of a NULL device in rds_iw_laddr_check (Radomir Vrbovsky) [1083276 1083277] {CVE-2014-2678}
  - [s390] crypto: fix aes, des ctr mode concurrency finding (Hendrik Brueckner) [1110168 1096328]
  - [s390] crypto: fix des and des3_ede ctr concurrency issue (Hendrik Brueckner) [1109885 1065404]
  - [s390] crypto: fix des and des3_ede cbc concurrency issue (Hendrik Brueckner) [1109883 1065398]
  - [kernel] futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi() (Mateusz Guzik) [1097759 1097760] {CVE-2012-6647}
  - [libata] ahci: accommodate tag ordered controller (David Milburn) [1099725 1083748]
  - [net] mac80211: crash dues to AP powersave TX vs. wakeup race (Jacob Tanenbaum) [1083531 1083532] {CVE-2014-2706}
  - [netdrv] ath9k: tid->sched race in ath_tx_aggr_sleep() (Jacob Tanenbaum) [1083249 1083250] {CVE-2014-2672}
  - [kernel] hrtimer: Prevent all reprogramming if hang detected (Prarit Bhargava) [1096059 1075805]
  - [net] ipv4: current group_info should be put after using (Jiri Benc) [1087412 1087414] {CVE-2014-2851}
  - [kernel] tracing: Reset ring buffer when changing trace_clocks (Marcelo Tosatti) [1093984 1018138]
  - [net] rds: dereference of a NULL device (Jacob Tanenbaum) [1079218 1079219] {CVE-2013-7339}
  - [s390] crypto: fix concurrency issue in aes-ctr mode (Hendrik Brueckner) [1110169 1063478]
  - [net] ipv4: processing ancillary IP_TOS or IP_TTL (Francesco Fusco) [1094403 990694]
  - [net] ipv4: IP_TOS and IP_TTL can be specified as ancillary data (Francesco Fusco) [1094403 990694]
  - [s390] crypto: Fix aes-xts parameter corruption (Hendrik Brueckner) [1110170 1043540]
  - [fs] ext3: pass custom EOF to generic_file_llseek_size() (Eric Sandeen) [1103068 1007459]
  - [fs] ext4: use core vfs llseek code for dir seeks (Eric Sandeen) [1103068 1007459]
  - [fs] vfs: allow custom EOF in generic_file_llseek code (Eric Sandeen) [1103068 1007459]
  - [fs] ext3: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [1103068 1007459]
  - [fs] ext4: replace cut'n'pasted llseek code with generic_file_llseek_size (Eric Sandeen) [1103068 1007459]
  - [fs] vfs: add generic_file_llseek_size (Eric Sandeen) [1103068 1007459]
  - [net] bridge: disable snooping if there is no querier (Vlad Yasevich) [1090749 1090670]
  - [net] Revert "bridge: only expire the mdb entry when query is received" (Vlad Yasevich) [1090749 1090670]
  - [net] Revert "bridge: fix some kernel warning in multicast timer" (Vlad Yasevich) [1090749 1090670]
  - [net] Revert "bridge: do not call setup_timer() multiple times" (Vlad Yasevich) [1090749 1090670]
  - [net] Revert "bridge: update mdb expiration timer upon reports" (Vlad Yasevich) [1090749 1090670]
  - [kernel] futex: Make lookup_pi_state more robust (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
  - [kernel] futex: Always cleanup owner tid in unlock_pi (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
  - [kernel] futex: Validate atomic acquisition in futex_lock_pi_atomic() (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
  - [kernel] futex: prevent requeue pi on same futex (Jerome Marchand) [1104516 1104517] {CVE-2014-3153}
  - [fs] autofs4: fix device ioctl mount lookup (Ian Kent) [1069630 999708]
  - [fs] vfs: introduce kern_path_mountpoint() (Ian Kent) [1069630 999708]
  - [fs] vfs: rename user_path_umountat() to user_path_mountpoint_at() (Ian Kent) [1069630 999708]
  - [fs] vfs: massage umount_lookup_last() a bit to reduce nesting (Ian Kent) [1069630 999708]
  - [fs] vfs: allow umount to handle mountpoints without revalidating them (Ian Kent) [1069630 999708]
  - Revert: [fs] vfs: allow umount to handle mountpoints without revalidating them (Ian Kent) [1069630 999708]
  - Revert: [fs] vfs: massage umount_lookup_last() a bit to reduce nesting (Ian Kent) [1069630 999708]
  - Revert: [fs] vfs: rename user_path_umountat() to user_path_mountpoint_at() (Ian Kent) [1069630 999708]
  - Revert: [fs] vfs: introduce kern_path_mountpoint() (Ian Kent) [1069630 999708]
  - Revert: [fs] autofs4: fix device ioctl mount lookup (Ian Kent) [1069630 999708]
  - [block] floppy: don't write kernel-only members to FDRAWCMD ioctl output (Denys Vlasenko) [1094308 1094310] {CVE-2014-1738 CVE-2014-1737}
  - [block] floppy: ignore kernel-only members in FDRAWCMD ioctl input (Denys Vlasenko) [1094308 1094310] {CVE-2014-1738 CVE-2014-1737}
  - [fs] vfs: fix autofs/afs/etc magic mountpoint breakage (Frantisek Hrbata) [1094370 1079347] {CVE-2014-0203}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.24.1.el6]
changelog:
  - [alsa] aloop: Close races at restarting the stream (Jaroslav Kysela) [1112492 1078592]
  - [alsa] aloop: Export snd_pcm_constraint_mask64() (Jaroslav Kysela) [1112492 1078592]
  - [alsa] pcm: Warn when buffer preallocation fails (Jaroslav Kysela) [1112492 1078592]
  - [alsa] aloop: Add SNDRV_PCM_STATE_PAUSED case in wait_for_avail function (Jaroslav Kysela) [1112492 1078592]
  - [alsa] jack: Unregister input device at disconnection (Jaroslav Kysela) [1112492 1078592]
  - [alsa] aloop: Optimize module name check (Jaroslav Kysela) [1112492 1078592]
  - [alsa] pcm: Add fallthru comments (Jaroslav Kysela) [1112492 1078592]
  - [alsa] aloop: Fix Oops while PM resume (Jaroslav Kysela) [1112492 1078592]
  - [alsa] aloop: add locking to timer access (Jaroslav Kysela) [1112492 1078592]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.25.1.el6]
changelog:
  - [net] sctp: Fix sk_ack_backlog wrap-around problem (Daniel Borkmann) [1113969 1085932] {CVE-2014-4667}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.26.1.el6]
changelog:
  - [net] gro: fix deliver of trunk packets to VLAN interfaces (Marcelo Ricardo Leitner) [1116231 1112324]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.27.1.el6]
changelog:
  - [scsi] fix performance regression due to inverted blk_get_queue return (Mike Snitzer) [1117582 1098658]
  - [net] openvswitch: fix use-after-free bug in netns (Flavio Leitner) [1120651 1100127]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.28.1.el6]
changelog:
  - [kernel] auditsc: audit_krule mask accesses need bounds checking (Denys Vlasenko) [1102704 1102705] {CVE-2014-3917}
  - [net] ipv4: fix route cache rebuilds (Jiri Pirko) [1113824 1111631]
  - [fs] nfsd: notify_change needs elevated write count (Mateusz Guzik) [1110177 1105057]
  - [fs] nfsv4: close needs to handle NFS4ERR_ADMIN_REVOKED (Dave Wysochanski) [1096397 1082127]
  - [fs] pipe: skip file_update_time on frozen fs (Eric Sandeen) [1114405 1093077]
  - [fs] nfs: Fail the truncate() if the lock/open stateid is invalid (Steve Dickson) [1090613 1075123]
  - [fs] nfs: Servers should only check SETATTR stateid open mode on size change (Steve Dickson) [1090613 1075123]
  - [fs] nfs: Fail data server I/O if stateid represents a lost lock (Steve Dickson) [1090613 1075123]
  - [fs] nfs: Fix the return value of nfs4_select_rw_stateid (Steve Dickson) [1090613 1075123]
  - [fs] nfs: Use the open stateid if the delegation has the wrong mode (Steve Dickson) [1090613 1075123]
  - [fs] nfs: nfs4_stateid_is_current should return 'true' for an invalid stateid (Steve Dickson) [1090613 1075123]
  - [fs] nfs: fix error return in nfs4_select_rw_stateid (Steve Dickson) [1090613 1075123]
  - [fs] nfs: Document the recover_lost_locks kernel parameter (Jeff Layton) [1089359 963785]
  - [fs] nfs: Don't try to recover NFSv4 locks when they are lost (Jeff Layton) [1089359 963785]
  - [fs] nfs: Fix handling of partially delegated locks (Jeff Layton) [1120074 959788]
  - [fs] nfs: Convert the nfs4_lock_state->ls_flags to a bit field (Jeff Layton) [1120074 959788]
  - [x86] Optimize switch_mm() for multi-threaded workloads (Rik van Riel) [1115821 991518]
  - [netdrv] pppol2tp: fail when socket option level is not SOL_PPPOL2TP [1119461 1119462] {CVE-2014-4943}
  - [kernel] utrace: force IRET path after utrace_finish_vfork() (Oleg Nesterov) [1115932 1115933] {CVE-2014-4699}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.29.1.el6]
changelog:
  - [mm] hugetlb: ensure hugepage access is denied if hugepages are not supported (Gustavo Duarte) [1118782 1086450]
  - [security] keys: Increase root_maxkeys and root_maxbytes sizes (Steve Dickson) [1115542 1113607]
  - [fs] lockd: Ensure that nlmclnt_block resets block->b_status after a server reboot (Steve Dickson) [1110180 959006]
  - [net] filter: add vlan tag access (Jiri Benc) [1108526 1082097]
  - [net] filter: add XOR operation (Jiri Benc) [1108526 1082097]
  - [net] filter: add SKF_AD_RXHASH and SKF_AD_CPU (Jiri Benc) [1108526 1082097]
  - [net] filter: Socket filter ancilliary data access for skb->dev->type (Jiri Benc) [1108526 1082097]
  - [net] filter: Add SKF_AD_QUEUE instruction (Jiri Benc) [1108526 1082097]
  - [net] filter: ingress socket filter by mark (Jiri Benc) [1108526 1082097]
  - [netdrv] bonding: look for bridge IPs in arp monitoring (Veaceslav Falico) [1102794 704190]
  - [s390] af_iucv: wrong mapping of sent and confirmed skbs (Hendrik Brueckner) [1112390 1102248]
  - [s390] af_iucv: recvmsg problem for SOCK_STREAM sockets (Hendrik Brueckner) [1112390 1102248]
  - [s390] af_iucv: fix recvmsg by replacing skb_pull() function (Hendrik Brueckner) [1112390 1102248]
  - [s390] kernel: avoid page table walk on user space access (Hendrik Brueckner) [1111194 1099146]
  - [s390] qeth: postpone freeing of qdio memory (Hendrik Brueckner) [1112134 1094379]
  - [s390] qeth: Fix retry logic in hardsetup (Hendrik Brueckner) [1112134 1094379]
  - [s390] qeth: Recognize return codes of ccw_device_set_online (Hendrik Brueckner) [1112134 1094379]
  - [s390] qdio: remove API wrappers (Hendrik Brueckner) [1112134 1094379]
  - [scsi] Ensure medium access timeout counter resets (David Jeffery) [1117153 1036884]
  - [scsi] Fix error handling when no ULD is attached (David Jeffery) [1117153 1036884]
  - [scsi] Handle disk devices which can not process medium access commands (David Jeffery) [1117153 1036884]
  - [fs] nfs: Fix calls to drop_nlink() (Steve Dickson) [1099607 1093819]
  - [mm] swap: do not skip lowest_bit in scan_swap_map() scan loop (Rafael Aquini) [1099728 1060886]
  - [mm] swap: fix shmem swapping when more than 8 areas (Rafael Aquini) [1099728 1060886]
  - [mm] swap: fix swapon size off-by-one (Rafael Aquini) [1099728 1060886]
  - [md] avoid deadlock when dirty buffers during md_stop (Jes Sorensen) [1121541 994724]
  - [x86] hyperv: bypass the timer_irq_works() check (Jason Wang) [1112226 1040349]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.29.2.el6]
changelog:
  - [kernel] futex: Fix errors in nested key ref-counting (Denys Vlasenko) [1094457 1094458] {CVE-2014-0205}
  - [net] vxlan: fix NULL pointer dereference (Jiri Benc) [1114549 1096351] {CVE-2014-3535}


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.1-0
changelog:
  - 1.1 rel# Patch to the 1.1 fix 2967 http://www.open-mpi.org/software/hwloc/nightly/v1.1/hwloc-1.1rc6r2967.tar.bz2
  - Fix hwloc_bitmap_to_ulong right after allocating the bitmap.
  - Fix the minimum width of NUMA nodes, caches and the legend in the graphical lstopo output.
  - Cleanup error management in hwloc-gather-topology.sh.
  - Add a manpage and usage for hwloc-gather-topology.sh on Linux.
  - Rename hwloc-gather-topology.sh to hwloc-gather-topology to be consistent with the upcoming version 1.2ease


author: Michal Hlavinka <mhlavink@redhat.com> - 82-6.1
changelog:
  - security fixes:
  - privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832)
  - race condition when checking source during mount (CVE-2011-1833)
  - mtab corruption via improper handling (CVE-2011-1834)
  - key poisoning via insecure temp directory handling (CVE-2011-1835)
  - arbitrary file overwrite via lock counter race (CVE-2011-1837)


author: Bob Relyea <rrelyea@redhat.com> - 1.1.0-36
changelog:
  - Recognize up to 10 certs and keys on PIV and CAC cards.
  - Allow cards to have no cert in slot '0'.
  - Allow cards to have ECC and RSA certs and keys


author: Bob Relyea <rrelyea@redhat.com> - 1.1.0-38
changelog:
  - rename the cache changes done in -36 so that they have issues with old
    cache values
  - fix cac 1 alt tokens that store certs beyond the top three slots
  - fix hand when using hp keyboard


author: Ade Lee <alee@redhat.com> 9.0.3-21
changelog:
  - Resolves #771790 - sslget does not work after FEDORA-2011-17400 update,
    breaking FreeIPA install (fixed in Git repo)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-5
changelog:
  - Discard unicast Request/Renew/Release/Decline message
    (unless we set unicast option) and respond with Reply
    with UseMulticast Status Code option (#554622)
  - Remove DHCPV6 OPERATION section from dhclient.conf.5
    describing deprecated 'send dhcp6.oro' syntax


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-6
changelog:
  - In dhclient-script check whether bound address
    passed duplicate address detection (DAD) (#559403)
  - If the bound address failed DAD (is found to be in use on the link),
    the dhcpv6 client sends a Decline message to the server
    as described in section 18.1.7 of RFC-3315 (#559403)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-7
changelog:
  - In client initiated message exchanges stop retransmission
    upon reaching the MRD rather than at some point after it (#559404)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-9
changelog:
  - If the Reply was received in response to Renew or Rebind message,
    client adds any new addresses in the IA option to the IA (#578098)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-10
changelog:
  - Add domain-search to the list of default requested DHCP options (#588352)
  - Move /etc/NetworkManager/dispatcher.d/10-dhclient script
    from dhcp to dhclient subpackage (#591140).
  - Compile with -fno-strict-aliasing (#594151).


author: Stepan Kasal <skasal@redhat.com> - 1.8.0-31
changelog:
  - drop *-cflags.patch, move all makefile fixes to *-fhs.patch
  - propagate libdir to Makefile; no need to set it on cmdline


author: Karel Klic <kklic@redhat.com> - 1.8.0-34
changelog:
  - -jbj patch replaced with -zeroheaders, which extends the header zeroing
    and also zeroes the buckets (#572601)
  - Fixed a memory leak in gdbm_reorganize(gdb) (rhbz#572598)
  - Handle read() returning less data than it was asked for (rhbz#572900)
  - Remove static builds from the devel package (#556050)
  - Moved autotools reinitialization from %build to %prep section


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.4.1.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.5.1.el6]
changelog:
  - [s390] dasd: fix IO error for newly defined devices (Hendrik Brueckner) [1574448]
  - [s390] dasd: fix failing path verification (Hendrik Brueckner) [1581684]
  - [s390] qeth: on channel error, reject further cmd requests (Hendrik Brueckner) [1562009]
  - [s390] qdio: fix access to uninitialized qdio_q fields (Hendrik Brueckner) [1581685]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1585299]
  - [x86] Add host_initiated check in reading MSR_AMD64_VIRT_SPEC_CTRL (Wei Huang) [1608576]
  - [x86] KVM: pass host_initiated to functions that read MSRs (Wei Huang) [1608576]
  - [fs] gfs2: Special-case rindex for gfs2_grow (Robert S Peterson) [1384184]
  - [fs] Revert "[fs] gfs2: Special case the rindex in gfs2_write_alloc_required()" (Robert S Peterson) [1384184]
  - [net] ip: process in-order fragments efficiently (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: add helpers to process in-order fragments faster. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: use rb trees for IP frag queue. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: discard IPv4 datagrams with overlapping segments. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: modify skb_rbtree_purge to return the truesize of all purged skbs. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: speed up skb_rbtree_purge() (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] skbuff: Rename RHEL6 version of skb_tree_purge() to skb_tree_purge_sk() (Stefano Brivio) [1613925] {CVE-2018-5391}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.1.el6]
changelog:
  - [x86] set __max_smt_threads for 1 core systems (Prarit Bhargava) [1623255]
  - [md] dm rq: fix a race condition in rq_completed() (Ming Lei) [1574568]
  - [scsi] scsi_transport_fc: Hold queue lock while calling blk_run_queue_async() (Ming Lei) [1574568]
  - [block] Avoid scheduling delayed work on a dead queue (Ming Lei) [1574568]
  - [block] Avoid that request_fn is invoked on a dead queue (Ming Lei) [1574568]
  - [block] Let blk_drain_queue() caller obtain the queue lock (Ming Lei) [1574568]
  - [block] Rename queue dead flag (Ming Lei) [1574568]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.2.el6]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-754.6.3.el6]
changelog:
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.20.1.el6]
changelog:
  - [sched] kernel: sched: Fix nohz load accounting -- again (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Move sched_avg_update to update_cpu_load (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Cure more NO_HZ load average woes (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Cure load average vs NO_HZ woes (Rafael Aquini) [1300349 1167755]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.21.1.el6]
changelog:
  - [fs] pipe: fix offset and len mismatch on pipe_iov_copy_to_user failure (Seth Jennings) [1310148 1302223] {CVE-2016-0774}
  - [fs] gfs2: Add missing else in trans_add_meta/data (Robert S Peterson) [1304332 1267995]
  - [fs] fs-cache: Synchronise object death state change vs operation submission (David Howells) [1308471 1096893]
  - [fs] fs-cache: Reduce cookie ref count if submit fails (David Howells) [1308471 1096893]
  - [mm] memcg: oom_notify use-after-free fix (Rafael Aquini) [1302763 1294400]
  - [x86] fix corruption of XMM registers when interrupt handlers use FPU (Mikulas Patocka) [1298994 1259023]
  - [net] tcp: honour SO_BINDTODEVICE for TW_RST case too (Florian Westphal) [1303044 1292300]
  - [net] add inet_sk_transparent() helper (Florian Westphal) [1303044 1292300]
  - [net] ipv6: tcp_ipv6 policy route issue (Florian Westphal) [1303044 1292300]
  - [net] ipv6: reuse rt6_need_strict (Florian Westphal) [1303044 1292300]
  - [net] tcp: resets are misrouted (Florian Westphal) [1303044 1292300]
  - [net] tcp: tcp_v4_send_reset: binding oif to iif in no sock case (Florian Westphal) [1303044 1292300]
  - [crypto] api: Only abort operations on fatal signal (Herbert Xu) [1296014 1272314]
  - [crypto] testmgr: don't use interruptible wait in tests (Herbert Xu) [1296014 1272314]
  - [kernel] sched: add wait_for_completion_killable_timeout (Herbert Xu) [1296014 1272314]
  - [net] sctp: add routing output fallback (Xin Long) [1307073 1229124]
  - [net] sctp: fix dst leak (Xin Long) [1307073 1229124]
  - [net] sctp: fix src address selection if using secondary addresses (Xin Long) [1307073 1229124]
  - [net] sctp: reduce indent level on sctp_v4_get_dst (Xin Long) [1307073 1229124]
  - [scsi] hpsa: Update driver revision to RH5 (Joseph Szczypek) [1306192 1244959]
  - [scsi] hpsa: fix issues with multilun devices (Joseph Szczypek) [1306192 1244959]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.22.1.el6]
changelog:
  - [mm] always decrement anon_vma degree when the vma list is empty (Jerome Marchand) [1318364 1309898]


author: Steve Grubb <sgrubb@redhat.com> 2.2-4
changelog:
  - Revised patch based on upstream commit 895
  resolves: #1028635 audisp-remote reconnect problems after transient network err


author: Steve Grubb <sgrubb@redhat.com> 2.3.7-1
changelog:
  - New upstream enhancement and bugfix release
  resolves: #1065067 - Audit package rebase
  resolves: #810749 - audit allows tcp_max_per_addr + 1 connections
  resolves: #869555 - ausearch -i does not interpret execve arguments always
  resolves: #888348 - auditd won't start when some actions send mail
  resolves: #922508 - confusing aulast records for bad logins
  resolves: #950158 - man page unclear wrt num_logs affecting keep_logs setting
  resolves: #967238 - Audit rules are built from a directory of rule files
  resolves: #967240 - ausearch to checkpoint so only reports new events
  resolves: #970675 - auparse is truncating path context after first category
  resolves: #1011052 - Missing text in auditd.conf man page
  resolves: #1022035 - Case values for actions unclear in auditd.conf man page
  resolves: #1029981 - ausearch help typo for "-x" option
  resolves: #1049916 - ausearch issues found by ausearch-test
  resolves: #1053424 - Error in auparse-defs.h
  resolves: #1071580 - audispd config file parser fails on long input
  resolves: #1089713 - limit of 30 for system call in audit.rules


author: Steve Grubb <sgrubb@redhat.com> 2.3.7-4
changelog:
  resolves: #1049916 - Handle i386 session ID's better
  resolves: #1120286 - ausearch -i does not display commas between categories


author: Steve Grubb <sgrubb@redhat.com> 2.4.5-1
changelog:
  - New upstream enhancement and bugfix release
  resolves: #1129076 - auvirt --help shows an incorrect option "--show--uuid"
  resolves: #1138674 - auditd may fail to start if configured to send mail
  resolves: #1144252 - Auditctl should not send warnings to console during boot
  resolves: #1197235 - ausearch can't parse time in non-US locale/UTF-8 encoding
  resolves: #1235457 - Line buffer is too short for plugin config files
  resolves: #1257650 - Rebase audit package


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-46
changelog:
  - require credentials to match for NTLM re-use (CVE-2015-3143)
  - close Negotiate connections when done (CVE-2015-3148)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-49
changelog:
  - prevent NSS from incorrectly re-using a session (#1269660)
  - prevent test46 from failing due to expired cookie (#1277551)


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
  - update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
  - merge-review cosmetics (#226429)
    - drop ancient sqlite3 obsoletes
    - fix tab vs space whitespace issues
    - remove commas from summaries
  - fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
  - update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
  - disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
  - update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
  - drop no longer needed test-disabler patches


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.3-10
changelog:
  - Fix emblem handling in trash (#616145)
  - Require new gnome-disk-utility (#636540)
  - Hide mounts having a path element starting with dot (#624795)
  - Fix SELinux while accessing a leaked /dev/ptmx file descriptor (#616838)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.3-13
changelog:
  - Fix interaction with LUKS volumes with fstab records (#599055)
  - Fix defects revealed by Coverity scan (#722465)
  - Correct return values on error for programs (#682799)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.3-15
changelog:
  - Fix several memory leaks (#809708)
  - Fix formatted BD-RE media detection (#669526)
  - Fix gvfs-open exit code on error (#746978)
  - Fix gvfs-info exit code on error (#746977)
  - Fix gvfs-cat exit code on error (#749369)
  - Fix gvfs-ls exit code on error (#749371)
  - Fix gvfs-mount exit code on error (#749372)


author: Michal Zidek <mzidek@redhat.com> - 0.4.0-13
changelog:
  - Resolves: rhbz#1538061 - sssd/libini_config" cannot parse configuration file
                             with line longer than 5102


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.16.4.1567-2
changelog:
  - updated to 1.16.4
  - rediffed/updated patches
  - splitted some subpackages (c++, client) out of main package as they
    introduce additional dependencies (c++, curl)


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 1.16.24-1200.1840
changelog:
  - updated to 1.16.24
  - rediffed patches
  - added patch fix handling of wrong certificates (Nikola Pajkovsky)
  - added support for $XMLRPC_TRACE_CURL env (John Dennis)
  - fixed 'xmlrpc-c-config --help' output (#531910)
  - build xmlrpc_pstream tool


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 1.16.24-1200.1840.2
changelog:
  - backported GSSAPI delegation from upstream version 1.27.04 with strong attention
    to libxmlrpc++ client ABI backward compatibility (#719945)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 1.16.24-1200.1840.3
changelog:
  - Fix memory leak in libxmlrpc_client.so (#741641)
  - Remove autoconf variables from pkgconfig files that are not used (#653702)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 1.16.24-1209.1840
changelog:
  - fixed various RpmDiff warning messages about missing sub-packages requires
  - added Requires libcurl to the client/apps packages (.so libraries needed)
  - specified BuildRequires curl-devel version for CURLOPT_GSSAPI_DELEGATION option
  - fix & increase release number (svnrev should be after N-V-R)


author: Milind Changire <mchangir@redhat.com> - 3.12.2-9
changelog:
  - fixes bugs bz#1546717 bz#1557551 bz#1558948 bz#1561999 bz#1563804 
    bz#1565015 bz#1565119 bz#1565399 bz#1565577 bz#1567100 bz#1567899 bz#1568374 
    bz#1568969 bz#1569490 bz#1570514 bz#1570541 bz#1570582 bz#1571645 bz#1572087 
    bz#1572585 bz#1575895


author: Milind Changire <mchangir@redhat.com> - 3.12.2-10
changelog:
  - fixes bugs bz#1488120 bz#1565577 bz#1568297 bz#1570586 bz#1572043 
    bz#1572075 bz#1575840 bz#1575877


author: Milind Changire <mchangir@redhat.com> - 3.12.2-13
changelog:
  - fixes bugs bz#1493085 bz#1518710 bz#1554255 bz#1558948 bz#1558989 
    bz#1559452 bz#1567001 bz#1569312 bz#1569951 bz#1575539 bz#1575557 bz#1577051 
    bz#1580120 bz#1581184 bz#1581553 bz#1581647 bz#1582119 bz#1582129 bz#1582417 
    bz#1583047 bz#1588408 bz#1592666 bz#1594658


author: Milind Changire <mchangir@redhat.com> - 3.12.2-14
changelog:
  - fixes bugs bz#1547903 bz#1566336 bz#1568896 bz#1578716 bz#1581047 
    bz#1581231 bz#1582066 bz#1593865 bz#1597506 bz#1597511 bz#1597654 bz#1597768 
    bz#1598105 bz#1598356 bz#1599037 bz#1599823 bz#1600057 bz#1601314


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
  - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
    bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-7
changelog:
  - Add dummy sources file to test for and prevent breaking rhpkg commands
  - Enable testing for 'rhpk upload' and 'rhpk new-sources' breakage such as hangs
  - Related: rhbz#837089


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-8
changelog:
  - PEM peminit returns CKR_CANT_LOCK when needed to inform caller module isn't thread safe
  - Resolves: rhbz#555019 - [PEM] invalid writes in multi-threaded libcurl based application


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-9
changelog:
  - Fix locking issue causing curl hangs and authenticate to the correct session
  - Resolves: rhbz#872838


author: Elio Maldonado <emaldona@redhat.com> - 3.14.0.0-12
changelog:
  - Recreate the distrust patch by backporting the upstream one
  - Resolves: rhpbz#890914 - Dis-trust TURKTRUST mis-issued *.google.com certificate


author: Jiri Skala <jskala@redhat.com> - 4.0.9-1
changelog:
  - Resolves: #602838 - CVE-2010-2251 lftp: multiple HTTP client download filename vulnerability
  - re-base to latest upstream version


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-21
changelog:
  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
    vulnerability and additional DTLS fixes (#771770)
  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
  - fix for CVE-2011-4577 - possible DoS through malformed RFC 3779 data (#771778)
  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-23
changelog:
  - fix problem with the SGC restart patch that might terminate handshake
    incorrectly
  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725)
  - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-25
changelog:
  - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686)
  - properly initialize tkeylen in the CVE-2012-0884 fix


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-26
changelog:
  - use PKCS#8 when writing private keys in FIPS mode as the old
    PEM encryption mode is not FIPS compatible (#812348)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-27
changelog:
  - fix sslrand(1) and sslpasswd(1) reference in openssl(1) manpage (#841645)
  - drop superfluous lib64 fixup in pkgconfig .pc files (#770872)
  - force BIO_accept_new(*:<port-number>) to listen on IPv4


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.40-2.4.3.4.el6
changelog:
  -  patch111 - nss-config-2.patch applied jsut as dry-run
    (== not applied) as it have invalid consequences
  - Resolves: rhbz#1036813


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.4.0.el6
changelog:
  - updated to security icedtea 2.4.4
   - icedtea_version set to 2.4.4
   - updatever bumped to       51
   - release reset to 0
  - sync with fedora
   - added and applied patch411 1029588.patch (rh 1029588)
   - added aand applied patch410, 1015432 (rh 1015432)
  - Resolves: rhbz#1050935


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.7.0.el6
changelog:
  - bumped to future icedtea-forest 2.4.7
  - updatever set to 55, buildver se to 13, release reset to 0
  - removed upstreamed patch402 gstackbounds.patch
  - removed BuildRequires on pulseaudio >= 0.9.1, devel is enough
  - removed Requires: rhino, BuildRequires is enough
  - added JRE_RELEASE_VERSION and ALT_PARALLEL_COMPILE_JOBS
  - fixed FT2_CFLAGS and FT2_LIBS
  - ppc64 repalced by power64 macro
  - patch111 applied as dry-run (6.5 forward port)
  - Resolves: rhbz#1085002


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115874


author: Peter Jones <pjones@redhat.com> - 4.02-9
changelog:
  - Avoid a workaround that causes machines to stall in PXE boots that
    use the local disk.
    ResolveS:rhbz#980671


author: Peter Jones <pjones@redhat.com> - 4.04-2
changelog:
  - Make the subpackages noarch, not i686, so rel-eng doesn't have to fight
    it to get working dependency resolution.
    Related: rhbz#980671


author: Praveen K Paladugu <praveen_paladugu@dell.com> - 2.2.0-1
changelog:
  - Updated the sources to 2.2.0. Couple of major changes are as follows:
  - Major changes:
  -       Adapt IANA ports of 5985 (http) and 5986 (https)
  -       Change the Ruby bindings module name to 'Openwsman'
  -       Change the Ruby plugin module name to 'Openwsman'
  -       IPv6 support (A_Venkatachalam@Dell.com)
  -       preliminary support for wbem intrinsic operations
  -           'EnumerateClassNames' and 'GetClass' (kkaempf@suse.de)
  -            (needs fixed sblim-sfcc, see www.openwsman.org for details)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.3-7
changelog:
  - Add missing openwsman headers to libwsman-devel
    Resolves: #615922
  - Move initscript to the right place
    Resolves: #626773
  - Fix return values from initscript according to guidelines
    Resolves: #613031
  - Fix ssl check behaviour in initscript
    Resolves: #617549
  - Fix openwsman crashes when sfcb is stopped
    Resolves: #625160


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.23.1.el6]
changelog:
  - [x86] perf: Add more Broadwell model numbers (Jiri Olsa) [1320035 1242694]
  - [perf] perf/x86/intel: Remove incorrect model number from Haswell perf (Jiri Olsa) [1320035 1242694]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.24.1.el6]
changelog:
  - [sched] fix KABI break (Seth Jennings) [1314878 1230310]
  - [sched] fair: Test list head instead of list entry in throttle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [sched] sched,perf: Fix periodic timers (Seth Jennings) [1314878 1230310]
  - [sched] sched: debug: Remove the cfs bandwidth timer_active printout (Seth Jennings) [1314878 1230310]
  - [sched] Cleanup bandwidth timers (Seth Jennings) [1314878 1230310]
  - [sched] sched: core: Use hrtimer_start_expires (Seth Jennings) [1314878 1230310]
  - [sched] fair: Fix unlocked reads of some cfs_b->quota/period (Seth Jennings) [1314878 1230310]
  - [sched] Fix potential near-infinite distribute_cfs_runtime loop (Seth Jennings) [1314878 1230310]
  - [sched] fair: Fix tg_set_cfs_bandwidth deadlock on rq->lock (Seth Jennings) [1314878 1230310]
  - [sched] Fix hrtimer_cancel/rq->lock deadlock (Seth Jennings) [1314878 1230310]
  - [sched] Fix cfs_bandwidth misuse of hrtimer_expires_remaining (Seth Jennings) [1314878 1230310]
  - [sched] Refine the code in unthrottle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [sched] Update rq clock earlier in unthrottle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [block] Fix q_suspended logic error for io submission (David Milburn) [1314209 1227342]
  - [block] nvme: No lock while DMA mapping data (David Milburn) [1314209 1227342]
  - [netdrv] ixgbe: finish ixgbe: Update ixgbe to use new vlan accleration (John Greene) [1315706 1249244]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.25.1.el6]
changelog:
  - [x86] nmi/64: Fix a paravirt stack-clobbering bug in the NMI code (Denys Vlasenko) [1259580 1259581] {CVE-2015-5157}
  - [x86] nmi/64: Switch stacks on userspace NMI entry (Denys Vlasenko) [1259580 1259581] {CVE-2015-5157}
  - [fs] anon_inodes implement dname (Aristeu Rozanski) [1322707 1296019]
  - [fs] xfs: Avoid pathological backwards allocation (Bill O'Donnell) [1320031 1302777]
  - [net] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Jacob Tanenbaum) [1297421 1297422] {CVE-2015-8767}
  - [net] udp: move logic out of udp[46]_ufo_send_check (Sabrina Dubroca) [1319276 1299975]
  - [net] af_unix: Guard against other == sk in unix_dgram_sendmsg (Jakub Sitnicki) [1315696 1309241]
  - [md] raid10: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1320863 1273546]
  - [md] raid1: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1320863 1273546]
  - [md] raid10: submit_bio_wait returns 0 on success (Jes Sorensen) [1320863 1273546]
  - [md] raid1: submit_bio_wait() returns 0 on success (Jes Sorensen) [1320863 1273546]
  - [md] crash in md-raid1 and md-raid10 due to incorrect list manipulation (Jes Sorensen) [1320863 1273546]
  - [md] raid10: ensure device failure recorded before write request returns (Jes Sorensen) [1320863 1273546]
  - [md] raid1: ensure device failure recorded before write request returns (Jes Sorensen) [1320863 1273546]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.26.1.el6]
changelog:
  - [kernel] revert "sched: core: Use hrtimer_start_expires" (Jiri Olsa) [1326043 1324318]
  - [kernel] Revert "Cleanup bandwidth timers" (Jiri Olsa) [1326043 1324318]
  - [kernel] revert "fair: Test list head instead of list entry in throttle_cfs_rq" (Jiri Olsa) [1326043 1324318]
  - [kernel] revert "sched, perf: Fix periodic timers" (Jiri Olsa) [1326043 1324318]
  - [kernel] Revert "fix KABI break" (Jiri Olsa) [1326043 1324318]


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.141-1
changelog:
  - Do not check for suspended devices if scanning for lvmetad update.
  - Fix part. table filter with external_device_info_source="udev" and blkid<2.20.
  - Add metadata/check_pv_device_sizes switch to lvm.conf for device size checks.
  - Warn if device size is less than corresponding PV size in metadata.
  - Cache device sizes internally.
  - Restore support for command breaking in process_each_lv_in_vg() (2.02.118).
  - Use correct mempool when process_each_lv_in_vg() (2.02.118).
  - Fix lvm.8 man to show again prohibited suffixes.
  - Fix configure to set proper use_blkid_wiping if autodetected as disabled.
  - Initialise udev in clvmd for use in device scanning. (2.02.116)
  - Add seg_le_ranges report field for common format when displaying seg devices.
  - Honour report/list_item_separator for seg_metadata_le_ranges report field.
  - Don't mark hidden devs in -o devices,metadata_devices,seg_pe_ranges.(2.02.140)
  - Change LV sizes in seg_pe_ranges report field to match underlying devices.
  - Add kernel_cache_settings report field for cache LV settings used in kernel.
  - Fix man page for dmsetup udevcreatecookie.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-1
changelog:
  - Use uninitilized pool header detection in all cases.
  - Fix read error detection when checking for uninitialized thin-pool header.
  - Fix error path for internal error in lvmetad vg lookup code.
  - Fix error path when sending thin-pool message fails in update_pool_lv().
  - Support reporting CheckNeeded and Fail state for thin-pool and thin LV.
  - For failing thin-pool and thin volume correctly report percentage as INVALID.
  - Report -1, not 'unkown' for lv_{snapshot_invalid,merge_failed} with --binary.
  - If PV belongs to some VG and metadata missing, skip it if system ID is used.
  - Automatically change PV header extension to latest version if writing PV/VG.
  - Identify used PVs in pv_attr field by new 'u' character.
  - Add pv_in_use reporting field to report if PV is used or not.
  - Add pv_ext_vsn reporting field to report PV header extension version.
  - Add protective flag marking PVs as used even if no metadata available.
  - Fix memory pool corruption in pvmove (2.02.141).
  - Support control of spare metadata creation when repairing thin-pool.
  - Fix config type of 'log/verbose' from bool to int (2.02.99).
  - Fix inverted data LV thinp watermark calc for dmeventd response (2.02.133).
  - Use use_blkid_wiping=0 if not defined in lvm.conf and support not compiled in.
  - Clear cached bootloader areas when PV format changed.
  - Fix string boundary check in _get_canonical_field_name().
  - Always initialized hist struct in _stats_parse_histogram().
  - Improve status parsing for thin-pool and thin devices.
  - Use fully aligned allocations for dm_pool_strdup/strndup() (1.02.64).
  - Fix thin-pool table parameter feature order to match kernel output.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-2
changelog:
  - Fix resize of stacked raid thin data volume (2.02.141).
  - Allow for raid leg replacement if not both data and metadata image are on pvs.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-3
changelog:
  - Detect and warn about mismatch between devices used and assumed for an LV.
  - If available, use /proc/self/mountinfo to detect mounted volume in fsadm.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-4
changelog:
  - Remove spurious error about no value in /sys/dev/block/major:minor/dm/uuid.
  - Fix device mismatch detection for LV if persistent .cache file is used.
  - Fix holder device not being found in /dev while sysfs has it during dev scan.
  - Document that lvmlockd and lvmpolld features are available only if compiled in
    (RHEL6 lvm2 doesn't have lvmlockd and lvmpolld compiled in).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-7
changelog:
  - Workaround for raid leg allocation failure after not-in-sync raid leg failure.
  - Fix flushing of outstanding IO for mirror target (2.02.133).


author: Tomas Bzatek <tbzatek@redhat.com> - 1.0.1-8.el6
changelog:
  - Allow extra mount options from udev rules (#673102, #681875)
  - Do not force-unmount devices marked as DM_SUSPENDED (#1121742)


author: Ondrej Holy <oholy@redhat.com> - 1.4.3-17
changelog:
  - Check GConf2 key before use to avoid error dialog (#1049232)
  - Fix renaming files on webdav (#1011835)
  - Fix libarchive dependency


author: Andreas Schneider <asn@redhat.com> - 3.6.23-34
changelog:
  - resolves: #1329967 - Fix netlogon credential checks
  - resolves: #1329975 - Fix dcerpc trailer verificaton


author: Adam Tkac <atkac redhat com> 32:9.7.2-2.P3
changelog:
  - host utility now honors "attempts", "timeout" and "debug" options in
    resolv.conf (#622764)
  - initscript should kill only the "correct" named process (#622785)
  - attempt to reconnect to PostgreSQL during each query if the initial
    connection failed (#623190)


author: Adam Tkac <atkac redhat com> 32:9.7.2-3.P3
changelog:
  - use same atomic operations on both ppc and ppc64 (#623638)
  - add new option DISABLE_ZONE_CHECKING to sysconfig/named (#623673)
  - document dig exit codes
  - add Requires: bind-libs to bind subpkgs
  - remove statement about system-config-bind from named.8 manpage (#660676)


author: Adam Tkac <atkac redhat com> 32:9.7.2-4.P3
changelog:
  - solve conflict between i686 and x86_64 bind-devel packages (#658045)
  - fix "service named status" when used with named-sdb
  - fix "krb5-self" update-policy rule processing (#664401)
  - don't check MD5, size and mtime of sysconfig/named


author: Thomas Haller <thaller@redhat.com> - 3.2.21-6
changelog:
  - fix rtnl_link_get_stat() for IPSTATS_MIB_* after kernel API breakage
  - fix parsing IFLA_PROTINFO which broke on older kernels (rh #1062533)
  - fix printing in nl_msec2str for whole seconds
  - don't reset route scope in rtnl_route_build_msg if set to RT_SCOPE_NOWHERE
  - backport nl_has_capability function


author: Steve Dickson <steved@redhat.com> 1.4.12-1
changelog:
  - Updated to latest stable upstream version: 1.4.12
  - API documentation is now installed (bz 487977)
  - libevent-devel multilib conflict (bz 477685)
  - epoll backend allocates too much memory (bz 517918)


author: Hans de Goede <hdegoede@redhat.com> - 0.11-2
changelog:
  - Fix a crash triggered when trying to view a usbredir enabled vm from
    virt-manager
    Related: rhbz#758100


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.11-3
changelog:
  - Fix cursor is displayed on each guest screen when mouse is in server mode
    Resolves: rhbz#804308
  - Fix --spice-color-depth=16 does not seem to work.
    Resolves: rhbz#802898
  - Fix cannot leave full-screen when mouse is grabbed in server mode mouse
    Resolves: rhbz#804307


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.11-6
changelog:
  - Fix blue-tinted video with old Spice server
    Resolves: rhbz#807389
  - Fix segfault during switch-host migration
    Resolves: rhbz#807410
  - Fix switch-host migration failure with SSL
    Resolves: rhbz#802574
  - Fix crash during migration while playing video
    Resolves: rhbz#808567
  - Requires gtk2 >= 2.18.9-10
    Resolves: rhbz#809033


author: Marc-André Lureau <marcandre.lureau@redhat.com> - 0.11-7
changelog:
  - Handle grab-broken event
    Resolves: rhbz#807292
  - Fix segfault with large clipboard copy-paste
    Resolves: rhbz#809145
  - Fix cursor not hidden
    Resolves: rhbz#810588
  - Fix segfault when closing while recording
    Resolves: rhbz#810247
  - Add USB support to controller
    Resolves: rhbz#807296
  - Add WAN support to controller
    Resolves: rhbz#787449


author: Thomas Woerner <twoerner@redhat.com> 1.2.22-1
changelog:
  - using NetworkManager DBUS interface to replace NCDeviceList from
    system-config-network
  - not opening orig port for local port forwarding, only new port is open
  - added isakmp support for IPsec (rhbz#504446)
  - added amanda client support (rhbz#541679)
  - fixed requirement for setenforce: libselinux-utils instead of libselinux
  - removed unused import socket
  - added download url to Source tag in spec file
  - fixed wrong license header in src/fw_tui.py (LGPL instead of GPL)
  - update cluster-suite service: disable rgmanager and cssd
  - removed separator at the end of the Options menu (rhbz#531635)
  - removed 2049/udp from NFS4 service (rhbz#532491)


author: Thomas Woerner <twoerner@redhat.com> 1.2.24-1
changelog:
  - DBUS-mechanism: report errors to syslog and print traceback (rhbz#563354)
  - fixed minor misspellings (rhbz#566468)
  - msgmerged po files
  - added missing default values for ip*tables-config content (rhbz#566869)
  - autofoo utils update
  - fixed max length of user defined interface name in interfaceDialog
  - added missing range check to port_entry_changed_cb
  - fixed sensitiveness of protocol label in portDialog
  - fixed misuse of MARK extension in nat table, now in mangle table
  - port forwarding dialog usability fixes (rhbz#507638)
  - use new fw_functions.checkInterface function in tui and gui
  - new function to check interface names in fw_functions
  - use new checkInterface function in parser for trust, masq and forward-port
  - add wlan standard device
  - fixed build (fw_nm.py not packaged)
  - updated translations: bn_IN, cs, da, de, el, en_GB, es, fi, fr, hu, is, it,
                          ja, nb, nl, or, pl, pt, pt_BR, ru, sr, sr@latin, sv,
                          te, uk


author: Thomas Woerner <twoerner@redhat.com> 1.2.25-1
changelog:
  - fixed lokkit: do not create or alter firewall in selinux only mode
    (rhbz#583986)
  - use new icons (rhbz#583715)
  - fixed treeviewtooltips to not show the tooltip if an overlapping window has
    the focus
  - updated translations: bn_IN, de, es, gu, it, kn, ml, mr, nl, or, pa, pl, pt,
                          pt_BR, ru, sk, sr, sr@latin, te


author: Thomas Woerner <twoerner@redhat.com> 1.2.26-1
changelog:
  - added libvirt services (rhbz#565625)
  - added Bakula service (rhbz#588377)
  - fixed DBUS mechanism to report complete syslog message (rhbz#604623)
  - fixed crash because of missing /etc/services file (rhbz#604726)
  - updated translations: ar, as, bn_IN, da, de, es, fi, fr, gu, he, hi, is, it,
                          ja, kn, ko, ml, mr, nl, or, pa, pl, pt, ru, ta, te, 
                          zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-1
changelog:
  - updated translations: bn_IN, de, fi, fr, gu, hi, it, ja, kn, ko, ml, mr, or,
                          pt_BR, ru, ta, te, zh_CN, zh_TW


author: Petr Šabata <contyk@redhat.com> - 2.6.32-24
changelog:
  - Don't hang on rtnl_send() in a confined domain (#985526)
  - Run lnstat indefinitely if -c was not specified (#977845)
  - lnstat manpage SEE ALSO path fixes (#974694)
  - Document tc's force and batch options (#950122)
  - Fix include/linux/if_link.h to get in line with upstream again (#903228)
  - Add support for the IPv6 tokenized interface (#950400)
  - Handle ip-route rto_min parameters correctly (#859145)
  - Add VXLAN support (#929313, #908155)
  - Add mdb subcommand to bridge (#885977)
  - tc now supports the -OK option (#851371)


author: Petr Pisar <ppisar@redhat.com> - 2.6.32-29
changelog:
  - Document tc -OK option (#851371)
  - Document "bridge mdb" and "bridge monitor mdb" (#885977)
  - Document bridge unsupported features (#929313)


author: Petr Šabata <contyk@redhat.com> - 2.6.32-31
changelog:
  - Removed the unsporrted features from the bridge(8) manpage and
    document bridge fdb replace (#929313)


author: Tim Waugh <twaugh@redhat.com> - 8.70-4
changelog:
  - Fixed Y-axis when duplexing with cups device (bug #557458).  This
    patch incorporates upstream commits 10625, 10631, and 10890.


author: Tim Waugh <twaugh@redhat.com> - 8.70-7
changelog:
  - Fixed jbig2dec-nullderef patch (bug #621118).
  - Applied upstream patch to fix iname.c segfault (bug #629562).


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-21.el6
changelog:
  - docs: Document managed=yes of hostdev passthrough (rhbz#740686)
  - ServerClient: Flush cached data (rhbz#748025)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.0
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.0
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.0
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Dan Williams <dcbw@redhat.com> - 0.8.1-7
changelog:
  - core: add DHCP lease-change events to the dispatcher (rh #662730)
  - core: validate Enable/Disable WiFi and WWAN requests (rh #626337)
  - core: don't update /etc/hosts with current hostname (rh #668830)
  - wifi: ensure Enabled state is preserved regardless of rfkill (rh #584271)
  - ifcfg-rh: respect GATEWAYDEV for ibft/iSCSI configs (rh #665027)
  - ifcfg-rh: handle IPv6 gateway correctly for static addressing configs (rh #666078)


author: Jiří Klimeš <jklimes@redhat.com> - 0.8.1-8
changelog:
  - applet: display IPv6 info under applet's 'Connection Information' (rh #634152)
  - applet,nm: fix translations (rh #589230)


author: Jiří Klimeš <jklimes@redhat.com> - 0.8.1-10
changelog:
  - wifi: use nl80211 supplicant driver and background scanning (rh #713283)
  - applet: pressing Enter in secrets dialogs comfirms them (rh #696585)
  - applet: fix freed memory access on reading gconf entries (rh #696916)
  - core: send hostname to DHCP server by default (rh #590096)
  - core: handle s390 CTC-type devices (rh #660666)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-15
changelog:
  - wifi: calculate quality correctly with nl80211/mac80211 drivers (rh #748075)
  - wifi: fix Ad-Hoc associations when using nl80211/mac80211 drivers (rh #747066)
  - vpn: fix D-Bus interface properties export (rh #659685)


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.17.1.el6]
changelog:
  - [scsi] qla2xxx: Fixup looking for a space in the outstanding_cmds array in qla2x00_alloc_iocbs() (Chad Dupuis) [1085660 1070856]
  - [scsi] isci: fix reset timeout handling (David Milburn) [1080600 1040393]
  - [scsi] isci: correct erroneous for_each_isci_host macro (David Milburn) [1074855 1059325]
  - [kernel] sched: Fix small race where child->se.parent, cfs_rq might point to invalid ones (Naoya Horiguchi) [1081907 1032350]
  - [kernel] sched: suppress RCU lockdep splat in task_fork_fair (Naoya Horiguchi) [1081907 1032350]
  - [kernel] sched: add local variable to store task_group() to avoid kernel stall (Naoya Horiguchi) [1081908 1043733]
  - [fs] cifs: mask off top byte in get_rfc1002_length() (Sachin Prabhu) [1085358 1069737]
  - [kernel] Prevent deadlock when post_schedule_rt() results in calling wakeup_kswapd() on multiple CPUs (Larry Woodman) [1086095 1009626]
  - [scsi] AACRAID Driver compat IOCTL missing capability check (Jacob Tanenbaum) [1033533 1033534] {CVE-2013-6383}
  - [md] dm-thin: fix rcu_read_lock being held in code that can sleep (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: irqsave must always be used with the pool->lock spinlock (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: sort the per thin deferred bios using an rb_tree (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: use per thin device deferred bio lists (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: simplify pool_is_congested (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix dangling bio in process_deferred_bios error path (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: take care to copy the space map root before locking the superblock (Mike Snitzer) [1086007 1060381]
  - [md] dm-transaction-manager: fix corruption due to non-atomic transaction commit (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map-metadata: fix refcount decrement below 0 which caused corruption (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix Documentation for held metadata root feature (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix noflush suspend IO queueing (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix deadlock in __requeue_bio_list (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix out of data space handling (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: ensure user takes action to validate data and metadata consistency (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: synchronize the pool mode during suspend (Mike Snitzer) [1086007 1060381]
  - [md] fix Kconfig indentation (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: allow metadata space larger than supported to go unused (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix the error path for the thin device constructor (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: avoid metadata commit if a pool's thin devices haven't changed (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map-metadata: fix bug in resizing of thin metadata (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix pool feature parsing (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map-metadata: fix extending the space map (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map-common: make sure new space is used during extend (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix set_pool_mode exposed pool operation races (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: eliminate the no_free_space flag (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: add error_if_no_space feature (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: requeue bios to DM core if no_free_space and in read-only mode (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: cleanup and improve no space handling (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: log info when growing the data or metadata device (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: handle metadata failures more consistently (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: factor out check_low_water_mark and use bools (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: add mappings to end of prepared_* lists (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: return error from alloc_data_block if pool is not in write mode (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: use bool rather than unsigned for flags in structures (Mike Snitzer) [1086007 1060381]
  - [md] dm-persistent-data: cleanup dm-thin specific references in text (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map-metadata: limit errors in sm_metadata_new_block (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix discard support to a previously shared block (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: initialize dm_thin_new_mapping returned by get_next_mapping (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map: disallow decrementing a reference count below zero (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: allow pool in read-only mode to transition to read-write mode (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: re-establish read-only state when switching to fail mode (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: always fallback the pool mode if commit fails (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: switch to read-only mode if metadata space is exhausted (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: switch to read only mode if a mapping insert fails (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map-metadata: return on failure in sm_metadata_new_block (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map-disk: optimise sm_disk_dec_block (Mike Snitzer) [1086007 1060381]
  - [md] dm-table: print error on preresume failure (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: do not expose non-zero discard limits if discards disabled (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: always return -ENOSPC if no_free_space is set (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: set pool read-only if breaking_sharing fails block allocation (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: prefix pool error messages with pool device name (Mike Snitzer) [1086007 1060381]
  - [md] dm-space-map: optimise sm_ll_dec and sm_ll_inc (Mike Snitzer) [1086007 1060381]
  - [md] dm-btree: prefetch child nodes when walking tree for a dm_btree_del (Mike Snitzer) [1086007 1060381]
  - [md] dm-btree: use pop_frame in dm_btree_del to cleanup code (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix stacking of geometry limits (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: add data block size limits to Documentation (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: fix metadata dev resize detection (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: generate event when metadata threshold passed (Mike Snitzer) [1086007 1060381]
  - [md] dm-persistent-metadata: add space map threshold callback (Mike Snitzer) [1086007 1060381]
  - [md] dm-persistent-data: add threshold callback to space map (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: detect metadata device resizing (Mike Snitzer) [1086007 1060381]
  - [md] dm-persistent-data: support space map resizing (Mike Snitzer) [1086007 1060381]
  - [md] dm-thin: refactor data dev resize (Mike Snitzer) [1086007 1060381]
  - [md] dm-bufio: initialize read-only module parameters (Mike Snitzer) [1086007 1060381]
  - [md] dm-bufio: submit writes outside lock (Mike Snitzer) [1086007 1060381]
  - [md] dm-bufio: add recursive IO request BUG_ON (Mike Snitzer) [1086007 1060381]
  - [md] dm-bufio: prefetch (Mike Snitzer) [1086007 1060381]
  - [md] dm-bufio: fix slow IO latency issue specific to RHEL6 (Mike Snitzer) [1086490 1058528]
  - [netdrv] mlx4_en: Fixed crash when port type is changed (Amir Vadai) [1085658 1059586]
  - [netdrv] vmxnet3: fix netpoll race condition (Neil Horman) [1083175 1073218]
  - [net] netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Jiri Pirko) [1077345 1077346] {CVE-2014-2523}
  - [scsi] megaraid_sas: fix a small problem when reading state value from hw (Tomas Henzl) [1078641 1065187]
  - [fs] gfs2: Increase the max number of ACLs (Robert S Peterson) [1078874 1075713]
  - [net] filter: let bpf_tell_extensions return SKF_AD_MAX (Daniel Borkmann) [1079872 960275]
  - [net] introduce SO_BPF_EXTENSIONS (Daniel Borkmann) [1079872 960275]
  - [scsi] scsi_dh: cosmetic change to sizeof() (Ewan Milne) [1075554 1062494]
  - [acpi] thermal: Check for thermal zone requirement (Nigel Croxon) [1075651 1021044]
  - [acpi] thermal: Don't invalidate thermal zone if critical trip point is bad (Nigel Croxon) [1075651 1021044]
  - [mm] flush pages from pagevec of offlined CPU (Naoya Horiguchi) [1078007 1037467]
  - [fs] xfs: deprecate nodelaylog option (Eric Sandeen) [1076056 1055644]
  - [fs] Fix mountpoint reference leakage in linkat (Jeff Layton) [1069848 1059943]
  - [net] sock: Fix release_cb kABI brekage (Thomas Graf) [1066535 1039723]
  - [vhost] fix total length when packets are too short (Michael S. Tsirkin) [1064442 1064444] {CVE-2014-0077}
  - [net] sctp: fix sctp_sf_do_5_1D_ce to verify if peer is AUTH capable (Daniel Borkmann) [1070715 1067451] {CVE-2014-0101}
  - [vhost] validate vhost_get_vq_desc return value (Michael S. Tsirkin) [1062579 1058677] {CVE-2014-0055}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.19.1.el6]
changelog:
  - [kernel] sched: fix cpu_power initialization (Radim Krcmar) [1091826 1065304]
  - [fs] gfs2: Fix uninitialized VFS inode in gfs2_create_inode (Abhijith Das) [1092002 1059808]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.20.1.el6]
changelog:
  - [net] rtnetlink: Only supply IFLA_VF_PORTS information when RTEXT_FILTER_VF is set (Jiri Pirko) [1092870 1081282]
  - [net] rtnetlink: Warn when interface's information won't fit in our packet (Jiri Pirko) [1092870 1081282]
  - [net] bridge: Correctly receive hw-accelerated vlan traffic (Vlad Yasevich) [1096214 1067722]
  - [net] vlan: Allow accelerated packets to flow through the bridge (Vlad Yasevich) [1096214 1067722]
  - [infiniband] qib: Add missing serdes init sequence (Doug Ledford) [1080104 1005491]
  - [infiniband] qib: Fix txselect regression (Doug Ledford) [1080104 1005491]
  - [netdrv] ixgbevf: fix vlan acceleration (Nikolay Aleksandrov) [1094287 1069028]
  - [security] selinux: Fix kernel BUG on empty security contexts (Paul Moore) [1062502 1064545] {CVE-2014-1874}
  - [netdrv] libertas: potential oops in debugfs (Denys Vlasenko) [1034176 1034177] {CVE-2013-6378}
  - [kernel] cgroup: move put_css_set() after setting CGRP_RELEASABLE bit to fix notify_on_release (Naoya Horiguchi) [1081909 1037465]
  - [kernel] sched: Use exit hook to avoid use-after-free crash (Naoya Horiguchi) [1081914 1032347]
  - [kernel] cgroup: replace list_del() with list_del_init() to avoid panic (Naoya Horiguchi) [1081915 1032343]
  - [x86] turbostat: display C8, C9, C10 residency (Neil Horman) [1096711 1080637]
  - [scsi] lpfc 8.3.44: Fix kernel panics from corrupted ndlp list (Rob Evers) [1086839 1063699]
  - [s390] fix kernel crash due to linkage stack instructions (Hendrik Brueckner) [1067678 1067679] {CVE-2014-2039}
  - [x86] kvm: rate-limit global clock updates (Andrew Jones) [1090750 1072373]
  - [kernel] hrtimers: Move SMP function call to thread context (Mateusz Guzik) [1079869 1073129]
  - [kernel] hrtimers: Support resuming with two or more CPUs online (Mateusz Guzik) [1079869 1073129]
  - [fs] autofs4: fix device ioctl mount lookup (Ian Kent) [1069630 999708]
  - [fs] vfs: introduce kern_path_mountpoint() (Ian Kent) [1069630 999708]
  - [fs] vfs: rename user_path_umountat() to user_path_mountpoint_at() (Ian Kent) [1069630 999708]
  - [fs] vfs: massage umount_lookup_last() a bit to reduce nesting (Ian Kent) [1069630 999708]
  - [fs] vfs: allow umount to handle mountpoints without revalidating them (Ian Kent) [1069630 999708]
  - [fs] ext4: fix WARN_ON from ext4_releasepage() (Carlos Maiolino) [1063508 1036814]
  - [fs] vfs: fix getname() && do_getname() interaction (Oleg Nesterov) [1075653 1024689]
  - [x86] apic: Make disabled_cpu_apicid static read_mostly, fix typos (Nigel Croxon) [1082622 980621]
  - [x86] kexec: Add disable_cpu_apicid kernel parameter (Nigel Croxon) [1082622 980621]
  - [kvm] x86: use kvm_read/write_guest_virt_system in task switch (Paolo Bonzini) [1070296 1018581]
  - [kvm] x86: small cleanups to kvm_task_switch (Paolo Bonzini) [1070296 1018581]
  - [kvm] x86: propagate error from kvm_load_segment_descriptor (Paolo Bonzini) [1070296 1018581]
  - [kvm] x86: improve save_guest_segment_descriptor (Paolo Bonzini) [1070296 1018581]
  - [kvm] x86: introduce kvm_write_guest_virt_system (Paolo Bonzini) [1070296 1018581]
  - [kvm] x86: Fix task switch privilege checks (Paolo Bonzini) [1070296 1018581]
  - [powerpc] Make function that parses RTAS error logs global (Steve Best) [1091424 1028682]
  - [powerpc] pseries: Add RTAS event log v6 definition (Steve Best) [1091424 1028682]
  - [powerpc] pseries: Parse and handle EPOW interrupts (Steve Best) [1091424 1028682]
  - [fs] nfsd: don't try to reuse an expired DRC entry off the list (Jeff Layton) [1088779 1036972]
  - [fs] nfsd: when reusing an existing repcache entry, unhash it first (Jeff Layton) [1088779 1036972]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.23.2.el6]
changelog:
  - [kernel] utrace: force IRET path after utrace_finish_vfork() (Oleg Nesterov) [1115932 1115933] {CVE-2014-4699}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-431.23.3.el6]
changelog:
  - [netdrv] pppol2tp: fail when socket option level is not SOL_PPPOL2TP [1119461 1119462] {CVE-2014-4943}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-696.el6]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424628] {CVE-2017-6074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.1.1.el6]
changelog:
  - [block] fix use-after-free in seq file (Denys Vlasenko) [1418548 1418549] {CVE-2016-7910}
  - [firmware] Replacing the chelsio firmware (t4,t5)fw-1.15.37.0 (Sai Vemuri) [1433865 1425749]
  - [kernel] genirq: Avoid taking sparse_irq_lock for non-existent irqs (Dave Wysochanski) [1428106 1360930]
  - [tty] n_hdlc: get rid of racy n_hdlc.tbuf (Herton R. Krzesinski) [1429917 1429918] {CVE-2017-2636}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.2.1.el6]
changelog:
  - [sched] fair: Rework throttle_count sync (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Reorder cgroup creation code (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Initialize throttle_count for new task-groups lazily (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Do not announce throttled next buddy in dequeue_task_fair() (Jiri Olsa) [1436241 1250762]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.6.2.el6]
changelog:
  - [mm] enlarge stack guard gap (Larry Woodman) [1452729 1452730] {CVE-2017-1000364 CVE-2017-1000366}


author: Than Ngo <than@redhat.com> - 6:4.3.4-15
changelog:
  - Resolves: bz#587016, print dialogue does not remember previous settings
  - Resolves: bz#682611, Konqueror splash page in zh_TW is wrong
  - Resolves: bz#734734, plasma eating up cpu-time when systemtray some icon
  - Resolves: bz#826114, konqueror crash when trying to add "Terminal Emulator" to main menu bar


author: Lukáš Tinkl <ltinkl@redhat.com> - 6:4.3.4-22
changelog:
  - Resolves rhbz#1088925 - Opening a terminal in Konqueror / Dolphin does not 
    inherit environment variables


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-2
changelog:
  - Enable two additional ciphers and keep another one disabled
  - Prevent enabling extended masker key derive


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-6
changelog:
  - Fix syntax errors in patch that disables sslv2 tests
  - Resolves: Bug 1297888 - Rebase RHEL 6.8 to NSS 3.21 for Firefox 45


author: Kai Engert <kaie@redhat.com> - 3.21.3-2
changelog:
  - Mozilla #1314604 / Red Hat CVE-2016-8635
  - remove disable_hw_gcm.patch which hasn't been used since 3.16.1


author: Doug Ledford <dledford@redhat.com> - 3.3.12-1
changelog:
  - Generate the opensm.conf file instead of shipping a static one as a source
  - Update to latest upstream release (FDR link speed support)
  - Resolves: bz750609


author: Doug Ledford <dledford@redhat.com> - 3.3.13-1
changelog:
  - Update to latest upstream release
  - Add patch to support specifying subnet_prefix on command lien
  - Update init script to pass unique subnet_prefix's when using the GUID
    method of starting multiple instances
  - Fix up LSB init script headers
  - Resolves: bz754196


author: Doug Ledford <dledford@redhat.com> - 3.3.15-1
changelog:
  - Update to latest upstream source (adds more SRIOV support)
  - Fix init script when no config files are present
  - Related: bz756396


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-105
changelog:
  - Fix ControlPersist option with ProxyCommand (#1160487)
  - Backport fix of ssh-keygen with error : gethostname: File name too long (#1161454)
  - Backport show remote address instead of UNKNOWN after timeout at password prompt (#1161449)
  - Fix printing of extensions in v01 certificates (#1093869)
  - Fix confusing audit trail for unsuccessful logins (#1127312)
  - Don't close fds for internal sftp sessions (#1085710)
  - Fix config parsing quotes (backport) (#1134938)
  - Enable logging in chroot into separate file (#1172224)
  - Fix auditing when using combination of ForcedCommand and PTY (#1131585)
  - Fix ssh-copy-id on non-sh remote shells (#1135521)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-106
changelog:
  - Add missing ControlPersist option to man ssh (#1197763)
  - Add sftp option to force mode of created files (#1191055)
  - Do not load RSA1 keys in FIPS mode (#1197072)
  - Add missing support for ECDSA in ssh-keyscan (#1196331)
  - Fix coverity/gcc issues (#1196063)
  - Backport wildcard functionality for PermitOpen in sshd_config file (#1159055)
  - Ability to specify an arbitrary LDAP filter in ldap.conf (#1119506)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-109
changelog:
  - Fix problems with failing persistent connections (#1131585)
  - Fix memory leaks in auditing patch (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-110
changelog:
  - Fix minor problems found by covscan/gcc (#1196063)
  - Add missing options in man ssh (#1197763)
  - Add KbdInteractiveAuthentication documentation to man sshd_config (#1109251)
  - Correct freeing newkeys structure when privileged monitor exits (#1208584)


author: Tomas Hozza <thozza@redhat.com> - 32:9.8.2-0.43.rc1
changelog:
  - Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1227189)
  - Added the fixed tarball with configuration to Sources (Related: #1223359)


author: Richard Hughes <rhughes@redhat.com> - 0.5.8-14
changelog:
  - When using PackageKit with RHN, do not try to setup from prerepoconf
    twice, to prevent an ugly python backtrace at startup.
  - This is a simple patch backported from Fedora 14.
  - Resolves: #670163


author: Richard Hughes <rhughes@redhat.com> - 0.5.8-15
changelog:
  - Do not emit a critical warning on the console when trying to install
    a local package with PackageKit.
  - This is a simple patch backported from Fedora 14.
  - Resolves: #667923


author: Rich Megginson <rmeggins@redhat.com> - 1.2.10.2-9
changelog:
  - Resolves: Bug 815991 - crash in ldap_initialize with multiple threads
  -  previous fix was still crashing in ldclt


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.10.2-11
changelog:
  - Resolves: Bug 819643 - Database RUV could mismatch the one in changelog under the stress
  - 1.2.10.2-10 was built from the private branch


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.10.2-12
changelog:
  - Resolves: Bug 819643 - Database RUV could mismatch the one in changelog under the stress
  - Resolves: Bug 821542 - letters in object's cn get converted to lowercase when renaming object


author: Rich Megginson <rmeggins@redhat.com> - 1.2.10.2-14
changelog:
  - Resolves: Bug 819643 - Database RUV could mismatch the one in changelog under the stress
  -- patch 0015 fixes a small memleak in previous patch


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.10.2-16
changelog:
  - Resolves: Bug 830001 - unhashed#user#password visible after changing password
  - Resolves: Bug 830256 - Audit log - clear text password in user changes


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.10.2-17
changelog:
  - Resolves: Bug 830001 - unhashed#user#password visible after changing password
  -- patch 0019 fixes deref issue.


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.10.2-18
changelog:
  - Resolves: Bug 830001 - unhashed#user#password visible after changing password
  -- patch 0020 disallows users' direct modify on unhashed#user#password


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Bump to 2.6.13 and u171b01.
  - Update java-1.7.0-openjdk-java-access-bridge-security.patch to apply after 8186080
  - Update RC4 patch (8076221/PR2809) to apply after 8148108 (DH lower limit increase)
  - Fix file path in rh1022017.patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Jeff Law <law@redhat.com> - 2.20.51.0.2-5.38
changelog:
  - Use thread-safe PLT stubs for Power. (#906079)
  - Avoid segfault when arch member uses long names, but no longname
    table exists.  (#909056)
  - Correct patch for 773526. (#922393)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 5.3.3-6
changelog:
  - merge Joe's changes:
  - improve CVE-2011-1466 fix to cover CAL_GREGORIAN, CAL_JEWISH
  - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148,
    CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470,
    CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740732)


author: Joe Orton <jorton@redhat.com> - 5.3.3-11
changelog:
  - add security fixes for CVE-2012-0781, CVE-2011-4153, CVE-2012-0057,
    CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2386


author: Petr Spacek <pspacek redhat com> - 2.3-4
changelog:
  - update-policy with match type 'zonesub' lead to crash (#921167)
  - zones without idnsUpdatePolicy attribute produced error messages (#908780)


author: Petr Spacek <pspacek@redhat.com> - 2.3-7
changelog:
  - fix crash caused by race condition during resolver cache flushing (#1126841)
  - fix ticket expiration check (#1142176)
  - fix idnsAllowTransfer and idnsAllowQuery attributes documentation (#1183805)


author: Petr Machata <pmachata@redhat.com> - 2011l-3
changelog:
  - State of Bahia, Brazil, to resume Summer Time on Oct 16
  - The project moved, reflect this in URL
  - Resolves: #740000


author: Petr Machata <pmachata@redhat.com> - 2011n-1
changelog:
  - Rebase to 2011n
    - Cuba postponed DST by two weeks to Nov 13
    - Fiji will enter DST on Jan 21
  - Add a patch for the leap second that will occur this summer
  - Resolves: #773755


author: Petr Machata <pmachata@redhat.com> - 2011n-2
changelog:
  - The Chilean Government has decided to postpone the entrance into
    winter time (to leave DST) from March 11 2012 to April 28th 2012
  - Resolves: #796569


author: Petr Machata <pmachata@redhat.com> - 2012b-1
changelog:
  - Rebase to 2012b; changes vs. 2011n-2:
    - Changes to zones for Antarctica stations
    - Armenia abolished DST in 2012 and forward
    - Cuba enters DST on 31st March
    - Falkland Islands will stay on permanent Summer Time
    - New zone for Creston Valley, Canada, which differs from Dawson
      Creek in past stamps.  Changes to historical stamps in Canada.
    - Last year, Tokelau skipped over the date line together with Samoa
  - Resolves: #802460


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-7
changelog:
  - Use alternatives to support other iptables versions for MRG kernels
    (rhbz#747068)
  - Restore sysctl values on service restart (rhbz#800208)
  - Added fallback support in case of error in service start (rhbz#808272)
  - Added AUDIT targets to to man pages (rhbz#809108)
  - Fixed maximum chain name length (rhbz#821441)
  - Added missing dependency for poliycoreutils package (rhbz#836286)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-9
changelog:
  - make alternatives names arch dependant for multilib (rhbz#860148)
  - added virtual provides for base libraries to be able to resolve library file requires


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-10
changelog:
  - New reload action for ip*tables services (rhbz#928812)
    It tries to reload the firewall rules from /etc/sysconfig/ip*tables. If this
    failes, it does not load the fallbacks and the old firewall rules are still
    there.
  - Use /lib*/xtables without version and not linked by alternatives again for 
    compatibility to older versions (rhbz#924362)
    The symlink for /lib*/xtables with the previous version will be cleaned up
    in a pre script.
  - Backport of --queue-bypass (rhbz#845435)
    Thanks to Florian Westphal and kay
  - Make ip*tables-save consistent to man page (rhbz#983198)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-11
changelog:
  - fixed shutdown hang if root filesystem is network based (rhbz#1007632)
    Thanks to Rodrigo A B Freire for the patch


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-12
changelog:
  - added ip6t_set (rhbz#1033270)
  - do not block uninstall on a failing alternatives --remove call in preun
    (rhbz#1059214) (rhbz#1070123)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-15
changelog:
  - Add message for init script error returns (rhbz#1081191)
  - Fix rule deletion of ipset matches (rhbz#1081422)
  - Add space after dccp types (rhbz#1084974)
  - Add -C option to check for existing rules (rhbz#1088361)
  - Copy custom plugins for updates from iptables < 1.4.7-10 (rhbz#1088400)
  - Enable the IPv6 set target (rhbz#1161330)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-16
changelog:
  - Fixed ressource leak in libiptc found by coverity (rhbz#1088361)
  - Copy custom plugins also for releases up to 14 (rhbz#1088400)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-15
changelog:
  - New upstream bugfix release 1.2.1
  - Resolves: rhbz#601770 - SSSD in RHEL 6.0 should ship with zero open Coverity
  -                         bugs.
  - Resolves: rhbz#603041 - Remove unnecessary option krb5_changepw_principal
  - Resolves: rhbz#604704 - authconfig should provide error with no trace back
  -                         if disabling sssd when sssd is not enabled
  - Resolves: rhbz#591873 - Connecting to the network after an offline kerberos
  -                         auth logs continuous error messages to sssd_ldap.log
  - Resolves: rhbz#596295 - Authentication fails for user from the second domain
  -                         when the same user name is filtered out from the
  -                         first domain
  - Related:  rhbz#598559 - Update translation files for SSSD before RHEL 6
  -                         final


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-19
changelog:
  - Resolves: rhbz#606836 - libcollection needs an soname bump before RHEL 6
  -                         final
  - Resolves: rhbz#608661 - SASL with OpenLDAP server fails
  - Resolves: rhbz#608688 - SSSD doesn't properly request RootDSE attributes


author: David Knox <dknox@redhat.com> 0:6.0.24-54
changelog:
  - Resolves: rhbz#956771 Related: CVE-2012-3439 digest 
  - authentication broken after errata for cve-2012-3439
  - patch for 3439 corrected


author: David Knox <dknox@redhat.com> 0:6.0.24-55
changelog:
  - Related: rhbz#955976 CVE-2013-1976. Changed log location
  - so only root can use it. Touching TOMCAT_LOG is no longer
  - required


author: Hans de Goede <hdegoede@redhat.com> - 0.6.3-2
changelog:
  - Add utf8 controller menu text patch from upstream git
  - Add smartcard channel patch from upstream git


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-4.b17
changelog:
  - Add flag logic back to spec file but disable for now.
  - Restore system-lcms.patch as used in October CPU.
  - Resolves: rhbz#1295751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-0.b15
changelog:
  - January 2016 security update to u71b15.
  - Improve verbosity and helpfulness of tarball generation script.
  - Update patch documentation using version originally written for Fedora.
  - Drop prelink requirement as we no longer use execstack.
  - Drop ifdefbugfix patch as this is fixed upstream.
  - Provide optional boostrap build and turn it off by default.
  - Add patch for size_t formatting on s390 as size_t != intptr_t there.
  - Resolves: rhbz#1295751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
  - Resolves: rhbz#1295751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-0.b03
changelog:
  - Update to u77b03.
  - Drop 8146566 which is applied upstream.
  - Replace s390 Java options patch with general version from IcedTea.
  - Apply s390 patches unconditionally to avoid arch-specific patch failures.
  - Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
  - Remove aarch64-specific suffix as update/build version are now the same as for other archs.
  - Only use z format specifier on s390, not s390x.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Correct spelling mistakes in tarball generation script.
  - Synchronise minor changes from Fedora.
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.
  - Resolves: rhbz#1320661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-0.b03
changelog:
  - Remove what remains of the SunEC sources in the remove-intree-libraries script.
  - Resolves: rhbz#1320661


author: Ray Strode <rstrode@redhat.com> 0.8.3-27.1
changelog:
  - use tcsetattr(...TCSANOW...) instead of tcsetattr(...TCSAFLUSH...)
    to work around a kernel bug leading to blocked boot.
    Resolves: #1125325


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.13.1.el6]
changelog:
  - [net] sctp: Implement quick failover draft from tsvwg (Neil Horman) [861953 830716]
  - [net] sctp: be more restrictive in transport selection on bundled sacks (Neil Horman) [861953 830716]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.14.1.el6]
changelog:
  - [usb] usbhid: Fix use-after-free in USBHID (James Paradis) [864827 857518]
  - [usb] Add kernel parameter to force io_watchdog for Intel EHCI HCD (James Paradis) [865713 846024]
  - [block] Fix hanging kernel threads in blk_execute_rq() (James Paradis) [865308 855984]
  - [mm] hugetlb: do not use vma_hugecache_offset() for vma_prio_tree_foreach (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
  - [mm] hugepages: fix use after free bug in "quota" handling (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
  - [mm] hugetlb: fix pgoff computation when unmapping page from vma (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
  - [mm] hugetlb: fix ENOSPC returned by handle_mm_fault() (Frederic Weisbecker) [843034 843035] {CVE-2012-2133}
  - [fs] gfs2: Write out dirty inode metadata in delayed deletes (Frantisek Hrbata) [859326 748827]
  - [usb] core: Fix device removal race condition (James Paradis) [864821 849188]
  - [mm] x86_32: fix SHLIB_BASE address typo (Aristeu S. Rozanski F) [804955 804956] {CVE-2012-1568}
  - [hid] hidraw: fix window in hidraw_release (Don Zickus) [841824 839973]
  - [hid] hidraw: protect hidraw_disconnect() better (Don Zickus) [841824 839973]
  - [hid] hidraw: remove excessive _EMERG messages from hidraw (Don Zickus) [841824 839973]
  - [hid] hidraw: fix hidraw_disconnect() (Don Zickus) [841824 839973]
  - [hid] fix a NULL pointer dereference in hidraw_write (Don Zickus) [841824 839973]
  - [hid] fix a NULL pointer dereference in hidraw_ioctl (Don Zickus) [841824 839973]
  - [hid] remove BKL from hidraw (Don Zickus) [841824 839973]
  - [mm] x86_32: randomize SHLIB_BASE (Aristeu Rozanski) [804955 804956] {CVE-2012-1568}
  - [block] fix up use after free in __blkdev_get (Jeff Moyer) [853943 847838]
  - [scsi] remove no longer valid BUG_ON in scsi_lld_busy (Jeff Garzik) [860640 842881]
  - [scsi] fix NULL request_queue in scsi_requeue_run_queue() (Jeff Garzik) [860640 842881]
  - [net] svcrpc: fix BUG() in svc_tcp_clear_pages (J. Bruce Fields) [856106 769045]
  - [scsi] lpfc: Fixed SCSI device reset escalation (Rob Evers) [861390 827566]
  - [scsi] lpfc: Fix abort status (Rob Evers) [861390 827566]
  - [kernel] cgroup: add cgroup_root_mutex (Frederic Weisbecker) [858954 844531]
  - [mm] Hold a file reference in madvise_remove (Jerome Marchand) [849738 849739] {CVE-2012-3511}
  - [base] driver-core: fix device_register race (Rob Evers) [860784 833098]
  - [netdrv] e1000e: drop check of RXCW.CW to eliminate link going up and down (Dean Nelson) [857055 847310]
  - [scsi] be2iscsi: Format the MAC_ADDR with sysfs (Rob Evers) [863147 827594]
  - [usb] usbdevfs: Add a USBDEVFS_GET_CAPABILITIES ioctl (Don Zickus) [841667 828271]
  - [fs] udf: fix retun value on error path in udf_load_logicalvol (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
  - [fs] udf: Improve table length check to avoid possible overflow (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
  - [fs] udf: Fortify loading of sparing table (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
  - [fs] udf: Avoid run away loop when partition table length is corrupted (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
  - [fs] udf: Use 'ret' instead of abusing 'i' in udf_load_logicalvol() (Nikola Pajkovsky) [843142 843143] {CVE-2012-3400}
  - [netdrv] bnx2x: Add remote-fault link detection (Michal Schmidt) [852450 814877]
  - [net] sunrpc: svc_xprt sends on closed socket should stop immediately (J. Bruce Fields) [853257 849702]
  - [mm] Never OOM kill tasks outside of memory cgroup when memory.limit_in_bytes is exceeded by a Transparent Huge Page (Larry Woodman) [860942 811255]
  - [powerpc] pseries: Support lower minimum entitlement for virtual processors (Steve Best) [860165 822651]
  - [usbhid] hiddev: Consolidate device existence checks in hiddev_ioctl (Don Zickus) [841824 839973]
  - [usbhid] hiddev: Fix race between disconnect and hiddev_ioctl (Don Zickus) [841824 839973]
  - [usbhid] hiddev: protect against disconnect/NULL-dereference race (Don Zickus) [841824 839973]
  - [crypto] algapi: Move larval completion into algboss (Herbert Xu) [854476 832135]
  - [fs] xfs: disable xfsaild idle mode (Brian Foster) [860787 813137]
  - [fs] xfs: fix the logspace waiting algorithm (Brian Foster) [860787 813137]
  - [fs] xfs: add AIL pushing tracepoints (Brian Foster) [860787 813137]
  - [fs] xfs: force the log if we encounter pinned buffers in .iop_pushbuf (Brian Foster) [860787 813137]
  - [fs] xfs: do not update xa_last_pushed_lsn for locked items (Brian Foster) [860787 813137]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.17.1.el6]
changelog:
  - [mm] Prevent kernel panic in NUMA related system calls after memory hot-add (Larry Woodman) [875382 870350] {CVE-2012-5517}
  - [md] Don't truncate size at 4TB for RAID0 and Linear (Jes Sorensen) [866470 865637]
  - [fs] ext4: fix undefined bit shift result in ext4_fill_flex_info (Lukas Czerner) [809690 809691] {CVE-2012-2100}
  - [fs] ext4: fix undefined behavior in ext4_fill_flex_info() (Lukas Czerner) [809690 809691] {CVE-2012-2100}
  - [kernel] sched_rt: Ignore RT queue throttling if idle task has RT policy (Igor Mammedov) [853950 843541]
  - [kernel] sched: Create special class for stop/migrate work (Igor Mammedov) [853950 843541]
  - [net] ipv6: fix overlap check for fragments (Amerigo Wang) [874550 819952] {CVE-2012-4444}
  - [net] ipv6: discard overlapping fragment (Jiri Pirko) [874550 819952] {CVE-2012-4444}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.18.1.el6]
changelog:
  - [scsi] sd: fix crash when UA received on DIF enabled device (Ewan Milne) [876487 865682]
  - [mm] hugetlb: fix non-atomic enqueue of huge page (Rafael Aquini) [876101 869750]
  - [x86] amd_iommu: attach device fails on the last pci device (Don Dutile) [876493 861164]
  - [net] nfs: Fix buffer overflow checking in __nfs4_get_acl_uncached (Frantisek Hrbata) [811794 822871] {CVE-2012-2375}
  - [net] nfs: Fix the acl cache size calculation (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] nfs: Fix range checking in __nfs4_get_acl_uncached and __nfs4_proc_set_acl (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] nfs: nfs_getaclargs.acl_len is a size_t (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] nfs: Don't use private xdr_stream fields in decode_getacl (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] nfs: Fix pointer arithmetic in decode_getacl (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] nfs: Simplify the GETATTR attribute length calculation (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] sunrpc: Add the helper xdr_stream_pos (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] sunrpc: Don't decode beyond the end of the RPC reply message (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] sunrpc: Clean up xdr_set_iov() (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [net] sunrpc: xdr_read_pages needs to clear xdr->page_ptr (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [fs] nfs: Avoid beyond bounds copy while caching ACL (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [fs] nfs: Avoid reading past buffer when calling GETACL (Sachin Prabhu) [811794 822871] {CVE-2012-2375}
  - [scsi] ibmvfc: Fix double completion on abort timeout (Steve Best) [876088 865115]
  - [net] core: allocate skbs on local node (Andy Gospodarek) [876491 843163]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.19.1.el6]
changelog:
  - [drm] i915: don't clobber the pipe param in sanitize_modesetting (Frantisek Hrbata) [876549 857792]
  - [drm] i915: Sanitize BIOS debugging bits from PIPECONF (Frantisek Hrbata) [876549 857792]
  - [net] fix divide by zero in tcp algorithm illinois (Flavio Leitner) [871920 866514] {CVE-2012-4565}
  - [fs] xfs: fix reading of wrapped log data (Dave Chinner) [876499 874322]
  - [x86] mm: fix signedness issue in mmap_rnd() (Petr Matousek) [876496 875036]
  - [net] WARN if struct ip_options was allocated directly by kmalloc (Jiri Pirko) [877950 872799]
  - [fs] block_dev: Fix crash when block device is read and block size is changed at the same time (Frantisek Hrbata) [864826 855906]
  - [mm] tracing: Move include of trace/events/kmem.h out of header into slab.c (Jeff Moyer) [864826 855906]
  - [mm] slab: Move kmalloc tracepoint out of inline code (Jeff Moyer) [864826 855906]
  - [netdrv] bnx2x: organize BDs calculation for stop/resume (Frantisek Hrbata) [874022 819842]
  - [netdrv] bnx2x: fix panic when TX ring is full (Michal Schmidt) [874022 819842]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.20.1.el6]
changelog:
  - [scsi] hpsa: Use LUN reset instead of target reset (Tomas Henzl) [884422 875091]
  - [char] tty: Fix possible race in n_tty_read() (Stanislaw Gruszka) [891580 765665]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.21.1.el6]
changelog:
  - [scsi] mpt2sas: fix for driver fails EEH recovery from injected pci bus error (Tomas Henzl) [888818 829149]
  - [net] bonding: Bonding driver does not consider the gso_max_size setting of slave devices (Ivan Vecera) [886618 883643]
  - [netdrv] tg3: Do not set TSS for 5719 and 5720 (John Feeney) [888215 823371]
  - [kernel] kmod: make __request_module() killable (Oleg Nesterov) [858755 819529] {CVE-2012-4398}
  - [kernel] kmod: introduce call_modprobe() helper (Oleg Nesterov) [858755 819529] {CVE-2012-4398}
  - [kernel] usermodehelper: implement UMH_KILLABLE (Oleg Nesterov) [858755 819529] {CVE-2012-4398}
  - [kernel] usermodehelper: introduce umh_complete(sub_info) (Oleg Nesterov) [858755 819529] {CVE-2012-4398}
  - [kernel] call_usermodehelper: simplify/fix UMH_NO_WAIT case (Oleg Nesterov) [858755 819529] {CVE-2012-4398}
  - [kernel] wait_for_helper: SIGCHLD from user-space can lead to use-after-free (Oleg Nesterov) [858755 819529] {CVE-2012-4398}
  - [net] sunrpc: Ensure that rpc_release_resources_task() can be called twice (Jeff Layton) [880928 878204]
  - [scsi] qla2xxx: Don't toggle RISC interrupt bits after IRQ lines are attached. (Chad Dupuis) [886760 826565]
  - [kernel] rcu: Remove function versions of __kfree_rcu and offset (Doug Ledford) [880085 873949]
  - [kernel] rcu: define __rcu address space modifier for sparse (Doug Ledford) [880085 873949]
  - [kernel] rcu: Add rcu_access_pointer and rcu_dereference_protected (Doug Ledford) [880085 873949]
  - [kernel] rcu: Add lockdep checking to rhel (Doug Ledford) [880085 873949]
  - [kernel] rcu: Make __kfree_rcu() less dependent on compiler choices (Doug Ledford) [880085 873949]
  - [kernel] rcu: introduce kfree_rcu() (Doug Ledford) [880085 873949]
  - [net] rcu: add __rcu API for later sparse checking (Doug Ledford) [880085 873949]
  - [infiniband] ipoib: Fix AB-BA deadlock when deleting neighbours (Doug Ledford) [880085 873949]
  - [infiniband] ipoib: Fix memory leak in the neigh table deletion flow (Doug Ledford) [880085 873949]
  - [infiniband] ipoib: Fix RCU pointer dereference of wrong object (Doug Ledford) [880085 873949]
  - [misc] Make rcu_dereference_bh work (Doug Ledford) [880085 873949]
  - [infiniband] ipoib: Use a private hash table for path lookup in xmit path (Doug Ledford) [880085 873949]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-279.22.1.el6]
changelog:
  - [virt] kvm: invalid opcode oops on SET_SREGS with OSXSAVE bit set (Petr Matousek) [862903 862904] {CVE-2012-4461}
  - [fs] fuse: optimize __fuse_direct_io() (Brian Foster) [865305 858850]
  - [fs] fuse: optimize fuse_get_user_pages() (Brian Foster) [865305 858850]
  - [fs] fuse: use get_user_pages_fast() (Brian Foster) [865305 858850]
  - [fs] fuse: pass iov[] to fuse_get_user_pages() (Brian Foster) [865305 858850]
  - [fs] mm: minor cleanup of iov_iter_single_seg_count() (Brian Foster) [865305 858850]
  - [fs] fuse: use req->page_descs[] for argpages cases (Brian Foster) [865305 858850]
  - [fs] fuse: add per-page descriptor <offset, length> to fuse_req (Brian Foster) [865305 858850]
  - [fs] fuse: rework fuse_do_ioctl() (Brian Foster) [865305 858850]
  - [fs] fuse: rework fuse_perform_write() (Brian Foster) [865305 858850]
  - [fs] fuse: rework fuse_readpages() (Brian Foster) [865305 858850]
  - [fs] fuse: categorize fuse_get_req() (Brian Foster) [865305 858850]
  - [fs] fuse: general infrastructure for pages[] of variable size (Brian Foster) [865305 858850]
  - [fs] exec: do not leave bprm->interp on stack (Josh Poimboeuf) [880145 880146] {CVE-2012-4530}
  - [fs] exec: use -ELOOP for max recursion depth (Josh Poimboeuf) [880145 880146] {CVE-2012-4530}
  - [scsi] have scsi_internal_device_unblock take new state (Frantisek Hrbata) [878774 854140]
  - [scsi] add new SDEV_TRANSPORT_OFFLINE state (Chris Leech) [878774 854140]
  - [kernel] cpu: fix cpu_chain section mismatch (Frederic Weisbecker) [876090 852148]
  - [kernel] sched: Don't modify cpusets during suspend/resume (Frederic Weisbecker) [876090 852148]
  - [kernel] sched, cpuset: Drop __cpuexit from cpu hotplug callbacks (Frederic Weisbecker) [876090 852148]
  - [kernel] sched: adjust when cpu_active and cpuset configurations are updated during cpu on/offlining (Frantisek Hrbata) [876090 852148]
  - [kernel] cpu: return better errno on cpu hotplug failure (Frederic Weisbecker) [876090 852148]
  - [kernel] cpu: introduce cpu_notify(), __cpu_notify(), cpu_notify_nofail() (Frederic Weisbecker) [876090 852148]
  - [fs] nfs: Properly handle the case where the delegation is revoked (Steve Dickson) [846840 842435]
  - [fs] nfs: Move cl_delegations to the nfs_server struct (Steve Dickson) [846840 842435]
  - [fs] nfs: Introduce nfs_detach_delegations() (Steve Dickson) [846840 842435]
  - [fs] nfs: Fix a number of RCU issues in the NFSv4 delegation code (Steve Dickson) [846840 842435]


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-1
changelog:
  - 'pki-common'
  -     Bugzilla Bug #674894 - ipactl restart : an annoy output line
  -     Bugzilla Bug #675179 - ipactl restart : an annoy output line


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-2
changelog:
  - 'pki-common'
  -     Bugzilla Bug #676051 - IPA installation failing - Fails to create CA
        instance
  -     Bugzilla Bug #676182 - IPA installation failing - Fails to create CA
        instance


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-3
changelog:
  - Resolves #676873 - Rebase pki-core again to pick the latest features and fixes
  -     Resolves #676048 - Installation within IPA hangs, r1846
  -     Resolves #679173 - uninitialized variable warnings from Perl, r1860
  -     Resolves #679174 - netstat loop fixes needed, r1862
  -     Resolves #679580 - Velocity fails to load all dependent classes, r1864


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-8
changelog:
  - Resolves 645097 
  - Resolves #683172 - pkisilent needs to provide option to set
    nsDS5ReplicaTransportInfo to TLS in replication agreements
    when creating a clone, r1886


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-10
changelog:
  - Resolves #688251 - Dogtag installation under IPA takes too much
    time - SELinux policy compilation, r1908


author: Václav Pavlín <vpavlin@redhat.com> - 9.03.34-1
changelog:
  - there should be crypttab instead of crypptab in man page (#870025)
  - sysconfig.txt advised saslauthd -a instad of -v (#869075)


author: John Dennis <jdennis@redhat.com> - 2.1.10-5
changelog:
  - Resolves: #689045 Using rlm_perl cause radiusd failed to start
    Fix configure typo which caused lt_dladvise_* functions to be skipped.
    run autogen.sh because HAVE_LT_DLADVISE_INIT isn't in src/main/autogen.h
    Implemented by: freeradius-lt-dladvise.patch


author: John Dennis <jdennis@redhat.com> - 2.1.12-1
changelog:
  - Upgrade to latest upstream release: 2.1.12
    resolves: bug#736878 Rebase to latest upstream
    resolves: bug#705723 logrotate script does not reload running daemon
    resolves: bug#787116 radtest PPPhint option not parsed correctly
    resolves: bug#700870 freeradius not compiled with --with-udpfromto
    resolves: bug#753764 shadow password expiration does not work
    resolves: bug#712803 radtest script is not working with eap-md5 option
    resolves: bug#690756 errors in raddb/sql/postgresql/admin.sql template


author: John Dennis <jdennis@redhat.com> - 2.1.12-4
changelog:
  - resolves: bug#855317
    CVE-2012-3547 freeradius: Stack-based buffer overflow by processing
    certain expiration date fields of a certificate during x509 certificate
    validation


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.1.12-5
changelog:
  - Add support for microsecond precision of home server's response_window
    option, client's response_window option with the same precision and home
    server's response_timeouts option, backported from v3.0.x.
  - Resolves: bug#1107843


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.1.12-6
changelog:
  - Fix missing braces around a condition branch in client response_window
    patch.
  - Resolves: bug#1107843


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-1
changelog:
  - Upgrade to the latest upstream release v2.2.6
    Resolves: Bug#921563  raddebug not working correctly
    Resolves: Bug#921567  raddebug -t 0 exists immediately
    Resolves: Bug#1060319 MSCHAP Authentication is not working using automatic
                          windows user credentials
    Resolves: Bug#1078736 Rebase FreeRADIUS to 2.2.4
    Resolves: Bug#1135439 Default message digest defaults to sha1
    Resolves: Bug#1142669 EAP-TLS and OCSP validation causing segmentation
                          fault
    Resolves: Bug#1173388 dictionary.mikrotik missing Attributes
  - Remove radutmp rotation
    Resolves: Bug#904578  radutmp should not rotate
  - Check for start_servers not exceeding max_servers
    Resolves: Bug#1146828 radiusd silently fails when start_servers is higher
                          than max_servers


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-4
changelog:
  - Move OpenSSL init out of version check
    Resolves: Bug#1189394 radiusd segfaults after update
  - Comment-out ippool-dhcp.conf inclusion
    Resolves: Bug#1189386 radiusd fails to start after 'clean' installation


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.58.1.11.10
changelog:
  - Updated to icedtea6 1.11.10
  - rewritten java-1.6.0-openjdk-java-access-bridge-security.patch
  - excluded aarch64.patch
    - by patch 8 -  removingOfAarch64.patch.patch
  - Resolves: rhbz#950387


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.59.1.11.11
changelog:
  - Updated to icedtea6 1.11.11 - fixed xalan/xerxes privledges
  - removed patch 8 -  removingOfAarch64.patch.patch - fixed upstream
  - Resolves: rhbz#950387


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.60.1.11.11
changelog:
  - added and applied (temporally) one more patch to xalan/xerces privileges
   - patch9 jaxp-backport-factoryfinder.patch
  - will be upstreamed
  - Resolves: rhbz#950387


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950387


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.62.1.11.11.90
changelog:
  - updated to icedtea6-1.11.11.90.tar.gz
  - removed upstreamed patch9 jaxp-backport-factoryfinder.patch
  - removed upstreamed patch10 fixToFontSecurityFix.patch.
  - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#973130


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.63.1.11.11.90
changelog:
  - added patch100  8000791-regression-fix.patch
  - bumped release
  - updated to icedtea-1.11.12
  - Resolves: rhbz#976897
  - Resolves: rhbz#983411


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.63.1.11.13
changelog:
  - removed upstreamed  patch100  8000791-regression-fix.patch
  - bumped release
  - updated to icedtea-1.11.13
  - Resolves: rhbz#983411


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-1.66.1.13.0
changelog:
  - updated to icedtea 1.13
  - updated to openjdk-6-src-b28-04_oct_2013
  - added --disable-lcms2 configure switch to fix tck
  - removed upstreamed patch7,java-1.6.0-openjdk-jstack.patch
  - added patch7 1.13_fixes.patch to fix 1.13 build issues
  - adapted patch0 java-1.6.0-openjdk-optflags.patch
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - adapted patch8 java-1.6.0-openjdk-timezone-id.patch
  - removed useless runtests parts
  - included also java.security.old files
  - Resolves: rhbz#1017621


author: Lukáš Nykrýn <lnykryn@redhat.com> - 004-411
changelog:
  - fcoe: Allow more time for the bnx2x link negotiation before brining up fcoe interfaces.
  Resolves: rhbz#1482185


author: Nikola Forró <nforro@redhat.com> - 3.9.4-14
changelog:
  - Merge previously released fixes for CVEs:
  - CVE-2013-1960 CVE-2013-1961 CVE-2013-4231
  - CVE-2013-4232 CVE-2013-4243 CVE-2013-4244
  - Resolves: #1335099


author: Nikola Forró <nforro@redhat.com> - 3.9.4-16
changelog:
  - Add patches for CVEs:
  - CVE-2016-3632 CVE-2016-3945 CVE-2016-3990
  - CVE-2016-3991 CVE-2016-5320
  - Related: #1335099


author: Nikola Forró <nforro@redhat.com> - 3.9.4-19
changelog:
  - Add patches for CVEs:
  - CVE-2016-9533 CVE-2016-9534 CVE-2016-9535
  - CVE-2016-9536 CVE-2016-9537 CVE-2016-9540
  - CVE-2016-5652
  - Resolves: #1412078


author: Peter Hutterer <peter.hutterer@redhat.com> 7.5-1
changelog:
  - iceauth 1.0.4
  - rgb 1.0.4
  - xhost 1.0.4
  - xmodmap 1.0.5
  - xrandr 1.3.4
  - xsetroot 1.1.0
  - xstdcmap 1.0.2


author: Ted Ross <tross@redhat.com> - 0.12-2
changelog:
  - Related:rhbz#663461 - Enable new architectures
  - Remove python-qpid-qmf and ruby-qpid-qmf from ppc and s390 architectures


author: Ted Ross <tross@redhat.com> - 0.12-4
changelog:
  - Related:rhbz#681680 - QMF agents wake up several times a second
  - Related:rhbz#699499 - [RFE] qmfv2 must provide mainloop integration


author: Adam Jackson <ajax@redhat.com> 7.11-2
changelog:
  - mesa-7.11-b9c7773e.patch: Sync with 7.11 branch
  - mesa-7.11-gen6-depth-stalls.patch: Fix GPU hangs on gen6+ in openarena
    and others (#741806)
  - Drop tdfx_dri.so, as there's no glide3 package or drm support in el6.


author: Matthias Schroder <Matthias.Schroder@cern.ch> 7.11-5.slc6
changelog:
  - Add fix for non-mesa-glx-extensions. This is the patch for
    63a6fd6603574c1c01324fbeb0863e39d3864c16 (#820746, RQF0139456)


author: Jakub Jelinek <jakub@redhat.com> 4.4.5-4
changelog:
  - ppc64 -mcmodel={medium,large} support (#630166)
  - reserve outgoing parameter save area on ppc64 if there
    is just __tls_get_addr call (#624889)
  - optimize/target attribute fix (#659582)


author: Deepak Bhole <dbhole@redhat.com> 1.6.0.0-1.18.b16
changelog:
  - Build only on x86 and x86_64
  - Added STRIP_KEEP_SYMTAB=libjvm* to install section, fix bz530402
  - Added java-1.6.0-openjdk-jar-misc.patch
  - Added java-1.6.0-openjdk-linux-separate-debuginfo.patch to separate debuginfo
  - Added patch for March 2010 security issues (java-1.6.0-openjdk-securitypatches-20100323.patch)


author: Martin Matejovic <mmatejov@redhat.com> - 1.6.0.0-1.19.b17
changelog:
  - Added icedtea6-1.7.3
  - Added openjdk b17
  - Enabled NPPlugin
  - Removed Files:
      java-1.6.0-openjdk-icedtea-gcc-stack-markings.patch
      java-1.6.0-openjdk-jar-misc.patch
      java-1.6.0-openjdk-linux-separate-debuginfo.patch
      java-1.6.0-openjdk-memory-barriers.patch
      java-1.6.0-openjdk-rhino-rewrite.patch
      java-1.6.0-openjdk-s390-optimizer-failure.patch
      java-1.6.0-openjdk-s390-serializer.patch
      java-1.6.0-openjdk-systemtap-fixes-jni-jstack.patch
      java-1.6.0-openjdk-x11.patch
  - Resolves: rhbz#593135
  - Resolves: rhbz#572675


author: Martin Matejovic <mmatejov@redhat.com> - 1.6.0.0-1.20.b17
changelog:
  - Fixed brew build for i686
  - Removed Files:
      java-1.6.0-openjdk-securitypatches-20091103.patch
      java-1.6.0-openjdk-securitypatches-20100323.patch
      java-1.6.0-openjdk-sparc-fixes.patch
      java-1.6.0-openjdk-sparc-hotspot.patch


author: Deepak Bhole <dbhole@redhat.com> - 1.6.0.0-1.21.b17
changelog:
  - Updated to IcedTea 1.7.4
  - Resolves: rhbz#537121
  - Resolves: rhbz#612467
  - Resolves: rhbz#613824
  - Additionally, fixed rh bugs 616893 and 616895


author: Jiri Vanek <jvanek@redhat.com> - 1.6.0.0-1.33.b17
changelog:
  - bumped release number, it was accidentaly reduced, and now lower version then last one was released.
  - Resolves: rhbz#676295


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-44.P1
changelog:
  - option 97 - pxe-client-id (#1058674)
  - dhclient-script: PREINIT6: make sure link-local address is available (#1130804)
  - dhcpd generates spurious responses when seeing requests
    from vlans on plain interface (#1150587)


author: Tom Lane <tgl@redhat.com> 5.1.67-1
changelog:
  - Update to 5.1.67, for assorted upstream bugfixes including
    CVEs announced in January 2013
  Resolves: #901381


author: Tom Lane <tgl@redhat.com> 5.1.69-1
changelog:
  - Update to 5.1.69, for assorted upstream bugfixes including
    CVEs announced in April 2013
  Resolves: #953085


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #990796, #842052
  - Fix mysqldump failure against MySQL 5.0.x server due missing tables
    Resolves: #877557
  - Add logrotate script
    Resolves: #904061
  - Fix init script to not show failed on start even when server started
    Resolves: #884651


author: Honza Horak <hhorak@redhat.com> 5.1.71-1
changelog:
  - Update to MySQL 5.1.71, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-71.html
    Resolves: #990796


author: Jakub Dorňák <jdornak@redhat.com> - 5.1.73-1
changelog:
  - Update to MySQL 5.1.73, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-73.html
    (CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2014-0393,
    CVE-2014-0386, CVE-2014-0401, CVE-2014-0402)
    Resolves: #1055882


author: Honza Horak <hhorak@redhat.com> 5.1.73-2
changelog:
  - Make mysqld init script more robust and ignore existing but
    non-being-used unix socket file
    Resolves: #1037650


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-12
changelog:
  - add character sequence test to pam_cracklib
  - drop unused difignore option from pam_cracklib (#811243)
  - add enforce_for_root option to pam_cracklib (#588893)
  - mention limits.d in the limits.conf(5) manpage (#723297)
  - add ability to lock out inactive accounts to pam_lastlog
  - fix require_selinux option in pam_namespace (#750601)
  - add mntopts flag for tmpfs polyinstantiation method
  - preserve authtok_type in pam_get_authtok() (#811168)
  - fix username mismatch in pam_unix remember feature (#815516)
  - relax restriction of root in pam_pwhistory
  - relax soft nproc limit for root in 90-nproc.conf


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-18
changelog:
  - pam_cracklib: improve documentation (#889233)
  - unbreak authentication if ld.so.preload is not empty
  - correct off by one error in account expiration calculation (#947011)
  - pam_console_apply: do not print error if console.perms.d is empty
  - properly handle all cases where crypt() might return NULL (#1026203)
  - pam_limits: clarify documentation of maxsyslogins limit (#1028490)
  - pam_access: call DNS resolution only when necessary and cache
    results (#1029817)
  - pam_limits: nofile applies to file descriptors not files (#1040664)
  - pam_limits: check whether the utmp login entry is valid (#1054936)
  - correct URLs in spec file (#1071770)
  - pam_userdb: correct the example in man page (#1078779)
  - pam_selinux: canonicalize username for getseuser() (#1083981)
  - pam_access: fix netgroup matching and @user@@netgroup parsing (#740233)


author: Stepan Kasal <skasal@redhat.com> - 1.2.3-21
changelog:
  - consolidate the autoconfiscation patches into one and clean it up
  - consequently, clean up the %build and %install sections
  - zconf.h includes unistd.h again (#479133)


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 3.1.7-7
changelog:
  - Fix double free in free_wstr (#648906)
  - Prevent overflows by increasing YYMAXDEPTH and YYSTACKSIZE
    byacc/bison parameters (#743343)
  - Preserve argv by copying the strings (#740673)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-12
changelog:
  - Add a zero default value to the DISABLETEST and TEST_FAILURES checks
  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-13
changelog:
  - Add zero default value to DISABLETEST check and fix the TEST_FAILURES check and reporting
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-14
changelog:
  - Add s390x and ia64 to the %define multilib_arches list used for defining alt_ckbi
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-15
changelog:
  - Using export NSS_DISABLE_HW_GCM=1 to deal with some problemmatic build systems
  - Resolves: rhbz#1016044 - nss.s390: primary link for libnssckbi.so must be /usr/lib64/libnssckbi.so


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Enable patch with fix for deadlock in trust domain lock and object lock
  - Resolves: Bug 1036477 - deadlock in trust domain lock and object lock
  - Disable hw gcm on rhel-5 based build environments where OS lacks support
  - Rollback changes to build nss without softokn until Bug 689919 is approved
  - Cipher suite was run as part of the nss-softokn build


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-6
changelog:
  - Make pem's derEncodingsMatch function work with encrypted keys
  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted client key ends up with SSL_ERROR_TOKEN_INSERTION_REMOVAL


author: William Cohen <wcohen@redhat.com> - 5.1.1-1
changelog:
  - Rebase to 5.1.1 for:
    - rhbz726798: Support for Sandy Bridge in PAPI
    - rhbz785258: FP event on Sandy Bridge when HT enabled
    - rhbz743648: Support for access to various energy and perf registers via papi 
    - rhbz831751: Ivy Bridge: support PAPI 
    - rhbz740909: Allow parallel builds
    - rhbz785975: Correct use of apostrophes in PAPI documentation


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-10
changelog:
  - updated 'delloem setled' command to indicate SES status and drive
    activities for a PCI-e SSD (#727314)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-10
changelog:
  - added -Y option for ipmitool to hide Kg key from cmdline (#698647)
  - added 'channel setkg' command to set Kg encryption key on remote machine
    (#726390)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-11
changelog:
  - fixed delloem powermonitor on bigendian systems (#731718)
  - fixed memory leak in Serial-over-Lan module (#731977)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-13
changelog:
  - added new options to configure retransmissions on lan/lanplus interfaces
    (#748073)
  - updated dellem command (#739358)
  - fixed exit code of ipmitool -o list (#715615)
  - improved checking of command line arguments (#725993)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.16.31-1
changelog:
  - Rebase to libguestfs 1.16.31.
  - Backport mount-local feature.
    resolves: rhbz#830135
  - Include copy-patches.sh shell script.
  - Simplify .gitignore.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.16.31-3
changelog:
  - Add dependency on fuse.
    resolves: rhbz#836501
  - Clarify the error message from resize2fs-M.
    resolves: rhbz#801640
  - Increase limit on size of Windows registry for inspection (RHBZ#852396).
  - Change virt-sparsify to work with old 'file' command (RHBZ#853763).
  - Enable tests by adding an LD_PRELOAD workaround for RHBZ#563103.
  - Tidy up comments in the check section.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.16.31-4
changelog:
  - Fix inspection of Windows guests (RHBZ#858126).
  - Fix list-devices when different drive interfaces are used (RHBZ#858128).


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.16.32-2
changelog:
  - Rebase to libguestfs 1.16.32 which includes a fix for inspection
    of Windows guests.
    resolves: rhbz#858126
  - Skip test-mdadm.sh.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.16.32-3
changelog:
  - Set permissions of .guestfish files in home directories to 0600
    resolves: rhbz#843068
  - Ignore /etc/release if /etc/redhat-release exists
    resolves: rhbz#872454


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.16.34-1
changelog:
  - Rebase to latest stable-1.16 branch version libguestfs 1.16.34.
  - Include missing patch which adds <locale.h> to fuse/guestmount.c
    resolves: rhbz#883338
  - Fix link to engineering git repo.
  - Add workaround for bug in yum: RHBZ#883463.


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.20.11-1
changelog:
  - Rebase to libguestfs 1.20.11.
    resolves: rhbz#958183
  - Remove buildnet: builds now detect network automatically.
  - The rhel-6.x branches containing the patches used in RHEL are
    now stored on a public git repository
    (https://github.com/libguestfs/libguestfs/branches).
  - Compare spec file to Fedora 18 and fix where necessary.
  - Backport new APIs part-get-gpt-type and part-set-gpt-type
    resolves: rhbz#965495
  - Fix DoS (abort) due to a double free flaw when inspecting certain guest
    files / images (CVE-2013-2124)
    resolves: rhbz#968337
  - libguestfs-devel should depend on an explicit version of
    libguestfs-tools-c, in order that the latest package is pulled in.
  - Rebuild against Augeas >= 1.0.0-5
    resolves: rhbz#971207
  - Backport Windows inspection changes
    resolves: rhbz#971090
  - Add back state test commands to guestfish
    resolves: rhbz#971664
  - Work around problem with ntfsresize command in RHEL 6
    resolves: rhbz#971326
  - Fix txz-out API
    resolves: rhbz#972413
  - Move virt-sysprep to the libguestfs-tools-c package since it's no longer
    a shell script
    resolves: rhbz#975572
  - Fix hostname inspection because of faulty Augeas path expression
    resolves: rhbz#975377
  - Calculate appliance root correctly when iface drives are added
    resolves: rhbz#975760
  - Add notes about resizing Windows disk images to virt-resize documentation
    resolves: rhbz#975753
  - Remove dependency on lsscsi, not available in 6Client
    resolves: rhbz#973425
  - Fix yum cache copy so it works if there are multiple repos
    resolves: rhbz#980502
  - Fix hivex-commit API to fail with relative paths
    resolves: rhbz#980372
  - Better documentation for filesystem-available API
    resolves: rhbz#980358
  - Fix double free when kernel link fails during launch
    resolves: rhbz#983690
  - Fix virt-sysprep --firstboot option
    resolves: rhbz#988863
  - Fix cap-get-file so it returns empty string instead of error on no cap
    resolves: rhbz#989352
  - Better documentation for acl-set-file
    resolves: rhbz#985269
  - Fix bogus waitpid error when using guestfish --remote
    resolves: rhbz#996825
  - Disable 9p support
    resolves: rhbz#997884
  - Document that guestfish --remote doesn't work with certain other arguments
    resolves: rhbz#996039
  - Enable kvmclock in the appliance to reduce clock instability
    resolves: rhbz#998108
  - Fix 'sh' command before mount causes daemon to segfault
    resolves: rhbz#1000122
  - Various fixes to tar-out 'excludes' (RHBZ#1001875)
  - Document use of glob + rsync-out (RHBZ#1001876)
  - Document mke2fs blockscount (RHBZ#1002032)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - add option to set Differentiated Services Code Point (DSCP) (#1228314)
  - extend rawstats log (#1242895)
  - fix resetting of leap status (#1243034)
  - report clock state changes related to leap seconds (#1242937)
  - allow -4/-6 on restrict lines with mask (#1232146)
  - retry joining multicast groups (#1288534)
  - explain synchronised state in ntpstat man page (#1286969)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10
changelog:
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10.el6_8.1
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10.el6_8.2
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-13
changelog:
  - Workaround build issues against OpenSSL with enabled ECC curves.
  - Make DRb compatible with OpenSSL 1.0.1.
    * ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch
  - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing
    * ruby-1.9.3-p484-CVE-2013-4164-ignore-too-long-fraction-part-which-does-not-affect-the-result.patch
    - Resolves: rhbz#1033502


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-1
changelog:
  - Update to Ruby 1.8.7-p374.
    * Remove Patch41: ruby-ppc64-segv-fix.patch; subsumed
    * Remove Patch45: ruby-1.8.7-CVE-2011-0188.patch; subsumed
    * Remove Patch46: ruby-1.8.7-FIPS.patch; subsumed
    * Remove Patch47: ruby-1.8.7-p352-mkconfig.rb-fix-for-continued-lines.patch; subsumed
    * Remove Patch48: ruby-1.8.7-p352-CVE-2011-4815.patch; subsumed
    * Remove Patch49: ruby-1.8.7-p358-marshal-load-segv-fix.patch; subsumed
    * Remove Patch50: ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch; subsumed
    * Remove Patch51: ruby-2.0.0-add-missing-rexml-require.patch; subsumed
    * Remove Patch52: ruby-1.8.7-p371-CVE-2012-4481.patch; subsumed
    * Remove Patch53: ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch; subsumed
    Resolves: rhbz#830098
  - Enable ECC support, provided by OpenSSL, in Ruby
    * ruby-1.9.3-p482-Fix-build-against-OpenSSL-with-enabled-ECC-curves.patch
    Resolves: rhbz#1033864
  - Exclude test that fails when issuing a certificate with RSA signature and
    DSS1 digest for earlier OpenSSL versions when used in conjunction with
    OpenSSL 1.0.1.
    * ruby-1.9.3-p172-Exclude-failing-tests-written-for-earlier-OpenSSL.patch
    Resolves: rhbz#1034351
  - Rename Tracer.fire to SystemTap.fire to avoid conflict with Ruby's tracer.
    Resolves: rhbz#784766


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-2
changelog:
  - Replace hardcoded MD5 by sha256 to prevent SSL server failure in FIPS mode.
    * ruby-1.8.7-p374-Replace-md5-by-sha256-to-fix-SSL-server-FIPS-compatibility.patch
  - Resolves: rhbz#802946


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-3
changelog:
  - Fix REXML billion laughs attack via parameter entity expansion
    (CVE-2014-8080).
    Resolves: rhbz#1163993
  - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
    Resolves: rhbz#1163993


author: Petr Machata <pmachata@redhat.com> - 1.41.0-26
changelog:
  - Change Requires: and other package references to use %{?_isa}, so
    that dependencies are arch-aware.


author: Petr Machata <pmachata@redhat.com> - 1.41.0-27
changelog:
  - Fix the way MPI_VERSION is compared with (>=2 rather than ==2) so
    that an arg-less boost::mpi::environment ctor is exposed for MPI
    libraries with MPI_VERSION of 3.
    (boost-1.41.0-mpi-NOARG_INIT.patch)
  - Fix boost::interprocess::move (boost-1.41.0-interprocess-move.patch)
  - Fix copy construction of boost::weak_ptr
    (boost-1.41.0-weak_ptr-copy.patch)
  - Undo the change of non-Requires: package references to not use
    %{?_isa} again.


author: Olivier Fourdan <ofourdan@redhat.com> 0.3-5
changelog:
  - Mark data subpackage as noarch and make it a requirement for libwacom
  - Use generated udev rule file to list only known devices from libwacom
    database


author: Olivier Fourdan <ofourdan@redhat.com> 0.3-8
changelog:
  - Update udev rule automatically from the libwacom database entries
  - Update database for Bamboo Pen and Touch styli


author: Jay Fenlason <fenlason@redhat.com> 1:1.2.15-1.el5
changelog:
  - Change sysconfig file to /etc/rdma/compat-dapl to match the change in dapl
  - Split out into separate source rpm from the dapl-2.0.25-2.el5.src.rpm
    Resolves: rhbz#557170 split compat-dapl into a separate srpm


author: Doug Ledford <dledford@redhat.com> - 1:1.2.15-2.el6
changelog:
  - Fix various rpmlint wanrings in spec file
  - Version all of the obsoletes
  - Now that this is no longer part of the dapl rpm, it needs its own
    doc macro so that the license and whatnot are on the system when the
    package is installed
  - Related: bz555835


author: Jay Fenlason <fenlason@redhat.com> - 1:1.2.15-2.1.el6
changelog:
  - Include pipe-leak patch to close
    Resolves: rhbz619439 - OFED1.5.1: uDAPL - cma: memory leak of FD's (DB2 pureScale)
    This required some whitspace editing--apparently the patch was garbled
    somewhere in transit.
  - Include the cma-memleak-verbs-CQ-compl-chans-fix patch to close
    Resolves: rhbz619443 - OFED1.5.1: uDAPL handles close on forked child exit (DB2 pureScale)


author: Doug Ledford <dledford@redhat.com> - 1:1.2.19-1
changelog:
  - Update to latest upstream release (1.2.15 -> 1.2.19)
  - Remove 3 patches rolled into upstream
  - Update exclusive arch to accommodate i686 arch
  - Related: bz725016, bz724896


author: Jiri Moskovcak <jmoskovc@redhat.com> 1.1.13-1
changelog:
  - updated translations rhbz#619340
  - removed dependency on libzip
  - added libxml-2.0 into configure (npajkovs@redhat.com)
  - fixed typo in man page rhbz#610748 (jmoskovc@redhat.com)
  - RHTSupport: GUI's SSLVerify checkbox had one missing bit of code (vda.linux@googlemail.com)
  - Resolves: rhbz#619340


author: Jiri Moskovcak <jmoskovc@redhat.com> 1.1.13-2
changelog:
  - increased timeout in gui to prevent timeouts when uploading large files
  - added update messages during upload
  - Resolves: #625012


author: Jiri Moskovcak <jmoskovc@redhat.com> 1.1.14-1
changelog:
  - updated po files (jmoskovc@redhat.com)
  - GUI: make how to mandatory (jmoskovc@redhat.com)
  - silent rules (npajkovs@redhat.com)
  - fixed segv in abrt-hook-ccpp rhbz#652338 (jmoskovc@redhat.com)
  - rhbz 623142 (npajkovs@redhat.com)
  - GUI: make the "install debuginfo" hint selectable rhbz#644343 (jmoskovc@redhat.com)
  - GUI: wrap howto and comments rhbz#625237 (jmoskovc@redhat.com)
  - GUI: show horizontal scrollbar when needed (jmoskovc@redhat.com)
  - GUI: wrap lines in the backtrace window rhbz#625232 (jmoskovc@redhat.com)
  - GUI: changed '*' to '•' rhbz#625236 (jmoskovc@redhat.com)
  - rm abrt_test.py (jmoskovc@redhat.com)
  - added utf-8 coding tag into .py files (jmoskovc@redhat.com)
  - GUI: show the scrollbar in summary only when needed (jmoskovc@redhat.com)
  - GUI: added accelerator key "Delete" to the delete button rrakus@redhat.com (jmoskovc@redhat.com)
  - backtrace rating check in abrt-cli (mtoman@redhat.com)
  - Localization of [y/n] response in abrt-cli (kklic@redhat.com)
  - abrt-cli --info: Make coredump and rating fields optional (kklic@redhat.com)
  - GUI: increase dbus timeout in Report() call (vda.linux@googlemail.com)
  - GUI: make the bt viewer not-editable rhbz#621871 (jmoskovc@redhat.com)
  - increased version to 1.1.14 (jmoskovc@redhat.com)
  - new bt parser (kklic) (jmoskovc@redhat.com)
  - disable polkit (jmoskovc@redhat.com)
  - add example of tainted kernel module (npajkovs@redhat.com)


author: Jiri Moskovcak <jmoskovc@redhat.com> 1.1.15-1
changelog:
  - removed unused files (jmoskovc@redhat.com)
  - update po files (jmoskovc@redhat.com)
  - removed some unused files (jmoskovc@redhat.com)
  - pass old pattern to ccpp hook and use it (dvlasenk@redhat.com)
  - GUI: added warning when gnome-keyring can't be accessed rhbz#576866 (jmoskovc@redhat.com)
  - 666893 - Unable to make sense of XML-RPC response from server (npajkovs@redhat.com)
  - PyHook: ignore SystemExit exception rhbz#636913 (jmoskovc@redhat.com)
  - 665405 - ABRT's usage of sos does not grab /var/log/messages (npajkovs@redhat.com)
  - add a note in report if kernel is tainted (npajkovs@redhat.com)
  - KerneloopsScanner.cpp: make a room for NULL byte (npajkovs@redhat.com)
  - fix multicharacter warring (npajkovs@redhat.com)
  - open help page instead of about rhbz#666267
  - Resolves: #665405, #576866, #649309, #623142, #614486, #650975, #666267


author: Jiri Moskovcak <jmoskovc@redhat.com> 1.1.16-1
changelog:
  - added list of attachments to comment rhbz#668875
  - stop consuming non-standard header rhbz#670492
  - Resolves: #670492, #668875


author: Jiri Moskovcak <jmoskovc@redhat.com> 1.1.16-3
changelog:
  - improved support for GSS customer portal
    - fixed the hash generating: use component name instead of package NVR
    - added a user-agent header to rhtsupport requests for easier hash algorithm
      matching
  - Resolves: #694410


author: Adam Tkac <atkac redhat com> 32:9.8.2-0.1.rc1
changelog:
  - update to 9.8.2rc1
  - patches merged
    - bind97-rh754398.patch
    - bind97-rh700097.patch
    - bind97-rh734502.patch
    - bind97-rh746694-1.patch
    - bind97-rh746694-2.patch
    - bind97-rh739406-1.patch
    - bind97-rh739406-2.patch
  - ship DNSKEY for root zone in default configuration


author: Adam Tkac <atkac redhat com> 32:9.8.2-0.2.rc1
changelog:
  - harden dns_zone_setmasterswithkeys() to avoid INSIST failures
  - build with '--enable-fixed-rrset'
  - fix potential memory leak in code which processes rndc authentication
    (#749582)
  - generate rndc.key during `service named start` (#768798)
  - nslookup: improve handling of AA responses with recursion off
  - removed obsolete bind97-rh714049.patch patch


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1229871)
  - document some options of the speed command (#1197095)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.1
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Pavel Šimerda <psimerda@redhat.com> - 1.0.1-3
changelog:
  - Resolves: #738244 - provide libnetfilter_queue package for RHEL 6.6
  - use a modified EPEL6 spec file


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.3
changelog:
  - Revise PR2323 to use header defines to mark whether GLib types have been defined or not
  - Resolves: rhbz#1190835


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.3
changelog:
  - Revise PR2323 to account for different glibconfig.h define used on RHEL 6
  - Resolves: rhbz#1190835


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.79-2.5.5.3
changelog:
  - Use installed directory in check section and remove duplicate tests in build
  - Resolves: rhbz#1190835


author: Deepak Bhole <dbhole@redhat.com> - 1.0-3
changelog:
  - Bump to 1.0 proper
  - Install to jre dir only
  - Restrict access to net.sourceforge.jnlp.*
  - Resolves bugs 674519, 674517, 674524, 671470


author: Deepak Bhole <dbhole@redhat.com> - 1.0-5
changelog:
  - Minor comment/group/etc. updates from omajid@redhat.com
  - Added base package requirement for javadoc subpackage


author: Joe Orton <jorton@redhat.com> - 2.0.1-8
changelog:
  - add security fix for CVE-2009-3560 (#533174)
  - add security fix for CVE-2009-3720 (#531697)
  - run the test suite


author: Jeff Law <law@redhat.com> - 2.12-1.74
changelog:
  - Correctly handle large response to AF_UNSPEC dns lookup (#795498)
    - Always use another area after a failed allocation in the
     main arena (#795328)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271928


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.5
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271928


author: Mike Christie <mcrhsit@redhat.com> 6.2.0.872.36
changelog:
  - 740054 sync iscsiuio to 0.7.2.1
  - 790609 Add ping and host chap support to iscsiadm
  - 636013 scalability testing.


author: Mike Christie <mcrhsit@redhat.com> 6.2.0.872.37
changelog:
  - 805467 Have iscsistart/iscsiadm bring up offload net interface.
  - 796574 Fix port handling when hostnames are used for portals.
  - 739843 Fix default iface setup handling.


author: Mike Christie <mcrhsit@redhat.com> 6.2.0.872.40
changelog:
  - 738192 Fix regression added when handling 738192 where unknown params
    messages got logged by mistake.


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-1
changelog:
  - Sync with upstream 2.0.873
  - 854776 Bring up network interface for iSCSI boot with bnx2i
  - 811428 make version string reported by iscsiadm match RPM version
  - fix iscsid segfault during qla4xxx login


author: Petr Holasek <pholasek@redhat.com> - 2.0.7-4
changelog:
  - Symbol numa_num_possible_cpus exported (bz804827)
  - miscalculating of numa_num_configured_cpus was fixed (bz804480)


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-8
changelog:
  - Prevent non-synced raid1 repair unless --force
  - Fix automatic updates of PV extension headers to newest version.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-9
changelog:
  - Fix lvchange --discard|--zero for active thin-pool.
  - Fix lock-holder device for thin pool with inactive thin volumes.
  - Use any inherited tags when wiping metadata sub LVs to ensure activation.
  - Do not issue "Failed to create directory" message for dm_create_dir failure.
  - Add Conflicts: lvm2-libs < 2.02.111 to device-mapper-event to prevent
    incorrect package setup if old and new device-mapper/lvm2 packages combined.
  - Move blkdeactivate/blk-availability script from lvm2 to device-mapper package.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-10
changelog:
  - Disable queueing on mpath devs in blk-availability initscript.
  - Add new -m|--mpathoption disablequeueing to blkdeactivate.
  - Prevent only repair for non-synced raid1 unless --force, not other raid types.


author: Nalin Dahyabhai <nalin@redhat.com> 0.44-1
changelog:
  - check specifically for cases where a specified token that we need to
    use just isn't present for whatever reason (#697058)


author: Nalin Dahyabhai <nalin@redhat.com> 0.46-1
changelog:
  - treat the ability to access keys in an NSS database without using a PIN,
    when we've been told we need one, as an error (#692766, really this time)


author: Nalin Dahyabhai <nalin@redhat.com> 0.47-1
changelog:
  - getcert: distinguish between {stat() succeeds but isn't a directory} and
    {stat() failed} when printing an error message (#739903)
  - getcert resubmit/start-tracking: when we're looking for an existing request
    by ID, and we don't find one, note that specifically (#741262)


author: Nalin Dahyabhai <nalin@redhat.com> 0.49-1
changelog:
  - when using an NSS database, skip loading the module database (#743042)
  - when using an NSS database, skip loading root certs
  - generate SPKAC values when generating CSRs, though we don't do anything
    with SPKAC values yet
  - internally maintain and use challenge passwords, if we have them
  - behave better when certificates have shorter lifetimes
  - add/recognize/handle notification type "none"
  - getcert: error out when "list -c" finds no matching CA (#743488)
  - getcert: error out when "list -i" finds no matching request (#743485)


author: Nalin Dahyabhai <nalin@redhat.com> 0.50-1
changelog:
  - really fix these this time:
   - getcert: error out when "list -c" finds no matching CA (#743488)
   - getcert: error out when "list -i" finds no matching request (#743485)


author: Nalin Dahyabhai <nalin@redhat.com> 0.50-2
changelog:
  - incorporate patch from Rob Crittenden to start supplying Referer:
    headers when we submit XML-RPC requests (#750617)


author: Nalin Dahyabhai <nalin@redhat.com> 0.50-3
changelog:
  - tweak the patch for #750617 to handle the case where xmlrpc-c doesn't
    offer dont_advertise as an option (Rob Crittenden)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-32
changelog:
  - Resolves: bug 1074847 - EMBARGOED CVE-2014-0132 389-ds-base: 389-ds: flaw in parsing authzid can lead to privilege escalation [rhel-6.5.z] (Ticket 47739 - directory server is insecurely misinterpreting authzid on a SASL/GSSAPI bind)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-33
changelog:
  - Release 1.2.11.15-33
  - Resolves: Bug 1094412 - fix memleak introduced by "Simple paged results should support async search (957864)" (DS 47623)
  - Resolves: Bug 1094413 - rhds91 389-ds-base-1.2.11.15-31.el6_5 crash on paged searches followed by simple srch (DS 47707)


author: Daniel Mach <dmach@redhat.com> - 0.9.9-5
changelog:
  - Update Intel Haswell events.
  - Add support for Intel Silvermont (Avoton).
  - Add support for Intel Broadwell.
  - Add support for aarch64.
  - Update IBM power8 events.


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.485.el6
changelog:
  - kvm-Change-fsfreeze-hook-default-location.patch [bz#1213233]
  - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1290743]
  - Resolves: bz#1213233
    ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1290743
    (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.486.el6
changelog:
  - kvm-blockdev-Error-out-on-negative-throttling-option-val.patch [bz#1294619]
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298046]
  - Resolves: bz#1294619
    (Guest should failed to boot if set iops,bps to negative number)
  - Resolves: bz#1298046
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-6.8])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.487.el6
changelog:
  - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249740]
  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249740]
  - Resolves: bz#1249740
    (Segfault occurred at Dst VM while completed migration upon ENOSPC)


author: Miroslav Rezanina <mrezanin@redhat.com - 0.12.1.2-2.488.el6
changelog:
  - Fixed qemu-ga path configuration [bz#1213233]
  - Resolves: bz#1213233
    ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.489.el6
changelog:
  - kvm-hw-qxl-qxl_send_events-nop-if-stopped.patch [bz#1290743]
  - kvm-block-mirror-fix-full-sync-mode-when-target-does-not.patch [bz#971312]
  - Resolves: bz#1290743
    (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)
  - Resolves: bz#971312
    (block: Mirroring to raw block device doesn't zero out unused blocks)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.490.el6
changelog:
  - kvm-qemu-ga-implement-win32-guest-set-user-password.patch [bz#1174181]
  - kvm-util-add-base64-decoding-function.patch [bz#1174181]
  - kvm-qga-convert-to-use-error-checked-base64-decode.patch [bz#1174181]
  - kvm-qga-use-more-idiomatic-qemu-style-eol-operators.patch [bz#1174181]
  - kvm-qga-use-size_t-for-wcslen-return-value.patch [bz#1174181]
  - kvm-qga-use-wide-chars-constants-for-wchar_t-comparisons.patch [bz#1174181]
  - kvm-qga-fix-off-by-one-length-check.patch [bz#1174181]
  - kvm-qga-check-utf8-to-utf16-conversion.patch [bz#1174181]
  - Resolves: bz#1174181
    (RFE: provide QEMU guest agent command for setting root account password (Linux guest))


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.491.el6_8.1
changelog:
  - kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331407]
  - kvm-vga.h-remove-unused-stuff-and-reformat.patch [bz#1331407]
  - kvm-vga-use-constants-from-vga.h.patch [bz#1331407]
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331407]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331407]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331407]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331407]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331407]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331407]
  - Resolves: bz#1331407
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-6.8.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.491.el6_8.2
changelog:
  - kvm-vga-add-sr_vbe-register-set.patch [bz#1347192]
  - Resolves: bz#1347192
    (Regression from CVE-2016-3712: windows installer fails to start)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.491.el6_8.3
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359724]
  - Resolves: bz#1359724
    (EMBARGOED CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-6.8.z])


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.29.1.el6]
changelog:
  - [x86] x86/spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Rename _RDS to _SSBD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/kvm: Expose the RDS bit to the guest (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573176 1572487]


author: Jeff Law <law@redhat.com> - 2.12-1.104
changelog:
  - Change from magic environment variable to existance of
      magic file /etc/sysconfig/32bit_ssse3_mempy_via_32bit_ssse3_memmove
      to trigger change in memcpy behavior. (#846342, #865375)
    - Fix IPTOS_CLASS #define. (#864322)


author: Jeff Law <law@redhat.com> - 2.12-1.107
changelog:
  - Simplify test for magic file to change memcpy behaviour
      and correctly handle encoded return value from inlined
      syscall (#846342, #874642)
    -


author: Patsy Franklin <pfrankli@redhat.com> - 2.12.1.107.3
changelog:
  - Consistantly MANGLE/DEMANGLE function pointers and
      fix use after free in dcigettext.c (#989558).


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-66
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-68
changelog:
  - Resolves: #1450298 - when ProxyErrorOverride is On, modcluster
    return 503 status code on subsequent requests (2)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-69
changelog:
  - Resolves: #1471383 - httpd.worker abort()s with misc/apr_reslist.c:159:
    reslist_cleanup: Assertion `rl->ntotal == 0' failed


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#927171 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Kai Engert <kaie@redhat.com> - 3.14.3-2
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#957603 - nss 3.14 - MD5 hash algorithm disabled


author: Daniel Veillard <veillard@redhat.com> - 0.5.11-1.el6
changelog:
  - Rebase to 0.5.11 for RHEL-6.1
  - needed to bump libcmpiutil requirement to 0.5.4 due to incompatibilities
  - Resolves: rhbz#633336
  - Resolves: rhbz#633331


author: Hans de Goede <j.w.r.degoede@hhs.nl> 3.0.0-3
changelog:
  - Change /dev/i2c-# creation from /lib/udev/devices to /etc/udev/makedev.d
    usage
  - Add an /etc/modprobe.d/i2c-dev file to work around bug 380971


author: Thomas Woerner <twoerner@redhat.com> 1.2.13-11
changelog:
  - removed joyos2.h from source archive, because of licensing issues
    Resolves: rhbz#537918
    Related: rhbz#543948


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-85
changelog:
  - Release 1.2.11.15-85
  - Resolves: #1372420 - DES to AES backport issues (DS 47462)
  - Resolves: #1391324 - ds9 backport 47411 - Replace substring search with plain search in referint plugin (DS 47411)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-86
changelog:
  - Release 1.2.11.15-86
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 49049)
  - Resolves: #1400997 - ldif2db.pl script shows wrong usage for -n as instance, instead of database (DS 49070)
  - Resolves: #1403754 - ns-slapd crashes during tickets/ticket48665_test.py (DS 48665)
  - Resolves: #1410645 - The "repl-monitor" web page does not display "year" in date. (DS 48220)
  - Resolves: #1399600 - ns-slapd segfaults during execution of tickets/ticket47966_test.py (DS 47966, DS 48987)
  - Resolves: #1402012 - Importing big ldif file with duplicate DNs throwing "unable to flush" error
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-87
changelog:
  - Release 1.2.11.15-87
  - Resolves: #1391701 - do not treat missing csn as fatal (DS 49020)
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-88
changelog:
  - Release 1.2.11.15-88
  - Resolves: #1413692 - custom schema is registered in small caps after schema reload (DS 47973)
  - Resolves: #1408976 - dbscan-bin crashing due to a segmentation fault. (DS 49104)


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-89
changelog:
  - Release 1.2.11.15-89
  - Resolves: #1421512 - ns-slapd crashes in ldif_sput due to the output buf size is less than the real size.


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-90
changelog:
  - Release 1.2.11.15-90
  - Resovles: #1435365 - Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax


author: Mark Reynolds <mreynolds@redhat,com> - 1.2.11.15-91
changelog:
  - Release 1.2.11.15-91
  - Resolves: bug 1437776 - EMBARGOED CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-95
changelog:
  - Release 1.2.11.15-95
  - Resolves: Bug 1562152 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch
  - Resolves: Bug 1544415 - CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (fix cherry-pick error)
  - Resolves: Bug 1543798 - EMBARGOED CVE-2018-1054 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-97
changelog:
  - Bump version to 1.2.11.15-97
  - Resolves: Bug 1563539 - acl_copyEval_context double free (fix spec file patch)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.9-1
changelog:
  - handle component destruction (patch by Richard W.M. Jones)
  - fix newtWinEntry definition
  - don't use uninitialized values in newtWinMenu
  - remove workarounds for old bug in SLsmg_write_nstring
  - improve SIGWINCH handling in form
  - don't abort from whiptail gauge on SIGWINCH
  - redisplay also last line
  - update Polish translation (Piotr Drąg)
  - update URL and Source tag


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.10-1
changelog:
  - improve --noitem description (#456305)
  - add setHeight to Textbox class
  - fix fixedheight forms
  - free keymap in newtFinished()
  - fix memory leak in textbox
  - fix valgrind error in checkboxtree
  - don't crash when running empty form
  - don't crash or hang when form has no focusable elements
  - before checkboxtree drawing return first item in GetCurrent()
  - redraw textbox in SetText()
  - add setColor description to SnackScreen docstring (Greg Swift)
  - make sure Widget isn't used directly (Greg Swift) (#452920)
  - add Serbian translations (Miloš Komarčević)
  - add Balochi translation (Mostafa Daneshvar)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.11-1
changelog:
  - fix buffer overflow in textbox when reflowing (#523955, CVE-2009-2905)
  - use full textbox width when reflowing and allow minimal width 1
  - fix writing lines longer than width in textbox
  - don't use va_list in newtvwindow more than once (#523696)
  - bind \E[Z to back-tab in built-in keymap (#468046)
  - terminate string after reading file in whiptail
  - add newtRadioSetCurrent function (Thomas Jarosch)
  - add pkgconfig support (Thomas Jarosch)
  - add Malay, Malayalam, Assamese, Gujarati, Bengali India, Kannada, Telugu
    translations
  - include tutorial in txt format
  - include debian patches
    - fix crash in textbox SetText when topLines != 0
    - don't link modules with libraries already linked with libnewt
    - add Asturian and Marathi translations


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.11-3
changelog:
  - add support for changing colors in individual labels, scrollbars, entries,
    textboxes and scales, add custom colorsets (#707704)


author: Hans de Goede <hdegoede@redhat.com> 6.4.9.6-2
changelog:
  - Fix undefined warning in magick-type.h (#489453)
  - Do not link PerlMagick against system ImageMagick, but against the just
    build one


author: Karel Zak <kzak@redhat.com> 2.17.1-1
changelog:
  - upgrade to 2.17.1 (bugfix release, #567555)
    ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng/v2.17/v2.17.1-ReleaseNotes
    ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng/v2.17/v2.17.1-ChangeLog
  - spec file fixes:
    fix floppyutil URL in specfile
    add missing liceces to License field
    fix mixed-use-of-spaces-and-tabs
  - fix #565888 - uuidd initscript lsb compliance
  - remove util-linux-ng-2.17-mount-mtabfake.patch (merged upstream)


author: Karel Zak <kzak@redhat.com> 2.17.1-3
changelog:
  - fix #572121 - RHEL6: reset tiny flag in libblkid
  - fix #572122 - RHEL6: blkid (and related) should be a bit more robust


author: Karel Zak <kzak@redhat.com> 2.17.2-1
changelog:
  - upgrade to the bugfix release 2.17.2 (#575722)
    ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng/v2.17/v2.17.2-ReleaseNotes
    ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng/v2.17/v2.17.2-ChangeLog
  - remove: util-linux-ng-2.17-blkid-alignment-offset.patch
            util-linux-ng-2.17-blkid-minix.patch
            util-linux-ng-2.17-blkid-tinyflag.patch
  - fix #572937 - RHEL6: use microsecond resolution for blkid cache entries


author: Karel Zak <kzak@redhat.com> 2.17.2-2
changelog:
  - fix #588248 - RHEL6: don't probe for RAIDs on CD-ROMs
  - fix #586368 - RHEL6: mdraid assembles incorrectly
  - fix #586942 - Add utempter support to "script"
  - fix #588298 - RHEL6: improve fdisk(8) move command.


author: Karel Zak <kzak@redhat.com> 2.17.2-3
changelog:
  - fix #592958 - whole disk raid members to not be identified
  - fix #594689 - partx infinite loop
  - fix #589955 - add command-line interface for libblkid topology support


author: Karel Zak <kzak@redhat.com> 2.17.2-4
changelog:
  - fix #604875 - memory usage in wipefs(8)
  - fix #591133 - udev /dev/disk/by-uuid not populated
  - fix #602657 - fdisk -l does not show correctly partitions names for FCoE volumes
  - fix #591617 - lscpu does not use cpu masks properly


author: Karel Zak <kzak@redhat.com> 2.17.2-5
changelog:
  - fix #561111 - remount of tmpfs fails on RHEL6 alpha
  - fix #612668 - backport fsfreeze from util-linux-ng 2.18
  - fix #598631 - shutdown, reboot, halt and C-A-D don't work


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-12.el6
changelog:
  - blockjob: Add qemu capabilities related to block pull jobs (rhbz#811683)
  - blockjob: Add API for async virDomainBlockJobAbort (rhbz#811683)
  - blockjob: Optimize JSON event handler lookup (rhbz#811683)
  - blockjob: Wire up qemu async virDomainBlockJobAbort (rhbz#811683)
  - blockjob: Allow for fast-finishing job (rhbz#811683)
  - virsh: Minor syntactic cleanups (rhbz#811683)
  - qemu: Use consistent error when qemu binary is too old (rhbz#811683)
  - blockjob: Add virsh blockpull --wait (rhbz#811683)
  - qemu: Fix deadlock when qemuDomainOpenConsole cleans up a connection (rhbz#811497)
  - qemu: Fix deadlock when qemuDomainOpenConsole cleans up a connection (rhbz#811497)
  - qemu: Fix mem leak in qemuProcessInitCpuAffinity (rhbz#810157)
  - numad: Convert node list to cpumap before setting affinity (rhbz#810157)
  - numad: Ignore cpuset if placement is auto (rhbz#810157)
  - conf: Do not parse cpuset only if the placement is auto (rhbz#810157)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-13.el6
changelog:
  - Fix a problem in the patchset, rhbz#811497 one was applied twice in -12
  - qemu, util: On restart of libvirt restart vepa callbacks (rhbz#812430)
  - qemu, util: Fix netlink callback registration for migration (rhbz#812430)
  - util: Only register callbacks for CREATE operations in virnetdevmacvlan.c (rhbz#812430)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-14.el6
changelog:
  - blockjob: Add new API flags (rhbz#638506)
  - blockjob: Add 'blockcopy' to virsh (rhbz#638506)
  - blockjob: Enhance xml to track mirrors across libvirtd restart (rhbz#638506)
  - blockjob: React to active block copy (rhbz#638506)
  - blockjob: Add qemu capabilities related to block jobs (rhbz#638506)
  - blockjob: Return appropriate event and info (rhbz#638506)
  - blockjob: Support pivot operation on cancel (rhbz#638506)
  - blockjob: Make drive-reopen safer (rhbz#638506)
  - blockjob: Implement block copy for qemu (rhbz#638506)
  - blockjob: Allow for existing files (rhbz#638506)
  - blockjob: Allow mirroring under SELinux (rhbz#638506)
  - blockjob: Accommodate RHEL backport names (rhbz#638506)
  - virsh: Avoid strtol (rhbz#813972)
  - conf: Tighten up XML integer parsing (rhbz#813972)
  - snapshot: Fix memory leak on error (rhbz#782457)
  - virsh: Avoid uninitialized memory usage (rhbz#814080)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-15.el6
changelog:
  - qemu: Improve errors related to offline domains (rhbz#816662)
  - blockjob: Check for active vm before checking blockcopy bits (rhbz#816662)
  - qemu: Preserve original error during migration (rhbz#807907)
  - rpc: Discard non-blocking calls only when necessary (rhbz#807907)
  - qemu: Fix detection of failed migration (rhbz#807907)
  - qemu: Avoid bogus error at the end of tunnelled migration (rhbz#807907)
  - qemu: Make sure qemu can access its directory in hugetlbfs (rhbz#815206)
  - virsh: Fix docs for list command (rhbz#814021)
  - virsh: Fix and clarify the --title flag for the list command in man page (rhbz#814021)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-16.el6
changelog:
  - qemuOpenFile: Don't force chown on NFS (rhbz#810241)
  - util: Fix crash when starting macvtap interfaces (rhbz#815270)
  - qemu: Fix segfault when host CPU is empty (rhbz#817078)
  - blockjob: Allow speed setting in block copy (rhbz#815791)
  - blockjob: Fix block-stream bandwidth race (rhbz#815791)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-17.el6
changelog:
  - qemu: Don't modify domain on failed blockiotune (rhbz#819014)
  - qemu: Reject blockiotune if qemu too old (rhbz#819014)
  - qemu: Don't use virDomainDefFormat* directly (rhbz#815503)
  - qemu: Emit compatible XML when migrating a domain (rhbz#815503)
  - usb: Create functions to search usb device accurately (rhbz#815755)
  - qemu: Call usb search function for hostdev initialization and hotplug (rhbz#815755)
  - virsh: Avoid heap corruption leading to virsh abort (rhbz#819636)
  - util: Fix libvirtd startup failure due to netlink error (rhbz#816465)
  - util: Allow specifying both src and dst pid in virNetlinkCommand (rhbz#816465)
  - util: Function to get local nl_pid used by netlink event socket (rhbz#816465)
  - util: Set src_pid for virNetlinkCommand when appropriate (rhbz#816465)
  - domain_conf: Add "usbredir" to list of valid spice channels (rhbz#819498)
  - domain_conf: Add "default" to list of valid spice channels (rhbz#819499)
  - snapshot: Allow block devices past cgroup (rhbz#810200)
  - blockjob: Allow block devices past cgroup (rhbz#810200)
  - util: Avoid libvirtd crash in virNetDevTapCreate (rhbz#817234)
  - python: Fix the forward_null error in Python binding codes (rhbz#771021)
  - xen: Fix resource leak in xen driver (rhbz#771021)
  - test: Fix resource leak in test driver (rhbz#771021)
  - node: Fix resource leak in nodeinfo.c (rhbz#771021)
  - virnet: Fix resource leak in virnetlink.c (rhbz#771021)
  - vmx: Fix resource leak (rhbz#771021)
  - qemu: Fix resource leak (rhbz#771021)
  - uuid: Fix possible non-terminated string (rhbz#771021)
  - node_device: Fix possible non-terminated string (rhbz#771021)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.10-18.el6
changelog:
  - numad: Set memory policy from numad advisory nodeset (rhbz#810157)
  - numad: Copy 'placement' of <numatune> to <vcpu> by default (rhbz#810157)
  - numad: Always output 'placement' of <vcpu> (rhbz#810157)
  - qemu: Avoid the memory allocation and freeing (rhbz#810157)
  - numad: Divide cur_balloon by 1024 before passing it to numad (rhbz#810157)
  - numad: Check numactl-devel if compiled with numad support (rhbz#810157)


author: Tomas Mraz <tmraz@redhat.com> - 6.1.11-1
changelog:
  - do not restart services when configuration did not change
  - dissallow setting identity or authentication services with missing
    installed files (#590447)
  - eliminate unnecessary updates of PAM config files and sssd.conf (#639978)
  - updated translations from Transifex


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-146
changelog:
  - Add sysadm_secadm policy module to separate in secadm_r, sysadm_r
  Resolves:#787413
  - Fixes for libvirt-qmf
  - Add label for package-cleanup 
  - Add support for zfs
  - Make cfengine domains as unconfined
  Resolves:#753184
  - Allow sshd_t to dyntransition to sysadm_t


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-147
changelog:
  - Fix man pages for SELinux users
  - Allow all user domains to setexec
  - Allow cobblerd to get SELinux status and booleans
  - Add labeling for /etc/zipl.conf
  Resolves:#813803
  - Allow fenced to read SNMP lib files


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-149
changelog:
  - Add labeling for /usr/sbin/matahari-dbus-sysconfigd
  - Add additional labeling for zarafa
  - Allow guest_t to fix labeling
  - Corenet_tcp_bind_all_unreserved_ports(ssh_t) should be called with the user_tcp_server boolean
  - squashfs does not support xattr in RHEL6
  Resolves:#815898
  - Remove pyzor labeling and move it to spamassassin.fc
  - Fix config.tgz


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-151
changelog:
  - Add openstack-nova, openstack-keystone, openstack-glance, openstack-quantum policies
  - Allow sysadm_t to create other crontabs
  - Allow nfsd_t to read defaul_t link files
  - Fix labeling for /var/run/heartbeat
  - Fixes for admin_template() interface to make sysadm_secadm.pp module working correctly
  - More fixes for condor policy
  - Allow chfn_t to creat user_tmp_files
  - Allow chfn_t to execute bin_t
  - Fix auth_role() interface
  - Fixes to make privsep+SELinux working if we try to use chage to change passwd


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-152
changelog:
  - Add label for condor_starter
  Resolves:#807682
  - Dontaudit sys_module for brctl
  - Allow winbind to send signull to smbd
  - Add jacorb port definition


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-154
changelog:
  - Allow fenced to manage snmpd lib files
  - Allow certmonger to get attributes on init script files
  Resolves:#790967
  - Fix labeling for Firefox plugins
  Resolves:#747993
  - Add mta_signal_user_agent() interface


author: Adam Jackson <ajax@redhat.com> 8.1-0.19
changelog:
  - Fix pthread linkage of glapi and osmesa
  - Drop llvmpipe-related patches
  - Don't require mesa-dri1-drivers on s390{,x}


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-17
changelog:
  - fix: strict aliasing warnings during package build (#723487)
  - add partial RELRO support for libraries (#723999)
  - fix: incorrect behavior of allow/try options of VerifyCert and TLS_REQCERT (#729095)
  - fix: memleak - free the return of tlsm_find_and_verify_cert_key (#729087)
  - fix: TLS_REQCERT=never ignored when the certificate is expired (#722959)
  - fix: matching wildcard hostnames in certificate Subject field does not work (#726984)
  - fix: OpenLDAP server segfaults when using back-sql (#727533)
  - fix: conversion of constraint overlay settings to cn=config is incorrect (#722923)
  - fix: DDS overlay tolerance parametr doesn't function and breakes default TTL (#723514)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-18
changelog:
  - fix: overlay refint option refint_nothing doesn't function correctly (#725479)
  - fix: Unwanted slash printed when installing openldap-servers (#732001)
  - manpage fix: TLS options in documentation are not valid for MozNSS (#684810)
  - fix: NSS_Init* functions are not thread safe (#731168)
  - manpage fix: errors in manual page slapo-unique (#723521) 
  - new feature: honor priority/weight with ldap_domain2hostlist (#730311)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-20
changelog:
  - new feature update: honor priority/weight with ldap_domain2hostlist (#730311)
  - fix regression: openldap built without tcp_wrappers (#742592)


author: Jan Vcelak <jvcelak@redhat.com> 2.4.23-21
changelog:
  - fix: ldapsearch crashes with invalid parameters (#743781)
  - fix: replication (syncrepl) with TLS causes segfault (#783445)
  - fix: openldap server in MirrorMode sometimes fails to resync via syncrepl (#784211)
  - use portreserve to reserve LDAPS port (636/tcp+udp) (#790687)
  - fix: missing options in manual pages of client tools (#745470)
  - fix: SASL_NOCANON option missing in ldap.conf manual page (#732916)
  - fix: slapd segfaults when certificate key cannot be loaded (#796808)
  - Jan Synáček <jsynacek@redhat.com>
    + fix: overlay constraint with count option work bad with modify operation (#742163)
    + fix: Default SSL certificate bundle is not found by openldap library (#742023)
    + fix: Duplicate close() calls in OpenLDAP (#784203)


author: Tom Lane <tgl@redhat.com> 8.4.11-1
changelog:
  - Update to PostgreSQL 8.4.11, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-10.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #812082


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830726


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852020


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-4
changelog:
  - Add two needed patches
  - Resolves: rhbz#783315 - Need nss workaround for freebl bug that causes openswan to drop connections
  - Resolves: rhbz#747387 - Unable to contact LDAP Server during winsync


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-1
changelog:
  - Update to 3.13.3
  - Resolves: rhbz#798539 - Distrust MITM subCAs issued by TrustWave
  - Remove builtins-nssckbi_1_88_rtm.patch which the rebase obsoletes


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Resolves: rhbz#768669 - PEM unregistered callback causes SIGSEGV


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-3
changelog:
  - Resolves: rhbz#746632 - pem_CreateObject mem leak on non existing file name
  - Use completed patch per code review


author: Phillip Lougher <plougher@redhat.com> [2.6.32-747.el6]
changelog:
  - [fs] gfs2: Check for the end of metadata in trunc_dealloc (Robert S Peterson) [1559928]
  - [fs] gfs2: clear journal live bit in gfs2_log_flush (Robert S Peterson) [1559928]
  - [netdrv] vmxnet3: fix tx data ring copy for variable size (Neil Horman) [1530378]
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1559386]
  - [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1554631]
  - [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1554631]
  - [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1554630]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-748.el6]
changelog:
  - [mm] fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE (Bhupesh Sharma) [1494380]
  - [mm] brk: fix min_brk lower bound computation for COMPAT_BRK (Bhupesh Sharma) [1494380]
  - [mm] split ET_DYN ASLR from mmap ASLR (Bhupesh Sharma) [1494380]
  - [s390] redefine randomize_et_dyn for ELF_ET_DYN_BASE (Bhupesh Sharma) [1494380]
  - [mm] expose arch_mmap_rnd when available (Bhupesh Sharma) [1494380]
  - [s390] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [s390] mmap: randomize mmap base for bottom up direction (Bhupesh Sharma) [1494380]
  - [powerpc] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [x86] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: create Kconfig variable for PIE randomization (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: PIE: make PF_RANDOMIZE check comment more accurate (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: fix PIE execution with randomization disabled (Bhupesh Sharma) [1494380]
  - [acpi] acpica: Support calling _REG methods within ACPI interpreter (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI interpreter already entered (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI mutex held by this thread (Lenny Szubowicz) [1522849]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-749.el6]
changelog:
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1561788]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1561788]
  - [lib] seq: Add seq_buf_printf() (Mauricio Oliveira) [1561788]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1561786]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1557562 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1558845]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-750.el6]
changelog:
  - [fs] fuse: fix punching hole with unaligned end (Miklos Szeredi) [1387473] {CVE-2017-15121}
  - [documentation] kdump: fix documentation about panic_on_warn to match rhel6 (Pingfan Liu) [1555196]
  - [fs] Provide sane values for nlink (Leif Sahlberg) [1554342]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-751.el6]
changelog:
  - [md] dm thin: fix regression that caused discards to be disabled if passdown was (Mike Snitzer) [1569377]
  - [s390] configs: enable auto expoline support (Hendrik Brueckner) [1554959]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1554959]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1554959]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1554959]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1554959]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1554959]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1554959]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1554959]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1554959]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1554959]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1554959]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1554959]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1554959]
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1568241]
  - [net] sctp: verify size of a new chunk in _sctp_make_chunk() (Stefano Brivio) [1551908] {CVE-2018-5803}


author: Petr Vobornik <pvoborni@redhat.com> - 3.0.0-46.el6
changelog:
  - Use tls version range in NSSHTTPS initialization
  - Resolves: #1154687 - POODLE: force using safe ciphers (non-SSLv3) in IPA
                         client and server
  - Resolves: #1012224 - host certificate not issued to client during
                         ipa-client-install


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-48.el6
changelog:
  - Resolves: #1263703 ipa-server-install with externally signed CA fails with
    NSS error (SEC_ERROR_BUSY)
    - Free NSS objects in --external-ca scenario
  - Resolves: #1263262 Unable to resolve group memberships for AD users when
    using sssd-1.12.2-58.el7_1.6.x86_64 client in combination with
    ipa-server-3.0.0-42.el6.x86_64 with AD Trust
    - Do not lookup up the domain too early if only the SID is known
    - Do not store SID string in a local buffer
    - Allow ID-to-SID mappings in the extdom plugin


author: Martin Basti <mbasti@redhat.com> - 3.0.0-49.el6
changelog:
  - Resolves: #1127211 ipa-server-install --uninstall produces avc
    - sysrestore: copy files instead of moving them to avoind SELinux issues
    - Use 'mv -Z' in specfile to restore SELinux context
  - Resolves: #1222999 ipa aci plugin is not parsing aci's correctly.
    - ACI plugin: correctly parse bind rules enclosed in parentheses
  - Resolves: #1225868 display browser config options that apply to the browser -
    Chrome
    - webui: add Kerberos configuration instructions for Chrome
    - Remove ico files from Makefile
    - WebUI: fix ipa_error.css
  - Resolves: #1232468 The Domain option is not correctly set in idmapd.conf when
    ipa-client-automount is executed.
    - Simplify adding options in ipachangeconf
    - ipachangeconf: Add ability to preserve section case
    - ipa-client-automount: Leverage IPAChangeConf to configure the domain for
      idmapd
  - Resolves: #1232899 ipa-client-install does not respect --realm option
    - Allow user to force Kerberos realm during installation.
  - Resolves: #1276358 Remove /usr/share/ipa/updates/50-lockout-policy.update
    file from IPA 3.0 releases
    - Remove 50-lockout-policy.update file


author: Jan Cholasta <mbasti@redhat.com> - 3.0.0-50.el6
changelog:
  - Resolves: #1225868 display browser config options that apply to the browser -
    Chrome
    - Remove ico files from Makefile
  - Resolves: #1232843 ipa-client-install errors out if client and server time
    are not in sync or unreachable
    - Skip time sync during client install when using --no-ntp
  - Resolves: #1288495 Add userCertificate index used in Smart Card
    authentication
    - add DS index for userCertificate attribute
  - Resolves: #1293588 JavaScript error in ssbrowser.html - TypeError: Cannot
    read property 'mozilla' of undefined
    - webui: fix browser detection in browserconfig.html and ssbrowser.html
  - Resolves: #1296124 Adjust Firefox configuration to new extension signing
    policy
    - webui: use manual Firefox configuration for Firefox >= 40
  - Remove binary patching from patch 0140


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-50.el6.2
changelog:
  - Resolves: #1351593 CVE-2016-5404 ipa: Insufficient privileges check in
    certificate revocation
    - cert-revoke: fix permission check bypass (CVE-2016-5404)


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-50.el6.3
changelog:
  - Resolves: #1322059 IPA Replica-Install from RHEL6 to RHEL7 Fails
    - Modififed NSSConnection not to shutdown existing database.
    - Do not erroneously reinit NSS in Dogtag interface
    - Make sure replication works after DM password is changed


author: Jan Cholasta <jcholast@redhat.com> - 3.0.0-51.el6
changelog:
  - Resolves: #1321138 Missing dependency package "python-sss-murmur" in
    ipa-server-3.0.0-50.el6.x86_64
    - SPEC: Require python2 version of sssd bindings
  - Resolves: #1367026 Document and test procedure for running IdM Server in TLS
    1.2+ environment
    - Require 389-ds-base with TLS 1.0 disable switch


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.4.1.el6]
changelog:
  - [fs] NLM: Ensure that we resend all pending blocking locks after a reclaim (Steve Dickson) [921150 913704]
  - [fs] xfs: remove log force from xfs_buf_cond_lock() (Brian Foster) [921961 896224]
  - [fs] xfs: recheck buffer pinned status after push trylock failure (Brian Foster) [921961 896224]
  - [fs] nfs: Ensure that we check lock exclusive/shared type against open modes (Dave Wysochanski) [920268 916324]
  - [powerpc] pseries: Fix partition migration hang in stop_topology_update (Steve Best) [921963 910597]
  - [infiniband] qib: correction for faulty sparse warning correction (Jay Fenlason) [922154 901701]
  - [usb] io_ti: Fix NULL dereference in chase_port() (Nikola Pajkovsky) [916198 916200] {CVE-2013-1774}
  - [net] bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Nikola Pajkovsky) [914690 914691] {CVE-2013-0349}
  - [char] tty: set_termios/set_termiox should not return -EINTR (Oleg Nesterov) [921145 904907]
  - [netdrv] ehea: fix VLAN support (Steve Best) [921535 911359]
  - [net] xfrm_user: return error pointer instead of NULL (Thomas Graf) [919388 919389] {CVE-2013-1826}
  - [net] dccp: check ccid before NULL poiter dereference (Weiping Pan) [919187 919188] {CVE-2013-1827}
  - [mm] tmpfs: fix use-after-free of mempolicy object (Nikola Pajkovsky) [915714 915715] {CVE-2013-1767}
  - [fs] fuse: set page_descs length in fuse_buffered_write() (Brian Foster) [916957 915135]
  - [fs] vfs: fix pointer dereference validation in d_validate (Carlos Maiolino) [915583 876600]
  - [fs] cifs: after upcalling for krb5 creds, invalidate key rather than revoking it (Niels de Vos) [912452 885899]
  - [fs] cifs: tmp_key_invalidate() should not set key->expiry to 0 (Niels de Vos) [912452 885899]
  - [block] disable discard request merge temporarily (Mike Snitzer) [911475 907844]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.5.1.el6]
changelog:
  - [fs] xfs: use maximum schedule timeout when ail is empty (Brian Foster) [921958 883905]
  - [net] xfrm_user: fix info leak in copy_to_user_tmpl() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_policy() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_state() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_auth() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] atm: fix info leak in getsockopt(SO_ATMPVC) (Thomas Graf) [922386 922387] {CVE-2012-6546}
  - [net] atm: fix info leak via getsockname() (Thomas Graf) [922386 922387] {CVE-2012-6546}
  - [fs] nls: improve UTF8 -> UTF16 string conversion routine (Nikola Pajkovsky) [916118 916119] {CVE-2013-1773}
  - [fs] fat: Fix stat->f_namelen (Nikola Pajkovsky) [916118 916119] {CVE-2013-1773}
  - [netdrv] tun: fix ioctl() based info leaks (Thomas Graf) [922350 922351] {CVE-2012-6547}
  - [virt] x86: Add a check to catch Xen emulation of Hyper-V (Andrew Jones) [923204 918239]
  - [fs] cifs: fix expand_dfs_referral (Sachin Prabhu) [923098 902492]
  - [fs] cifs: factor smb_vol allocation out of cifs_setup_volume_info (Sachin Prabhu) [923098 902492]
  - [fs] cifs: have cifs_cleanup_volume_info not take a double pointer (Sachin Prabhu) [923098 902492]
  - [fs] nfs: Dont allow NFS silly-renamed files to be deleted, no signal (Dave Wysochanski) [920266 905095]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.6.1.el6]
changelog:
  - [virt] kvm: accept unaligned MSR_KVM_SYSTEM_TIME writes (Petr Matousek) [917020 917021] {CVE-2013-1796}
  - [char] tty: hold lock across tty buffer finding and buffer filling (Prarit Bhargava) [928686 901780]
  - [net] tcp: fix for zero packets_in_flight was too broad (Thomas Graf) [927309 920794]
  - [net] tcp: frto should not set snd_cwnd to 0 (Thomas Graf) [927309 920794]
  - [net] tcp: fix an infinite loop in tcp_slow_start() (Thomas Graf) [927309 920794]
  - [net] tcp: fix ABC in tcp_slow_start() (Thomas Graf) [927309 920794]
  - [netdrv] ehea: avoid accessing a NULL vgrp (Steve Best) [921535 911359]
  - [net] sunrpc: Get rid of the redundant xprt->shutdown bit field (J. Bruce Fields) [915579 893584]
  - [virt] kvm: do not #GP on unaligned MSR_KVM_SYSTEM_TIME write (Gleb Natapov) [917020 917021] {CVE-2013-1796}
  - [drm] i915: bounds check execbuffer relocation count (Nikola Pajkovsky) [920523 920525] {CVE-2013-0913}
  - [x86] irq: add quirk for broken interrupt remapping on 55XX chipsets (Neil Horman) [911267 887006]
  - [kvm] Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (Gleb Natapov) [917024 917025] {CVE-2013-1797}
  - [kvm] Fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (Gleb Natapov) [917020 917021] {CVE-2013-1796}
  - [kvm] Fix bounds checking in ioapic indirect register reads (Gleb Natapov) [917030 917032] {CVE-2013-1798}
  - [kvm] x86: release kvmclock page on reset (Gleb Natapov) [917024 917025] {CVE-2013-1797}
  - [security] keys: Fix race with concurrent install_user_keyrings() (David Howells) [916681 913258] {CVE-2013-1792}
  - [virt] hv_balloon: Make adjustments to the pressure report (Jason Wang) [909156 902232]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.8.1.el6]
changelog:
  - [fs] raw: don't call set_blocksize when not changing the blocksize (Jeff Moyer) [951406 909482]
  - [x86] Allow greater than 1TB of RAM on AMD x86_64 sytems (Larry Woodman) [952570 876275]
  - [netdrv] ixgbe: Only set gso_type to SKB_GSO_TCPV4 as RSC does not support IPv6 (Michael S. Tsirkin) [927292 908196]
  - [netdrv] bnx2x: set gso_type (Michael S. Tsirkin) [927292 908196]
  - [netdrv] qlcnic: set gso_type (Michael S. Tsirkin) [927292 908196]
  - [netdrv] ixgbe: fix gso type (Michael S. Tsirkin) [927292 908196]
  - [fs] gfs2: Allocate reservation structure before rename and link (Robert S Peterson) [924847 922999]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.9.1.el6]
changelog:
  - [fs] nfs: Fix handling of revoked delegations by setattr (Steve Dickson) [960415 952329]
  - [fs] nfs: Return the delegation if the server returns NFS4ERR_OPENMODE (Steve Dickson) [960415 952329]
  - [fs] nfs: Fix another potential state manager deadlock (Steve Dickson) [960436 950598]
  - [fs] nfs: Fix another open/open_recovery deadlock (Steve Dickson) [960433 916806]
  - [fs] nfs: Hold reference to layout hdr in layoutget (Steve Dickson) [960429 916726]
  - [fs] nfs: add "pnfs_" prefix to get_layout_hdr() and put_layout_hdr() (Steve Dickson) [960429 916726]
  - [fs] nfs: nfs4_open_done first must check that GETATTR decoded a file type (Steve Dickson) [960412 916722]
  - [net] sunrpc: Dont start the retransmission timer when out of socket space (Steve Dickson) [960426 916735]
  - [fs] nfs: Dont use SetPageError in the NFS writeback code (Steve Dickson) [960420 912867]
  - [fs] nfs: Dont decode skipped layoutgets (Steve Dickson) [927294 904025]
  - [fs] nfs: nfs4_proc_layoutget returns void (Steve Dickson) [927294 904025]
  - [fs] nfs: defer release of pages in layoutget (Steve Dickson) [927294 904025]
  - [fs] nfs: Use kcalloc() when allocating arrays (Steve Dickson) [927294 904025]
  - [fs] nfs: Fix an ABBA locking issue with session and state serialisation (Steve Dickson) [960417 912842]
  - [fs] nfs: Fix a race in the pNFS return-on-close code (Steve Dickson) [960417 912842]
  - [fs] nfs: Do not accept delegated opens when a delegation recall is in effect (Steve Dickson) [960417 912842]
  - [fs] nfs: Fix a reboot recovery race when opening a file (Steve Dickson) [952613 908524]
  - [fs] nfs: Ensure delegation recall and byte range lock removal don't conflict (Steve Dickson) [952613 908524]
  - [fs] nfs: Fix up the return values of nfs4_open_delegation_recall (Steve Dickson) [952613 908524]
  - [fs] nfs: Dont lose locks when a server reboots during delegation return (Steve Dickson) [952613 908524]
  - [fs] nfs: Move nfs4_wait_clnt_recover and nfs4_client_recover_expired_lease (Steve Dickson) [952613 908524]
  - [fs] nfs: Add NFSDBG_STATE (Steve Dickson) [952613 908524]
  - [fs] nfs: nfs_inode_return_delegation() should always flush dirty data (Steve Dickson) [952613 908524]
  - [fs] nfs: nfs_client_return_marked_delegations cant flush data (Steve Dickson) [952613 908524]
  - [fs] nfs: Prevent deadlocks between state recovery and file locking (Steve Dickson) [952613 908524]
  - [fs] nfs: Allow the state manager to mark an open_owner as being recovered (Steve Dickson) [952613 908524]
  - [kernel] seqlock: Dont smp_rmb in seqlock reader spin loop (Steve Dickson) [952613 908524]
  - [kernel] seqlock: add 'raw_seqcount_begin()' function (Steve Dickson) [952613 908524]
  - [kernel] seqlock: optimise seqlock (Steve Dickson) [952613 908524]
  - [fs] nfs: don't allow nfs_find_actor to match inodes of the wrong type (Jeff Layton) [921964 913660]
  - [net] sunrpc: Add barriers to ensure read ordering in rpc_wake_up_task_queue_locked (Dave Wysochanski) [956979 840860]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.10.1.el6]
changelog:
  - [scsi] be2iscsi : Fix the NOP-In handling code path (Nikola Pajkovsky) [955504 947550]
  - [scsi] be2iscsi: Fix memory leak in control path of driver (Rob Evers) [955504 947550]
  - [virt] kvm: validate userspace_addr of memslot (Petr Matousek) [950496 950498] {CVE-2013-1943}
  - [virt] kvm: fix copy to user with irq disabled (Michael S. Tsirkin) [949985 906602] {CVE-2013-1935}
  - [net] veth: Dont kfree_skb() after dev_forward_skb() (Jiri Benc) [957712 957713] {CVE-2013-2017}
  - [net] tcp: Reallocate headroom if it would overflow csum_start (Thomas Graf) [954298 896233]
  - [net] tcp: take care of misalignments (Thomas Graf) [954298 896233]
  - [net] skbuff.c cleanup (Thomas Graf) [954298 896233]
  - [idle] intel_idle: Initialize driver_data correctly in ivb_cstates on IVB processor (Prarit Bhargava) [960864 953630]
  - [x86] Prevent panic in init_memory_mapping() when booting more than 1TB on AMD systems (Larry Woodman) [962482 869736]
  - [mm] enforce mmap_min_addr on x86_64 (Rik van Riel) [961431 790921]
  - [mm] optional next-fit policy for arch_get_unmapped_area (Rik van Riel) [961431 790921]
  - [mm] fix quadratic behaviour in get_unmapped_area_topdown (Rik van Riel) [961431 790921]
  - [scsi] Revert: qla2xxx: Optimize existing port name server query matching (Chad Dupuis) [950529 924804]
  - [scsi] Revert: qla2xxx: Avoid losing any fc ports when loop id's are exhausted (Chad Dupuis) [950529 924804]
  - [fs] defer do_filp_open() access checks to may_open() (Eric Sandeen) [928683 920752]
  - [md] dm thin: bump the target version numbers (Mike Snitzer) [924823 922931]
  - [md] dm-thin: fix discard corruption (Mike Snitzer) [924823 922931]
  - [md] persistent-data: rename node to btree_node (Mike Snitzer) [924823 922931]
  - [md] dm: fix limits initialization when there are no data devices (Mike Snitzer) [923096 908851]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.11.1.el6]
changelog:
  - [kernel] perf: fix perf_swevent_enabled array out-of-bound access (Petr Matousek) [962793 962794] {CVE-2013-2094}


author: Laine Stump <laine@redhat.com> - 0.1.6-2
changelog:
  - make miimon/arpmon in bond definitions optional
  - Resolves: rhbz#585108
  - properly deal with initializing a 0 length /etc/sysconfig/iptables file
  - Resolves: rhbz#582905


author: Laine Stump <laine@redhat.com> - 0.1.6-4
changelog:
  - install missing sysconfig.aug file
  - Resolves: rhbz#613886
  - Don't delete the physical interface config when defining a vlan
  - Resolves: rhbz#585112


author: Laine Stump <laine@redhat.com> - 0.1.7-1
changelog:
  - rebase to netcf-0.1.7
    - Resolves: rhbz#651032
    - remove all iptables manipulation
    - Resolves: rhbz#633346
    - Resolves: rhbz#629206


author: Laine Stump <laine@redhat.com> - 0.1.8-1
changelog:
  - rebase to netcf-0.1.8
    - resolves rhbz#616060
    - show ifup output in relevant error message
    - resolves rhbz#662057
    - pkgconfig file should not list augeas, libxml or libxslt
    - resolves rhbz#681078
    - Need to input 'quit' twice to quit ncftool after an erroneous command
    - resolves rhbz#703318
    - %desc field in specfile has a typo
    - resolves rhbz#705061
    - rebase netcf for RHEL6.2
    - resolves rhbz#708476
    - RFE: transaction-oriented API for handling host interfaces


author: Laine Stump <laine@redhat.com> - 0.1.9-1
changelog:
  - rebase to netcf-0.1.9
    - resolves rhbz#616060
    - always add <bridge> element to bridge, even if there is no physdev present
    - resolves rhbz#713180
    - don't log error if interface isn't found in kernel during status report
    - resolves rhbz#713286
    - update gnulib


author: Laine Stump <laine@redhat.com> - 0.1.9-2
changelog:
  - resolves rhbz#728184
    - eliminate potential use of uninitialized index/pointer in add_bridge_info
    - resolves rhbz#736920
    - resolves rhbz#739505
    - fix missing vlan/bond/ethernet info in dumpxml --live


author: Laine Stump <laine@redhat.com> - 0.1.9-3
changelog:
  - resolves rhbz#886862
    - libnl addr and link caches are not thread-safe, leading to
      libvirtd crashes


author: Laine Stump <laine@redhat.com> - 0.1.9-4
changelog:
  - resolves rhbz#844578
    - check IFF_RUNNING before considering and interface "active"
    - resolves rhbz#848722
    - fix ipcalc_netmask


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.91-2.6.2.1
changelog:
  - Bump to 2.6.2 and u91b00.
  - Drop PR2568/RH1248530 backport now applied upstream.
  - Resolves: rhbz#1271920


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.1
changelog:
  - Bump to 2.6.4 and u95b00.
  - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
  - Drop 8072932or8074489 patch as applied upstream in u91b01.
  - Drop installation of soundfont symlink following inclusion of 8140620/PR2710 in 2.6.3
  - Resolves: rhbz#1295767


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-15
changelog:
  - better documentation of the available digests in apps (#693858)
  - backported CHIL engine fixes (#693863)
  - allow testing build without downstream patches (#708511)
  - enable partial RELRO when linking (#723994)
  - add intelx engine with improved performance on new Intel CPUs
  - add OPENSSL_DISABLE_AES_NI environment variable which disables
    the AES-NI support (does not affect the intelx engine)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-16
changelog:
  - merge the optimizations for AES-NI, SHA1, and RC4 from the intelx
    engine to the internal implementations


author: <dwalsh@redhat.com> - 3.0.40-1
changelog:
  - Apply Miroslav patch that rewrites sealert option handling with using optparse. Fixing conflicting options problems.
  - Fix requires to include pygtk2-libglade


author: <dwalsh@redhat.com> - 3.0.45-1
changelog:
  - Patch from Mgrepl to stop printable from crashing if None is passed in
  - Update to latest translations


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.9
changelog:
  - selinux-polgengui should not blow up on disabled SELinux system
  Resolves: #695288
  CVE-2011-1011 policycoreutils: insecure temporary directory handling in seunshare
  Resolves: #679690
  check return value of getpwuid()
  Resolves: #684015 
  Fix semanage module -D' traceback
  Resolves: #666861 
  sandbox -- AttributeError: 'module' object has no attribute 'chcon' 	
  Resolves: #690502 	
  system-config-selinux could not open interface info 	
  Resolves: #696809
  Mv sandbox.conf.5.gz to sandbox.5.gz and put in base package
  Resolves: #690744 
  sestatus usage message not complete (missing -b option) 	
  Resolves: #705027
  correct package name in the -sandbox subpackage description 	
  Resolves: #679798
  dracut attempts to load_policy with SELinux=disabled 	
  Resolves: #659076
  Resolves: #658532
  8 options are not described in semanage man page 	
  Resolves: #677541
  Mention "semanage module" in semanage man page 	 
  Resolves: #677542
  Update translations
  Resolves: #589232 
  Allow polcycoreutils-gui and tools to run on disabled SELinux systems
  Resolves: #695288 
  Resolves: #689153


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.10
changelog:
  - Fix policycoreutils-sandbox description
  - Change sepolgen-ifgen to search all available policy files
  - Fix portspage in system-config-selinux to not crash
  - fix to sandbox 
    - Fix seunshare to use more secure handling of /tmp
      - Rewrite seunshare to make sure /tmp is mounted stickybit owned by root
     - Change to allow sandbox to run on nfs homedirs, add start python script
     - change default location of HOMEDIR in sandbox to /tmp/.sandbox_home_*
     - Move seunshare to sandbox package
     - Fix sandbox to show correct types in  usage statement
  Resolves: #679690
  Resolves: #679689
  Resolves: #677541
  Resolves: #679798
  - Fixes for sepologen 
    - Usage statement needs -n name
    - Names with _ are being prevented
    - dbus apps should get _chat interface
    - Cleaup selinux-polgengui to be a little more modern, fix comments and use selected name
    - Add sandbox to sepolgen
    - Polgengui raises the wrong type of exception.  #471078
  - Cleanup chcat man page
  - Update translations
  Resolves: #589232
  - restorecond fixes
    - Have restorecond watch more directories in homedir
    - Fix restorecond watching utmp file for people logging in our out
    - Exit in restorecond if it can not find a UID in the passwd database

  - Stop fixfiles from complaining about missing dirs

  - Semanage fixes
    - Fix up node handling in semanage command
    - Fix proper handling of getopt errors
    - Do not allow modules names to contain spaces
    - Change semanage to not allow it to semanage module -D
  Resolves: #684015
  Resolves: #677542
  - Change setsebool to suggest run as root on failure
  - Don't report error on load_policy when system is disabled.
  - Fix unchecked return value of getpwuid()
  Resolves: #684015


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.11
changelog:
  - Remove sandbox calling -k, only should be used by seunshare, should not be
  called all the time.
  Resolves: #679690
  Resolves: #679689
  Resolves: #677541
  Resolves: #679798


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.12
changelog:
  - Back port option handling in semanage to handle semodule module -D correctly
  - Back port manpage from Fedora
  Resolves: #666861


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.13
changelog:
  - Fix spec file to require rsync for sandbox
  Resolves: #734467
  - Fix spec file to require gtkhtml2 for lockdown booleans program
  Resolves: #702860
  - Fix bugs found by Coverity
  Resolves: #717640
  Resolves: #728833


author: Miroslav Grepl <mgrepl@redhat.com> 2.0.83-19.15
changelog:
  - Needs require gnome-python2-gtkhtml2 to make system-config-selinux working
  - Not use open_init_pty by default


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.16
changelog:
  - Restorecon should not be exiting with a 1 when it is successful in relabeling a file
  Resolves: #740699
  Resolves: #739587


author: Miroslav Grepl <mgrepl@redhat.com> 2.0.83-19.18
changelog:
  - Other fix for semanage man page
  Resolves: #677541
  - Don't report error on load_policy when system is disabled.


author: Andrew Beekhof <andrew@beekhof.net> - 1.6.5-0.1.git833ca18
changelog:
  - Incorporate review feedback
    + Add calls to ldconfig
    + Fix package group
    + Resolve rpmlint warnings
    + Added LICENSE, NOTICE and AUTHORS to the doc list
    + Document how the tarball was generated
    + Update version number to be a .5 pre-release snapshot


author: Nalin Dahyabhai <nalin@redhat.com> 0.7.5-8
changelog:
  - switch to only munging the contents of /etc/nslcd.conf on the very first
    install (#706454)
  - make sure that we have enough space to parse any valid GID value when
    parsing a user's primary GID (#716822,#720230)
  - tweak the default "validnames" setting to also allow shorter and shorter
    names to pass muster (#706860)


author: Nalin Dahyabhai <nalin@redhat.com> 0.7.5-9
changelog:
  - include backported enhancement to take URIs in the form "dns:DOMAIN" in
    addition to the already-implemented "dns" (#730309)


author: Nalin Dahyabhai <nalin@redhat.com> 0.7.5-10
changelog:
  - update the validnames changes to the self-tests so that their expectations
    match the modified defaults (#737496)


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-11
changelog:
  - do not overflow big UID values, use explicit base when converting UIDs
    and GIDs to integer types (#741362)


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.74
changelog:
  - Add 0195-UPBZ-1024103-alua-prio-timeout.patch
    * change alua prioritizer timeout from 5 minutes to one minute
  - Resolves: bz #1024103


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.75
changelog:
  - Add 0196-RHBZ-1012672-fix-sysdev.patch
    * rewrite multipath sysfs device handling to fix various issues from
      bzs #1012672, #1064636, and #1049637
  - Add 0197-RHBZ-1049315-netapp-rw-change.patch
    * allow reload_rewrite to be set by device, and set it by default for
      netapp devices.
  - Add 0198-RHBZ-1080052-orphan-paths-on-reload.patch
    * make multipath orphan paths that are no longer included in the device
      when the table is reread.
  - Add 0199-RHBZ-1007719-multipath-man.patch
    * documentation update
  - Add 0200-RHBZ-1009061-allow_devt.patch
    * allow specifying paths to multipath by major:minor, instead of devname
  - Add 0201-RHBZ-1018697-cli-use-basename.patch
    * make multipathd interactive commands accept device names that start with
      /dev/
  - Add 0202-RHBZ-1024604-weighted-prio-man.patch
    * documentation update
  - Add 0203-RHBZ-1054046-mpathconf-typo.patch
    * fix command output typo
  - Add 0204-RHBZ-1067102-doc-add-selectors.patch
    * documentation update
  - Add 0205-RHBZ-1072974-alua-typo.patch
    * fix priritizer output typo
  - Add 0206-UPBZ-1020556-e-series-config.patch
    * udpate E-Series config to autodetect prio and hardware handler.
  - Resolves: bz #1049637, #1064636, #1049315, #1080052, #1007719, #1009061
  - Resolves: bz #1018697, #1024604, #1054046, #1067102, #1072974, #1020556


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.76
changelog:
  - Add 0207-UPBZ-1027061-sg-read-use-buffsize.patch
    * make readsector0 checker calculate the number of blocks to read based
      on the buffer size and the block size
  - Add 0208-UPBZ-1028220-datacore-config.patch
    * Add support for DataCore Virtual Disk
  - Add 0209-RHBZ-999766-update-annotated.patch
    * update multipath.conf.annotated
  - Add 0210-UPBZ-1099932-fast-io-fail-iscsi.patch
    * and iscsi support for fast_io_fail_tmo
  - Add 0211-UPBZ-1088013-reorder-paths-for-round-robin.patch
    * make multipathd order paths for better throughput in round-robin mode
  - Add 0212-RHBZ-1086417-orphan-path-on_failed-add.patch
    * If multipathd fails to add path correctly, it now fully orphans the path
  - Add 0213-RHBZ-1069641-config-error-checking.patch
    * Improve multipath.conf error checking.
  - Resolves: bz #1027061, #1028220, #999766, #1099932, #1088013, #1086417
  - Resolves: bz #1069641


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.77
changelog:
  - Add 0214-RHBZ-1078485-configurable-prio-timeout.patch
    * checker_timeout now adjusts the timeouts of the prioritizers as well.
  - Add 0215-RHBZ-1054747-add-noasync-option.patch
    * Add a new defaults option, "force_sync", that disables the async mode
      of the path checkers. This is for cases where to many parallel checkers
      hog the CPU
  - Add 0216-RHBZ-1095868-multipathd-man-typo.patch
  - Add 0217-RHBZ-1101101-add-w-options.patch
    * multipath now includes the -w and -W options. -w makes multipath remove
      a wwid from the wwids file. -W removes all of the wwids, except for the
      ones belonging to the current multipath devices, from the bindings file.
  - Resolves: bz #1078485, #1054747, #1095868, #1101101


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.78
changelog:
  - Modify 0196-RHBZ-1012672-fix-sysdev.patch
    * remove unused function, and fix NULL ptr dereference
  - Modify 0211-UPBZ-1088013-reorder-paths-for-round-robin.patch
    * Fix some pointer errors
  - Modify 0213-RHBZ-1069641-config-error-checking.patch
    * Stop allocating extra memory in config parser.
  - Related: bz #1049637, #1069641, #1088013


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.79
changelog:
  - Modify 0198-RHBZ-1080052-orphan-paths-on-reload.patch
    * Fix case where pathlist wasn't getting updated properly
  - Related: bz #1080052


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80
changelog:
  - Add 0218-RHBZ-1117714-configure-missing-devs.patch
    * handle externally removed devices during configuration.
  - Resolves: bz #1117714


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80.1
changelog:
  - Add 0219-RHBZ-1136966-fix-partition-mapping-creation-race-with-kpartx.patch
    * Only run kpartx on device activation
  - Resolves: bz #1162265


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80.2
changelog:
  - Add 0220-RHBZ-1179728-add-wwid-option.patch
    * add multipath option "-a". To add a device's wwid to the wwids file
  - Add 0221-RHBZ-1179728-cmdline-wwid.patch
    * make multipathd read wwids specified by the kernel commandline mpath.wwid
      option on startup.
  - Resolves: bz #1179728


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.80.3
changelog:
  - Add 0222-RHBZ-1187217-thread-safe.patch
    * only multipathd will keep a global cache of sysfs information
      for paths.
  - Resolves: bz #1187217


author: Nils Philippsen <nils@redhat.com> - 1.0.21-1
changelog:
  - version 1.0.21
  - remove obsolete rpath, hal, genesys-gl841-registers patches
  - update pkgconfig, udev, man-utf8->man-encoding, epson-expression800,
    docs-utf8 patches
  - remove hal conditional
  - package man pages


author: Nils Philippsen <nils@redhat.com> - 1.0.21-3
changelog:
  - build with -fno-strict-aliasing
  - use PIC/PIE because SANE-enabled software is likely to deal with data coming
    from untrusted sources (client <-> saned via network)


author: Nils Philippsen <nils@redhat.com> - 1.0.21-4
changelog:
  - update udev rules for Fujitsu fi-6110 device (#987890)
  - fix bogus changelog dates
  - fix source URLs


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-16.P1
changelog:
  - Unexpected abort caused by a DHCPv6 decline message (CVE-2011-0413, #672995)
  - Write/accept a semi-colon at the end of the max-life and preferred-life
    clauses in dhcpv6 lease files (#672551)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-20.P1
changelog:
  - The 'hardware [ethernet|etc] ...;' parameter in host records has been
    extended to attempt to match DHCPv6 clients by the last octets
    of a DUID-LL or DUID-LLT provided by the client. (#706974)
  - Explicitly clear the ARP cache and flush all addresses & routes
    instead of bringing the interface down (#694799)
  - Use PID for seeding the random number generator in dhclient (#694798)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-21.P1
changelog:
  - A pair of defects cause the server to halt upon processing certain packets
    (CVE-2011-2748, CVE-2011-2749, #729885)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-23.P1
changelog:
  - Build libraries with -fpic/-fPIC, not with -fPIE (#736999)
  - Add dhcp-common subpackage (#736194)
  - Do not run dhcpd as root (#693381)
    - Use '--enable-paranoia' configure flag
    - Create dhcpd user in %pre
    - Run dhcpd/dhcpd6 services with '-user dhcpd -group dhcpd'
    - Move changing of the effective user/group ID after writing new PID file.


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-30
changelog:
  - oCERT-2011-003: add -R command-line option and PYTHONHASHSEED environment
  variable, to provide an opt-in way to protect against denial of service
  attacks due to hash collisions within the dict and set types
  Resolves: CVE-2012-1150


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-31
changelog:
  - fix endless loop in SimpleXMLRPCServer upon malformed POST request
  Resolves: CVE-2012-0845
  - send encoding in SimpleHTTPServer.list_directory to protect IE7 against
  potential XSS attacks
  Resolves: CVE-2011-4940


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-34
changelog:
  - add an RPATH to pyexpat.so to avoid ImportError on XML_SetHashSalt when a
  vanilla build of expat is present in LD_LIBRARY_PATH
  Resolves: rhbz#833271


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-35
changelog:
  - add -DNDEBUG to OPT during the build, disabling C-level assertions
  Resolves: rhbz#810847
  Resolves: rhbz#841748
  - avoid allocating thunks in ctypes unless absolutely necessary, to avoid
  generating SELinux denials on "import ctypes" and "import uuid" when
  embedding Python within httpd
  Resolves: rhbz#814391
  - avoid infinite loop in logging.handlers.SysLogHandler with eventlet when
  the syslog daemon is stopped
  Resolves: rhbz#835460


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-36
changelog:
  - disable patch 110 (python-2.6.5-ctypes-noexecmem.patch)
  Related: rhbz#707944
  - disable patch 129 (python-2.6.6-gc-assertions.patch) now that we're
  building with -DNDEBUG
  Related: rhbz#810847
  Related: rhbz#841748
  Related: rhbz#614680


author: Elio Maldonado <emaldona@redhat.com> - 3.12.8-2
changelog:
  - Add suppport for pkcs8 formatted keys in the pem module
  - Add verify(not md5 size mtime) to configuration files attributes
  - Prevent nss-sysinit disabling on package upgrade
  - Create pkcs11.txt with correct permissions regardless of current umask
  - Add option to setup-nsssysinit.sh to report nss-sysinit status
  - Update test certificate which had expired


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-2
changelog:
  - Prefer user database ca cert trust settings system's ones
  - Swap internal key slot on fips mode switches


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-3
changelog:
  - Add requires for pkcs11-devel on nss-softokn-freebl devel
  - Run the test suites in check section per packaging guidelines


author: Martin Stransky <stransky@redhat.com> - 17.0.8-4
changelog:
  - Fixed rhbz#818636 - Firefox allows install of addons,
    disregarding xpinstall.enabled flag set as false.


author: Martin Stransky <stransky@redhat.com> - 17.0.9-2
changelog:
  - Added patch for rhbz#983488 - Resizing window changes window
    size to 0 with third party window manager.


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-639.el6]
changelog:
  - [input] wacom: fix ExpressKeys remote events (Aristeu Rozanski) [1318027]
  - [fs] revert "writeback: remove wb_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: bdi_writeback_task must set task state before calling schedule" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: merge bdi_writeback_task and bdi_start_fn" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: harmonize writeback threads naming" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix possible race when creating bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 1" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 2" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: simplify bdi code a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not remove bdi from bdi_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move last_active to bdi" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: restructure bdi forker loop a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move bdi threads exiting logic to the forker thread" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: prevent unnecessary bdi threads wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: optimize periodic bdi thread wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: remove unnecessary init_timer call" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: cleanup bdi_register" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix bad _bh spinlock nesting" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wakeup events when forking bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: Fix lost wake-up shutting down writeback thread" (Jeff Moyer) [1322297]
  - [mm] revert "backing-dev: ensure wakeup_timer is deleted" (Jeff Moyer) [1322297]
  - [perf] revert: perf changes out of "sched, perf: Fix periodic timers" (Jiri Olsa) [1322488]


author: Cole Robinson <crobinso@redhat.com> - 0.8.6-2
changelog:
  - Don't launch consoles on app startup (bz 670735)
  - Fix connecting to VNC over unix socket (bz 651606)
  - Fix changing 'Overview' settings (bz 673463)


author: Cole Robinson <crobinso@redhat.com> - 0.8.6-3.el6
changelog:
  - Add ICH6 sound model (bz 680827)
  - Don't error if shutting down a transient domain (bz 681113)
  - Don't offer to create readonly file formats (673028)
  - Improve wording if offering to reuse existing storage (bz 669741)
  - Disallow changing format in 'customize' screen for new storage (bz 677255)


author: Cole Robinson <crobinso@redhat.com> - 0.9.0-1.el6
changelog:
  - Rebased to version 0.9.0
  - Use a hiding toolbar for fullscreen mode
  - Use libguestfs to show guest packagelist and more (Richard W.M. Jones)
  - Basic 'New VM' wizard support for LXC guests
  - Remote serial console access (with latest libvirt)
  - Remote URL guest installs (with latest libvirt)
  - Add Hardware: Support <filesystem> devices
  - Add Hardware: Support <smartcard> devices (Marc-André Lureau)
  - Enable direct interface selection for qemu/kvm (Gerhard Stenzel)
  - Allow viewing and changing disk serial number


author: Cole Robinson <crobinso@redhat.com> - 0.9.0-3
changelog:
  - Fix typo that broke net stats reporting (bz 726447)
  - Add BuildRequires: GConf2 to fix package install (bz 726325)


author: Cole Robinson <crobinso@redhat.com> - 0.9.0-5
changelog:
  - Fix autodrawer on RHEL6, unbreaks opening console window (bz 727414)
  - Update icon cache after RPM install


author: Cole Robinson <crobinso@redhat.com> - 0.9.0-6
changelog:
  - Fix 'Resize to VM' graphical option (bz 728541)
  - More explicit python binary references (bz 708181)
  - Fix launching 'create pool' dialog (bz 729226)
  - More SCSI option hiding (bz 727766)
  - Fix showing XML chars in VM name (bz 732371)
  - Fix confusion when removing device with unapplied changes (bz 728845)
  - Fix deleting guest with managed save data (bz 728155)
  - Fix error when adding default storage (bz 728497)
  - Disable unsupported RHEL6 options (bz 727766, bz 710337, bz 729590, bz
    717373)


author: Cole Robinson <crobinso@redhat.com> - 0.9.0-7
changelog:
  - Detect that RHEL6 qemu supports spice (bz 734693)
  - Properly fix crash when deleting a vm device (bz 728845)
  - Try harder to generate remote URI for localhost for p2p migration (bz
    699953)
  - Fix vm lookup race after vm creation (bz 731771)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 2.12.23-21
changelog:
  - Upgraded to 2.12.23 to incorporate multiple TLS 1.2 fixes
    (#1326389, #1326073, #1323215, #1320982, #1328205, #1321112)
  - Modified gnutls-serv to accept --sni-hostname (#1333521)
  - Modified gnutls-serv to always reply with an alert message (#1327656)
  - Removed support for DSA2 as it causes interoperability issues (#1321112)
  - Allow sending and receiving certificates which were not in the
    signature algorithms extension (#1328205)
  - Removed support for EXPORT ciphersuites (#1337460)
  - Raised the minimum acceptable DH size to 1024 (#1335924)
  - Restricted the number of alert that can be received during handshake (#1388730)
  - Added fixes for OpenPGP parsing issues (CVE-2017-5337, CVE-2017-5336, CVE-2017-5335)
  - The exposed (but internal) crypto back-end registration API is deprecated and no
    longer functional. The ABI is kept compatible (#1415682)


author: Dan Williams <dcbw@redhat.com> - 1:0.6.8-3
changelog:
  - Ensure the supplicant starts and ends with clean driver state
  - Handle driver disconnect spammage by forcibly clearing SSID
  - Don't switch access points unless the current association is dire (rh #493745)


author: Dan Williams <dcbw@redhat.com> - 1:0.6.8-7
changelog:
  - Fix supplicant initscript return value (rh #521807)
  - Fix race when connecting to WPA-Enterprise/802.1x-enabled access points (rh #508509)
  - Don't double-scan when attempting to associate


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.7.3-1
changelog:
  - Update to 0.7.3 - for nl80211 and background scanning (rh #713280)
  - Drop upstreamed and backported patches


author: Nils Philippsen <nils@redhat.com> - 2:2.6.9-1
changelog:
  - version 2.6.9

    Overview of Changes from GIMP 2.6.8 to GIMP 2.6.9
    =================================================

    * Bugs fixed:

     612618 - Font selection remains visible
     622234 - gimp.desktop: image/x-psd in MimeTypes twice
     622196 - Unportable test(1) construct in configure script
     620604 - Description of "histogram" procedure is slightly inaccurate
     541586 - Tool options not saved/loaded correctly?
     614153 - Importing PDF files with long titles
     600112 - blur-gauss-selective.exe crashes
     599233 - Dialog of "Save as BMP" ignores changes which are not made
              with a mous
     565001 - Text-Tool crashes when edit a 2.4.2 version xcf
     610478 - Layer preview suddenly stops getting updated
     609026 - leaks shared memory
     609056 - Exporting to Alias PIX format fails
     608188 - a few strings in Save as... > Raw image data dialog are always
              in English
     604820 - GEGL Operation "path" crashes GIMP
     603711 - Crashes when using path tool
     607242 - GIMP 2.7.0 fails to build against libpng 1.4.0
     606372 - Saving to .ppm fails on indexed colorspace
     605237 - the "Antialiasing..." message in the progress bar does not show
              translated
     604508 - gimp-layer-new-from-visible should work from updated projection

    * Updated and new translations:

     Asturian (ast)
     Basque (eu)
     Burmese (my)
     Catalan (ca)
     Chinese (Hong Kong) (zh_HK)
     Chinese (Taiwan) (zh_HK)
     German (de)
     Italian (it)
     Latvian (lv)
     Low German (nds)
     Romanian (ro)
     Simplified Chinese (zh_CN)
     Slovenian (sl)
     Ukrainian (uk)
     Valencian (ca@valencia)

  - remove obsolete gtk219, never-stack-trace-desktop, indexed-pnm patches
  - don't manually provide "gimp-libs%{?_isa}" in gimp-libs
  - don't package %{_datadir}/gtk-doc/html, but dirs beneath


author: Tomas Bzatek <tbzatek@redhat.com> - 1.4.3-6
changelog:
  - SFTP: Fix crash on unmount
  - FTP: Backport several PASV/EPSV fixes from upstream (#542205, #555033)
  - AFC: Use new libimobiledevice library (#565567)


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-4
changelog:
  - Add DM_DISABLE_UDEV environment variable to manage dev nodes by libdm only.
  - Recognize DM_DISABLE_UDEV environment variable for a complete fallback.
  - Do not verify udev operations if --noudevsync command option is used.
  - Automatically deactivate failed preloaded dm tree node.
  - Fix lvm2app to return all property sizes in bytes.
  - Add lvm.conf option global/thin_disabled_features.
  - Add lvconvert support to swap thin pool metadata volume.
  - Implement internal function detach_pool_metadata_lv().
  - Fix lvm2app and return lvseg discards property as string.
  - Allow forced vgcfgrestore of lvm2 metadata with thin volumes.
  - Add lvm.conf thin pool defs thin_pool_{chunk_size|discards|zero}.
  - Support discards for non-power-of-2 thin pool chunks.
  - Support allocation of pool metadata with lvconvert command.
  - Move common functionality for thin lvcreate and lvconvert to toollib.
  - Use lv_is_active() instead of lv_info() call.
  - Disallow pvmove on RAID LVs until they are addressed properly
  - Automatically restore MISSING PVs with no MDAs.
  - Do not allow --splitmirrors on RAID10 logical volumes.
  - When no '-i' argument is given for RAID10, default to 2 stripes.
  - Mirrored log is now fixed before its mirror when double-fault occurs.
  - Exit pvscan --cache immediately if cluster locking used or lvmetad not used.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-5
changelog:
  - Avoid a global lock in pvs when lvmetad is in use.
  - Fix crash in pvscan --cache -aay triggered by non-mda PV.
  - Fix memleak in device_is_usable mirror testing function.
  - Do not ignore -f in lvconvert --repair -y -f for mirror and raid volumes.
  - Fix regression that caused inability to create a snapshot of an inactive LV.
  - Remove warning about unsupported discards for non-power-of-2 thin pool chunks.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-6
changelog:
  - Limit RAID device replacement to repair only if LV is not in-sync.
  - Disallow RAID device replacement or repair on inactive LVs.
  - Fix possible race while removing metadata from lvmetad.
  - Fix possible deadlock when querying and updating lvmetad at the same time.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-7
changelog:
  - Synchronize with udev in pvscan --cache and fix dangling udev_sync cookies.
  - Fix autoactivation to not autoactivate VG/LV on each change of the PVs used.
  - Fix lvmetad updates for lvm1 format and fix reported internal errors.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-9.el6_4.1
changelog:
  - Fix alignment of PV data area if detected alignment less than 1 MB (2.02.74).
  - Give precedence to EMC power2 devices with duplicate PVIDs


author: Remi Collet <rcollet@redhat.com> - 5.3.3-27.1
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Remi Collet <rcollet@redhat.com> - 5.3.3-27.2
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-27.3
changelog:
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: John Hefferman <john.hefferman@cern.ch> -1.45
changelog:
  - -b option added for dual-boot computers. Along with server changes, allows for a plaintext machine password to be returned along with the keytab.
  - Improved error messages
  - Added timeout on verify arc command where previously missing


author: Zane Bitter <zbitter@redhat.com> 0.6.0-5
changelog:
  - Fix buffer overflow in broker wrapper
    Related: rhbz#795430
  - Move shadow-utils dependency to correct subpackage


author: Jeff Peeler <jpeeler@redhat.com> 0.6.0-6
changelog:
  - Fix man pages not being installed properly.
  - Fix permission on lockfile preventing broker daemon startup.
  - Resolves: rhbz#803718, rhbz#803590


author: Adam Jackson <ajax@redhat.com> 2.11.0-2
changelog:
  - intel-2.11.0-vga-clock-max.patch: Clamp VGA pixel clock to 250MHz,
    anything higher's going to look awful anyway. (#559426)


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 1.1.0-5
changelog:
  - Minor tweaks to summaries and descriptions.
  - Don't own /usr/include/X11.
  - Use a regular, unversioned dep on xorg-x11-filesystem.


author: Amar Tumballi <atumball@redhat.com> - 3.4.0.31rhs-1
changelog:
  - fixes to geo-replication upgrade script to handle symlink (bz#1001089)
  - fixes to glusterd to handle op-version properly to allow 'volume set' to
    happen even in older clients connected case (bz#1002871)
  - fixes in geo-replication to handle hardlink migration properly (bz#1001498)


author: Amar Tumballi <atumball@redhat.com> - 3.4.0.32rhs-1
changelog:
  - fixes to hardened build to pass execstack check in rpmdiff
  - fix the compatibility issue with older servers (bz#999944)


author: Amar Tumballi <atumball@redhat.com> - 3.4.0.34rhs-1
changelog:
  - bug fixes for 852140 950314 980778 998832 998914 998943 1000922
    1000996 1001893 1001895 1002022 1002613 1003580 1005460 1005478
    1005553 1006172 1007866 1008173 1009851 1011694 1011905


author: Arumugam Balamurugan <barumuga@redhat.com> - 3.4.0.35rhs-1
changelog:
  - bug fixes for 969461 1000948 1000936 1011694 1013556 1016971 979641
    950314 852140 980778 1006172 1005553 1005478 1007866 998914 981035


author: Arumugam Balamurugan <barumuga@redhat.com> - 3.4.0.36rhs-1
changelog:
  - bug fixes for 1002885 1021808 1007536 1017014 1012216 998786 977544
    1016385 858434 1001895 1012900 980910 1001556


author: Caius 'kaio' Chance <k at kaio.me> - 0.2.20080216.1-27.fc12
changelog:
  - Merged from F-11 tree.
  - Obsoleted cjkuni-fonts-common.
  - Resolves: rhbz#507637 (using font.{dir,scale} from upstream source)


author: Caius 'kaio' Chance <cchance at redhat.com> - 0.2.20080216.1-31.el6
changelog:
  - Resolves: rhbz#556694
  - Removes contents of -compat in spec file.
  - Removes conflicts tag in -ghostscript.


author: Caius 'kaio' Chance <cchance at redhat.com> - 0.2.20080216.1-33.el6
changelog:
  - Resolves: rhbz#559452
  - Obsolete older version of cjkuni-fonts-common should be done in cjkuni-fonts-common subpackage rather than 
    cjkuni-fonts-ghostscript subpackage.


author: Caius 'kaio' Chance <cchance at redhat.com> - 0.2.20080216.1-34.el6
changelog:
  - Resolves: rhbz#559452
  - Fix cjkuni-fonts-common shouls obsoletes cjkunifonts-common instead of itself.


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.1
changelog:
  - Rebase to Ruby 1.8.7.  Based on Mohammed Morsi's port of the 1.9.1
    spec file to Fedora 11: <http://mo.morsi.org/blog/node/318>.
    * ruby-multilib.patch (aka patch23): Rewrite the mkconfig.rb patch so that
    it may be applied unconditionally.  This addresses an rpmlint complaint
    about the arch-dependent patch.  Now, the script itself tests the target
    architecture.  Remove the ".ifarch ppc64 s390x sparc64 x86_64" conditional.


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.2
changelog:
  - Integrate addition of patch101 by Mohammed Morsi.  This fixes
    the segv-inducing marshaling bug affecting rails-3.0.0.
  - Integrate Mamoru Tasaka's path-fixing feedback, including
    updates to ruby-1.8.7-lib-paths.patch


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.3
changelog:
  - split some long lines; as in Mamoru Tasaka's 1.8.7.x spec file
  - don't require emacs; remove vestiges of emacs


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-1
changelog:
  - Resolves: rhbz#602435
  - (sitelib2): remove unused definition
  - correct search path, using changes from Mohammed Morsi's
    http://mo.morsi.org/files/ruby-1.8.7.249-5.fc13.src.rpm


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-5
changelog:
  - avoid thread-related segfault on powerpc64
    * ruby-ppc64-segv-fix.patch: New file.
    Do not ignore test failure on ppc64.
  - Resolves: rhbz#653824


author: Peter Hutterer <peter.hutterer@redhat.com> 1.0.2-1
changelog:
  - libXp 1.0.2. Drags in a bunch of general cleanup, code changes are quite
    limited and CVE-2013-2062 (#960362)


author: Paul Howarth <paul@city-fan.org> - 1:1.7.0.6-1.0.cf
changelog:
  - update to 1.7.0.6
    - JavaFX SDK and JavaFX Runtime included
    - Java Access Bridge included
    - alternative hash function (disabled by default)
    - changes to Security Warning dialog box for trusted signed and self signed
      applications
  - update tzupdater to 1_3_48-2012d


author: Paul Howarth <paul@city-fan.org> - 1:1.7.0.6-1.1.cf
changelog:
  - filter ffmpeg dependencies added by JavaFX runtime; the runtime can use
    either libavcodec.so.52 or libavcodec.so.53 (same for libavformat), but this
    cannot easily be captured as RPM dependencies - if you need the JavaFX
    runtime, install the appropriate ffmpeg package for your OS


author: Peter Hatina <phatina@redhat.com> 1.8.10-1
changelog:
  - upgrade to 1.8.10
  - see http://www.wireshark.org/docs/relnotes/wireshark-1.8.10.html
  - Related: #711024


author: Peter Hatina <phatina@redhat.com> 1.8.10-5
changelog:
  - security patches
  - Resolves: CVE-2013-6336
              CVE-2013-6338
              CVE-2013-6339
              CVE-2013-6340
              CVE-2013-7112
              CVE-2013-7114


author: Eric Sandeen <sandeen@redhat.com> 3.1.1-8
changelog:
  - mkfs.xfs: better handle misaligned 4k devices (#836433)
  - mkfs.xfs: default to physical sectorsize (#836433)
  - mkfs.xfs: clarify errors when specified AG size is too large (#730433)


author: Eric Sandeen <sandeen@redhat.com> 3.1.1-11
changelog:
  - mkfs.xfs: Use multidisk mode when geometry is on cmdline (#961501)
  - xfs_io: Update  man page to include chproj, lsproj (#962394)
  - xfs_io: Remove broken setfl command (#962394)
  - xfs_logprint: Handle multiply-logged fields (#962397)
  - xfs_repair: Handle fragmented multiblock dir2 directories (#964216)
  - xfs_repair: avoid segfault with ag_stride (#93904)


author: Michael Stead <mstead@redhat.com> 0.99.12-1
changelog:
  - Don't skip past firstboot login page on invalid user/pass (jbowes@redhat.com)
  - 805690: Turn repo gpgcheck off if no gpgkey specified. (dgoodwin@redhat.com)
  - 795552: Put safe int conversions around certain fact checks.
    (bkearney@redhat.com)
  - 804100: display an error when candlepin doesn't support release
    (jbowes@redhat.com)
  - 804227: expect a Release object instead of a bare string (alikins@redhat.com)
  - Latest string files from zanata (bkearney@redhat.com)
  - 805450: display better error message when autosubscribing
    (cduryee@redhat.com)
  - 805594: Give each "Subscribe" button in the GUI a unique at-spi name.
    (awood@redhat.com)
  - 803374: Provide unambiguous at-spi names for widgets. (awood@redhat.com)
  - 805353: subscription-manager list --help should use consistent wording for
    servicelevel option. (awood@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.13-1
changelog:
  - latest strings into keys.pot and updated from zanata (alikins@redhat.com)
  - 809611: Fix undefined variable in installedtab for expired
    (alikins@redhat.com)
  - pep8/pyflakes cleanups (alikins@redhat.com)
  - Repolib now requires a UEP connection. (awood@redhat.com)
  - Use numeric index to access portion of URL. (awood@redhat.com)
  - 807785: use a better title on the autobind wizard (jbowes@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - Add release selection to preferences dialog (alikins@redhat.com)
  - 805415: handle entitlements for socket count of 0 (alikins@redhat.com)
  - 804201: Fix sla select in firstboot after back button (jbowes@redhat.com)
  - 807477: Delay attempt to connect to RHN until after basic error checks.
    (awood@redhat.com)
  - 803374: Change the 'Subscribe' button to read 'Auto-subscribe.'
    (awood@redhat.com)
  - 808217: Add a header to the release list (bkearney@redhat.com)
  - 807153: Provide a more informative error message when encountering repodata
    errors. (awood@redhat.com)
  - 807822: Allow setting release to '' (mstead@redhat.com)
  - 807036: Instruct users to go to All Subscriptions for all SLA failures
    (bkearney@redhat.com)
  - 807407: Subscripton Manager substitutes "" for $releasever when releaseVer
    not set on consumer (wpoteat@redhat.com)
  - 803756: Trap RemoteServerException as well as RestLibException (404) for
    service-level command (mstead@redhat.com)
  - 806941: Removed unknown swapped attribute from autobind.glade.
    (mstead@redhat.com)
  - 807360: Allow the repos command to work without being registered
    (bkearney@redhat.com)
  - 806457: Fix deletion of productids with yum localinstall (alikins@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.14-1
changelog:
  - Update strings and pull latest from zanata (alikins@redhat.com)
  - 810306: Improved messaging in firstboot (mstead@redhat.com)
  - 811337: Unregister any time we return to rhsm_login (jbowes@redhat.com)
  - 811294: Refresh strings to fix broken kn.po (alikins@redhat.com)
  - 807153: Allow more aggressive deletion of product certs. (awood@redhat.com)
  - 810399: Require the latest rhn-setup-gnome for firstboot (alikins@redhat.com)
  - 810290: Use correct calculation for "Next update" time in sm-gui
    (cduryee@redhat.com)
  - Extracted the latest strings, and sent them to the zanata
    (bkearney@redhat.com)
  - 810363: Handle socket errors for bad proxy host in firstboot
    (alikins@redhat.com)
  - Latest man page and documentation (dlackey@redhat.com)
  - 809989: Add the shortened password url to the strings files.
    (bkearney@redhat.com)
  - 809989: Add a shorter URL to the registration screen (bkearney@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.15-1
changelog:
  - update translations from zanata (alikins@redhat.com)
  - 815563: Remove incorrect at-spi locators. (awood@redhat.com)
  - 795541: Environment command should omit the Library from katello
    (bkearney@redhat.com)
  - 811952: Don't try to unsubscribe old ents if we register (alikins@redhat.com)
  - 811952: Handle errors on unsubscribing ent certs (alikins@redhat.com)
  - 812929: Fix issue with selected sla not being in suitable_slas
    (mstead@redhat.com)
  - 811863: Handle unforseen errors in preferences dialog. (dgoodwin@redhat.com)
  - 812104: add "release" and "service-level" to completion (alikins@redhat.com)
  - Latest man page (bkearney@redhat.com)


author: Bryan Kearney <bkearney@redhat.com> 0.99.16-1
changelog:
  - 817390: add completion support for servicelevel (alikins@redhat.com)
  - 817117: fix completion of environment command (alikins@redhat.com)
  - 816377: handle cert migration data being missing (alikins@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.17-1
changelog:
  - latest strings from zanata (alikins@redhat.com)
  - 810236: Update facts after registering with --consumerid.
    (dgoodwin@redhat.com)
  - 818298: release --list should not display rhel-5 when only rhel-6 product is
    installed (wpoteat@redhat.com)
  - adding mention that subscription-manager-migration-data is a required package
    for the migration scripts to work, bz818767 (deon@deonlackey.com)
  - 818461: invalid date format error when using or_IN.UTF-8 (cduryee@redhat.com)
  - 815479: Incorrect owner should be relayed on service level list call.
    (wpoteat@redhat.com)


author: Michael Stead <mstead@redhat.com> 0.99.18-1
changelog:
  - 813296: Remove check for candlepin_version (jbowes@redhat.com)
  - latest strings from zanata (alikins@redhat.com)
  - 820743: fix multiline string that was not extracted (alikins@redhat.com)
  - 820080: Fix "Configuration" spelling on firstboot page (alikins@redhat.com)
  - 820671: Fix issues finding translated strings from glade (alikins@redhat.com)
  - 820765 removing reference to migration being supported on rhel 5.8 and later
    (deon@deonlackey.com)
  - 821024: Properly handle ESC on preferences dialog (mstead@redhat.com)
  - 820639: Don't show unenabled content as an available release
    (alikins@redhat.com)
  - 820743: fix some merge errors from fix for 820743 (alikins@redhat.com)
  - 820743: some multiline strings extracted into string catalog incorrectly
    (alikins@redhat.com)
  - 820080: Fix "Configuration" spelling on firstboot page (alikins@redhat.com)
  - 820027: Fix unlocalized string blurb for "list --servicelevels"
    (alikins@redhat.com)
  - 820042: update translations from zanata (alikins@redhat.com)
  - 819808: Fix untranslated string "No service levels..." (alikins@redhat.com)
  - 820040,820037,820030: don't break multibyte help blurbs (alikins@redhat.com)
  - 819828: Add translated strings for missing translations (alikins@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.99.19-1
changelog:
  - 824100: fix pt_BR translations, and update zanata (alikins@redhat.com)
  - 822057: do not hard-code cdn to port 443 (cduryee@redhat.com)
  - 820743: fix translation errors for "service-level" command
    (alikins@redhat.com)


author: Chris Duryee (beav) <cduryee@redhat.com>
changelog:
  - rev version so next will be 0.99.19.1 (cduryee@redhat.com)
  - 818383: display better messages for yum plugin usage (cduryee@redhat.com)


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-285
changelog:
  -Allow munin apache scripts to manage munin logs and talk with httpd over unix stream socket. 
  Resolves:#1286052
  -Allow httpd to send generic signal to httpd suexec if htpasswd is invoked. Resolves:#1286007
  -Dontaudit httpd running as piranha_web_t accesses to snmp mib indexes. 
  Resolves:#1285674
  -Allow ipsec running as ipsec_t to create pluto.log with correct labeling.
  Resolves:#1267212
  -Allow whack executed by sysadm SELinux user to access /var/run/pluto/pluto.ctl. It fixes "ipsec auto --status" executed by sysadm_t. 
  Resolves:#1257591
  -Dontaudit attemps to write generic tmp_t dirs if gnome-keyring-daemon runs under passwd_t domain. 
  Resovles:#1131531


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-286
changelog:
  - arping running as netutils_t sys_module capability for removing tap devices. Dontaudit this access.
  - Allow hv_vss_daemon to write access on all mount point directories to make VSS live backup if working if there is home partition.
  - Add support for squid to be able to create temoporary files. 
  Resolves:#1291164
  - Allow usbhid-ups to access /proc/bus/usb to have it working on ppc64 machines. 
  Resolves:#1290693
  - Add support for /var/run/chronyd.sock. 
  Resolves:#1290310
  - Update apache_content_template() inteface to allow "shutdown" permissions for apache scripts on unix_stream_socket. 
  Resolves:#1286052
  - Fix label for /var/lib/graphite-web 
  Resolves:#1221934
  - Dontaudit rpm write access for prelink_mask_t Resolves:#1216907
  - Allow apcupsd_t to communicate with sssd Add default label for /var/lock/subsys/apcupsd and /var/lock/LCK.
  Resolves:#1286030
  - Allow shorewall_t to create netlink_socket 
  Resolves:#1290705


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-287
changelog:
  - Allow sssd-ifp to dbus chat with all users. 
  Resolves:#1296693
  - Allow keepalived to connect to 3306/tcp port - mysqld_port_t.
  Resolves:#1296854
  - Add support for stunnel custom log files, allow transition and label /log/stunnel* log files. 
  Resolves:#1296238
  - Provide conman_unconfined_script_exec_t/conman_unconfined_script_t SELinux types used for conman scripts.
  - Resolves:#1290565
  - Allow ctdbd trasition to smbcontrol_t when "ctdb disablescript 50.samba" is executed.
  - Resolves:#1293787
  - Label ctdbd event scripts as ctdbd_exec_t instead of bin_t. 
  Resolves:#1293787
  - Allow watchdog to read localization files. It wants to access localtime. 
  Resolves:#1267974
  - Backport rules allowing sssd_t to be able to request the kernel to load a module.
  Resolves:#1246634


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-288
changelog:
  - Allow netutils_t domain to chown capability.
  Resolves:#1298514
  - Allow all jabber domain to access SSL certs.
  Resolves:#1261145
  - Allow shorewall request kernel load module
  Resolves:#1290705
  - Allow passwd to create temporary files to support ssh logins if gnome-keyring-daemon is called by passwd and runs in passwd_t.
  Resolves:#1131531
  - Allow stunnel to write log outputs on users pty.
  Resolves:#1296238
  - Allow polkit-1/actions to get attributes for all filesytems.
  Resolves:#1301561
  - Allow p11-child to connect to apache ports. Allow p11-child  to manage authentication cache.


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  Related: #1326621


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.1
changelog:
  - Allow ipc_lock capability for glusterd.
  - GlusterFS volumes of RDMA transport proceed fuse mount and requires ipc_lock capability.
  Resolves: #1388582


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.2
changelog:
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1393267
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs
  Resolves: rhbz#1393253


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-19.el6
changelog:
  - Client installation crashes when Kerberos SRV record is not found (#889583)
  - Fix typo in patch 0048 for CVE-2012-5484 (#878220)


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-20.el6
changelog:
  - Set maxbersize to a large value to accomondate large CRLs during replica
    installation. (#888956)
  - Set minimum version of pki-ca, pki-slient and pki-setup to 9.0.3-29 to
    pick up default CA validity period of 20 years. (#891980)


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-21.el6
changelog:
  - Properly handle migrated uniqueMember attributes (#894090)
  - ipa permission-find using valid targetgroup throws internal error (#893827)
  - Fix migration of CRLs to new directory location (#893722)
  - Installing IPA with a single realm component sometimes fails (#893187)


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-22.el6
changelog:
  - Set minimum version of bind-dyndb-ldap to 2.3-2 to pick up missing DNS
    zone SOA serial fix (#894131)
  - Stopped named service crashed ipa-upgradeconfig program (#895298)
  - ipa-replica-prepare crashed when manipulating DNS zone without SOA
    serial (#894143)
  - Use new certmonger locking to prevent NSS database corruption during
    CA subsystem renewal (#883484)
  - Set minimum selinux-policy to 3.7.19-193 to allow certmonger to talk
    to dbus in an rpm scriptlet. (related #883484)
  - Set minimum vresion of certmonger to 0.61-3 for new locking scheme
    (related #883484)


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-23.el6
changelog:
  - Installer should not connect to 127.0.0.1. (#895561)
  - Don't initialize NSS if we don't have to. (#878220)


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-24.el6
changelog:
  - Add certmonger condrestart to server post scriptlet (#903758)
  - Make certmonger a (pre) Requires (#903758)
  - Add selinux-policy to Requires(pre) to avoid post scriptlet AVCs
    (#903758)
  - Set minimum version of pki-ca to 9.0.3-30 and add to Requires(pre)
    to pick up certmonger upgrade fix (#902474)
  - Update anonymous access ACI to protect secret attributes (#902481)


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-26.el6_4
changelog:
  - Significant decrease in migration performance. (#908308)
  - ipa-client-install failed to fall over to replica with master down (#909161)
  - During Migration - If Schema is unavailable migration fails (#908400)


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-26.el6_4.2
changelog:
  - Missing LDAP schema attributeType and objectClass after upgrade (#916535)
  - ipa-adtrust-install and ipa-replica-conncheck may not parse krb5.conf
    correctly and crash (#917065)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-5
changelog:
  - script-login did not drop privileges correctly (#709095)
  - fix directory traversal due to not obeying chroot directive (#709097)
  - check proxy destination host against SSL certificate name (#754980)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-8.3
changelog:
  - mention it in config file, that we disabled SSLv2 and SSLv3
    by default (#1174158)
  - add ssl_protocols configuation option and disable SSLv2 and SSLv3
    by default (#1174158)


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.55
changelog:
  - Modify 0131-RHBZ-662433-override-queue-no-daemon.patch
    * enforce queueing on condrestart as well
  - Add 0142-RHBZ-769527-fix-features-build.patch
    * remove "queue_if_no_path" feature when flushing due to
      "flush_on_last_del"
  - Add 0143-RHBZ-467709-followover-chkr-state.patch
    * Only failback if the path checker's reported state has changed
  - Resolves: bz #467709, #769527
  - Related: bz #662433


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.56
changelog:
  - Modify 0137-RHBZ-799842-change-netapp-config.patch
    * Add pg_init_retries to netapp config
  - Add 0144-RHBZ-812832-shutdown-crash.patch
    * kill waiter threads with pthread_cancel() instead of SIGUSR1
  - Resolves: bz #799842, #812832


author: Benjmain Marzinski <bmarzins@redhat.com> -0.4.9.57
changelog:
  - Add 0145-RHBZ-831045-realloc-vector.patch
    * fix deleting items from vector, and handle error cases
  - Resolves: bz #831045


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.59
changelog:
  - Add 0146-RHBZ-595692-fix-cciss-names.patch
    * convert cmdline cciss names to sysfs format
  - Add 0147-RHBZ-824243-826610-833124-doc-fix.patch
  - Add 0148-RHBZ-619173-storagetek-config.patch
  - Add 0149-RHBZ-810788-remove-dups.patch
    * remove duplicates from builtin configs
  - Add 0150-RHBZ-810755-update-conf-defaults.patch
  - Add 0151-RHBZ-822389-fix-rename.patch
    * make multipath switch names on reload after disabling
      user_friendly_names
  - Add 0152-RHBZ-735459-mpath_persist.patch
    * mpathpersist allows persistent reservatoins through multipath devices
  - Add 0153-RHBZ-839386-retain_hwhandler.patch
    * add retain_attached_hw_handler default and multipaths config option
  - Add 0154-RHBZ-578114-kpartx-retry.patch
    * retry on EBUSY for loop device deletes
  - Add 0155-RHBZ-810989-load-modules.patch
    * service multipathd start loads kernel modules
  - Add 0156-RHBZ-813963-new-alua-prio.patch
    * combine the "alua" and "tpg_pref" prioritizers
  - Add 0157-RHBZ-816717-flush-full-paths.patch
    * make multipath accept full pathnames in -f
  - Add 0158-RHBZ-821885-check-blacklist.patch
    * make multipath -c check the device blacklisting
  - Add 0159-RHBZ-818367-829065-rdac.patch
  - Add 0160-RHBZ-841732-dont-swap-devices.patch
  - Resolves: bz #595692, #824243, #826610, #833124, #619173, #810788, #810755
  - Resolves: bz #822389, #735459, #839386, #578114, #810989, #813963, #816717
  - Resolves: bz #821885, #818367, #829065, #841732


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.60
changelog:
  - Add 0161-RHBZ-836890-AIX-whitespace.patch
  - Add 0162-RHBZ-860748-early-blacklist.patch
    * blacklist devices as soon as possible
  - Add 0163-RHBZ-839386-detect-prio.patch
    * add default and device configuration option detect-prio
  - Add 0164-RHBZ-839386-netapp-config.patch
  - Modify 0153-RHBZ-839386-retain_hwhandler.patch
    * cleanup minor issues
  - Resolves: bz #836890, #860748, #839386


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.62
changelog:
  - Add 0165-RHBZ-869253-disable-libdm-failback.patch
    * multipathd and kpartx now set a flag to request device-mapper
      not create devices itself.
  - Resolves: bz #869253


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.63
changelog:
  - Add 0166-RHBZ-880487-make-path-fd-readonly.patch
    * revert change from 0152-RHBZ-735459-mpath_persist.patch, so that
      path fds are again opened O_RDONLY
  - Resolves: bz #880487


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.64
changelog:
  - Add 0167-RHBZ-735459-fix-mpathpersist-fns.patch
    * make reservation_key display correctly in "multipathd show config"
  - Resolves: bz #735459


author: Ade Lee <alee@redhat.com> 9.0.3-12
changelog:
  - Resolves #689909 - Dogtag installation under IPA takes too much
    time - remove the inefficient sleeps, r2097


author: Ade Lee <alee@redhat.com> 9.0.3-13
changelog:
  - Resolves #698796: Race conditions during IPA installation, r2103 (alee)
  - Resolves #708075 - Clone installation does not work over NAT, r2104 (alee)
  - Resolves #726785 - If replication fails while setting up a clone it 
    will wait forever, r2106 (alee)
  - Resolves #691076 - pkiremove removes the registry entry for all instances
    on a machine, r2112 (mharmsen)
  - Resolves #693835 - /var/log/tomcat6/catalina.out owned by pkiuser, r2118
    (mharmsen)
  - Resolves #729126 - Increase default validity from 6mo to 2yrs in IPA
    profile, r2125 (awnuk)
  - Resolves #728651 - CS8 64 bit pkicreate script uses wrong library name
    for, r2126 (mharmsen)
  - Resolves #700522 - pki tomcat6 instances currently running unconfined,
    r2128 (alee)


author: Ade Lee <alee@redhat.com> 9.0.3-14
changelog:
  - Resolves #700522 - pki tomcat6 instances currently running unconfined, 
    allow server to come up when selinux disabled, r2149


author: Ray Strode <rstrode@redhat.com> 2.28.2-13
changelog:
  - GDM doesn't handle keyboard selection for the session anymore,
    yet it still claims to.  Ignore what it says.
    Resolves: #693843


author: Olivier Fourdan <ofourdan@redhat.com> 2.28.2-17
changelog:
  - wacom: add support for NV-CONTROL extension (#805036)
  - wacom: fix button mapping (#805042)
  - wacom: add LED support from upstream (#805064)
    Resolves: #805036 #805042 #805064


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-8.el6
changelog:
  - Fix ambiguous error msg in automount indirect map creation (#790131)
  - Invalid error message attempting to delete config attributes (#791373)
  - Enforce single-value attributes (#794746)
  - config-mod allowed to add additional certificate subjects bases (#794750)
  - Embedded carriage returns in a CSV not handled (#797569)
  - WebUI displays "Insufficient access: invalid credentials" when a password
    doesn't meet policy requirements (#802786)
  - Tech Preview: SELinux User Mapping (#803821)
  - Tech Preview: Add support for central management of the SSH keys (#803822)
  - Password Policy Failure Interval Reset is not working. (#804096)
  - Set SELinux booleans properly (#806330)
  - DNS records in LDAP are publicly accessible (#807361)
  - Upgrading replication agreements without nsDS5ReplicatedAttributeList fails
    (#808201)
  - IPA Upgrade Web UI failure with internal server error (#809262)
  - Do not create private groups for migrated users (#809560)


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-9.el6
changelog:
  - Fix password policy history enforcement (#810900)
  - Privilege page should not have choice to list permissions by "indirect
    membership" (#810350)
  - ipa-server-install fails when domain name is not resolvable (#809190)
  - Identity->DNS->Settings:Forward policy: change check box to radio buttons
    (#808620)
  - When adding permissions for a type, attributes that are not allowed are
    listed (#807755)
  - user-mod --rename is successful for more than max login characters
    (#807417)
  - Can't specify netgroup host, user category to all in Web UI (#807366)
  - Permission names cannot contains '<' or '>' (#807304)
  - ipa-server-install --uninstall errors out when trying to start dirsrv.
    (#801376)
  - Should not be allowed to run host-disable on an IPA Server or
    service-disable on an IPA Server service  (#800119)
  - permission with filter or subtree does not allow attr to be specified
    (#783536)
  - Netgroups compat plugin not reporting users correctly (#767372)
  - certmonger renews server certificates ok but those services need a restart
    (related #766167)
  - Set minimum vresion of certmonger to 0.56 (related #766167)
  - Set minimum version of slapi-nis to 0.40 (#767372)
  - Unable to disable or enable hbacrule with --setattr (#810948)
  - When adding a user with --noprivate option gidNumber should be required
    (#805546)
  - Fix error when no value is given in --revocation-reason optional argument
    with "ipa cert-revoke" (#808099)
  - Set minimum version of bind-dyndb-ldap to 1.1.0-0.5.b1 (related #805814)


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-10.el6
changelog:
  - Don't interactively prompt for dnsrecord options provided on the
    command-line options (#790295)
  - Validate external hosts added to netgroups (#797256)
  - Handle invalid RDN for container in migration (#804807)
  - Unable to use permission-mod to rename permission object (#805478)
  - Migration: don't append basedn to container if it is included (#807371)
  - Raise correct exception when LDAP limits are exceeded (#808042)
  - Notify user that password needs to be reset in forms-based login (#811296)
  - DNS Resource records: add & delete A & AAAA record does not work in root
    (#811744)
  - user-mod --rename with an empty string fails (#811748)
  - DNS CNAME record: delete sometimes does not work (#811758)
  - Delegation UI does not allow to specify permission (#812110)
  - IPA uninstall after upgrade returns some sysrestore.state errors (#812391)
  - Improve migration plugin error when 2 groups have identical GID (#813389)


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-11.el6
changelog:
  - Make new DNS permission mixed-case (#807361)
  - hbactest returns failure when hostgroups are chained (#801769)
  - Man Page : Document client IP addressing / FQDN requirements (#768257)
  - Login failed attempts counter or locked out status are not displayed (#759501)
  - Wrong title and icon in login and logout pages (#814752)


author: Rob Crittenden <rcritten@redhat.com> - 2.2.0-12.el6
changelog:
  - Remove patch 0042 and add revert patch for handling which attributes are
    allowed in a permission. (#783502)
  - ipa-client-install sets "KerberosAuthenticate yes" in sshd.conf, breaking
    SSSD auth (#817030)
  - pwpolicy_find does not sort by priority in UI (#815799)
  - Improve zonemgr validation (#745705)


author: Harald Hoyer <harald@redhat.com> 004-347
changelog:
  - backport of the rootfallback= kernel cmdline option
  Resolves: rhbz#737687
  - call iscsistart regardless of network failures
  Resolves: rhbz#1099603
  - set the firmware loading timeout to 600
  Related: rhbz#1077186
  - add install_items to dracut.conf man page
  Resolves: rhbz#1041484
  - pickup nvme driver
  Resolves: rhbz#1041484
  - create  /dev/btrfs-control
  Resolves: rhbz#1070676
  - create all hook directories
  Resolves: rhbz#1051448


author: Konstantin Ryabitsev <icon@fedoraproject.org> - 0.9.4-2
changelog:
  - Add hotfix for broken py-def (#220843)
  - Simplify kid and kidc to not require setuptools to run (#220844)


author: Kyle McMartin <kmcmarti@redhat.com> 3.1.2.1-1
changelog:
  - update to 3.1.2.1
  - add some shell functions to make life easier for multi-versioned firmware
    filenames that are now upstream


author: Kyle McMartin <kmcmarti@redhat.com> - 3.2.21.1-1
changelog:
  - update to 3.2.21.1, linked to 3.2.1.0 based on Brocade's submission
    for 3.11 ( http://marc.info/?l=linux-scsi&m=136843872927453&w=2 )
    Resolves: rhbz#928990


author: Richard W.M. Jones <rjones@redhat.com> - 1.3-4.1
changelog:
  - Add support for IBM PowerVM Lx86 Linux/x86 emulator (RHBZ#668857).
  - Move configure into build (not prep).


author: Richard W.M. Jones <rjones@redhat.com> - 1.3-4.2
changelog:
  - Add support for Microsoft HyperV (RHBZ#670272).
  - Add support for Hitachi Virtage (RHBZ#670530).
  - Add support for EC2 (Xen) instances (RHBZ#671126).  This includes
    backporting the test framework and enabling tests.
  - Add support for IBM Systemz z/VM, LPAR (RHBZ#671132).


author: Richard W.M. Jones <rjones@redhat.com> - 1.3-4.4
changelog:
  - Various improvements to the wording in the manual page.
    resolves: rhbz#672285
  - Confirm support for Microsoft HyperV and add a regression test.
    resolves: rhbz#670272


author: Richard W.M. Jones <rjones@redhat.com> - 1.11-1.1
changelog:
  - Rebase to virt-what 1.11.
    resolves: rhbz#672211
  - Add patch "IA64 Xen HVM should print 'xen-hvm' not 'xen-domU'" from upstream.


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.146
changelog:
  - Fix memory order when reading libgcc handle (#905941).
  - Fix format specifier in malloc_info output (#1027261).
  - Fix nscd lookup for innetgr when netgroup has wildcards (#1054846).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.147
changelog:
  - Fix stack overflow due to large AF_INET6 requests (CVE-2013-4458, #1111460).
  - Fix buffer overflow in readdir_r (CVE-2013-4237, #1111460).


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.9-6
changelog:
  - opt kernel out of showing smolt information in abrt bug reports. rhbz#795548
  - ABRT mailx plugin on by default causes crashes being always labelled as reported rhbz#803618
  - pkg-config --cflags libreport includs -fPIC rhbz#803736
  - Coverity revealed memory leaks and possibly other issues rhbz#809416
  - GLib warnings by report-gtk when crash dir does not exist rhbz#813283
  - `report' tool requires current working directory to be a crash dir rhbz#817051
  - Searching for duplicate anaconda bugs while reporting exception against partner-bugzilla during install fails rhbz#820985
  - Undefined non-weak symbols rhbz#826745
  - ABRT has wrong URL in dialog
  Resolves: #809416,#813283,#817051,#826745,#820985,#795548,#803618,#803736


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.9-7
changelog:
  - don't warn about daemon connection when deleting a problem rhbz#799909
  - ignore non problem dirs when cleaning old problems rhbz#847291
  - Resolves: #799909, #847291


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.9-8
changelog:
  - use the default template for bz reports rhbz#747410
  - fix adding users to CC in bugzilla rhbz#841338
  - Resolves: #747410, #841338


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.9-10
changelog:
  - updated translation rhbz#864025
  - fixed brewtap warnings rhbz#812283
  - silence few rpmdiff warnings rhbz#857425
  - Resolves: #864025, #812283, #857425


author: Michal Hlavinka <mhlavink@redhat.com> - 39-5
changelog:
  - fix crash when bad substitution is used
  - fix crash when alias contains alias
  - fix crash when xtrace is enabled
  - use alternatives for ksh/mksh selection


author: Michal Hlavinka <mhlavink@redhat.com> - 39-9
changelog:
  - tab completion did not work correctly with files containing multibyte 
    characters in name (#771198)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Martin Sivak <msivak@redhat.com> - 3.9-18
changelog:
  - Fix a segfault when overrides line was incomplete
    Resolves: rhbz#673100
  - Added backports directory to depmod search path
    Resolves: rhbz#761511


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Add reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - ABS_JAVA_HOME_DIR is no longer used in the latest tapsets
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.0
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-9
changelog:
  - Update fix_multiple_open patch to fix regression in openldap client
  - Remove pk11_genobj_leak patch, which caused crash with Firefox
  - Add comment in the policy file to preserve the last empty line
  - Disable SHA384 ciphersuites when CKM_TLS12_KEY_AND_MAC_DERIVE is not
    provided by softoken; this superseds check_hash_impl patch


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.8-7
changelog:
  - [abrt] abrt-addon-ccpp-2.0.7-4.fc17: abrt-action-analyze-core:106:extract_info_from_core:IndexError: list index out of range rhbz#804309
  - abrt-addon-python: The process might hang forever if no one collects the dump it sends rhbz#808562
  - Reporting may fail with: "abrt-bodhi: command not found" rhbz#810309
  - too strict check for tainted kernel rhbz#814594
  - "abrt-ccpp status" returned no status messages rhbz#820475
  - abrt missing dependency: libreport-plugin-bugzilla rhbz#828673
  - abrt-addon-python: The process might hang forever if no one collects the dump it sends rhbz#837333
  - don't remove new problems from abrt-upload directory rhbz#839285
  - Resolves: #839285, #828673, #810309, #820475, #828673, #808562, #837333, #804309, #814594, #814594


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.8-8
changelog:
  - hopefully fixed ugly applet icon rhbz#797078
  - abrt-install-ccpp-hook: fix the check for %e presense rhbz#851097
  - abrt-harvest-vmcore: add CopyVMcore config option to copy vmcores. Closes rhbz#847227
  - fixed problems discovered by brewtap rhbz#812284
  - don't try to run dbus-send if it's not installed rhbz#811901
  - Resolves: #797078, #851097, #847227, #812284, #811901


author: Denys Vlasenko <dvlasenk@redhat.com> 2.0.8-13
changelog:
  - Prevent daemon from being stuck (unresponsive to socket connects)
    while post-create even runs
  - Prevent infinite loop of crashes
  - Resolves: #826924


author: Zdenek Pavlas <zpavlas@redhat.com> - 1.1.30-11
changelog:
  - Add show-changed-rco command
  - Resolves: rhbz#684925
  - Return 1 if any pkg download/gpg check fails.
  - Resolves: rhbz#701096
  - Add --compare-arch option.
  - Resolves: rhbz#710579
  - Get rid of double download attempts.
  - Resolves: rhbz#711767
  - yum-debug-restore: handle multiple kernel packages
  - Resolves: rhbz#737597
  - package-cleanup: handle kernel-PAE, keep N of each kernel package name.
  - Resolves: rhbz#769775
  - package-cleanup man page: update description of --count option.
  - Resolves: rhbz#782338


author: Marek Kasik <mkasik@redhat.com> 2.3.11-7
changelog:
  - Add freetype-2.3.11-CVE-2010-3855.patch
      (Protect against invalid `runcnt' values.)
  - Resolves: #651762


author: Marek Kasik <mkasik@redhat.com> 2.3.11-8
changelog:
  - Add freetype-2.3.11-CVE-2011-0226.patch
      (Add better argument check for `callothersubr'.)
      - based on patches by Werner Lemberg,
        Alexei Podtelezhnikov and Matthias Drochner
  - Resolves: #723468


author: Marek Kasik <mkasik@redhat.com> 2.3.11-13
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Properly initialize array "result" in
    FT_Outline_Get_Orientation()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806269


author: Marek Kasik <mkasik@redhat.com> - 2.3.11-15.el6_6.1
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197737


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.54-1
changelog:
  - specfile: require newer lvm
  - ifdown-eth: add timeout for when flushing global scope
  - functions: support boolean values in is_true() & is_false()
  - ifup-aliases: do not return with error when arping fails
  - netconsole: resolve domain name via 'getent' instead of 'hosts'


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.55-1
changelog:
  - ipcalc: detect invalid mask
  - ifup-aliases: send gratuitous ARPs when adding addresses
  - network: treat other tunnel interfaces (fixes ifdown stage)
  - kexec-disable.conf: release kexec memory properly
  - network-functions: do not send hostname via dhclient everytime
  - sysconfig/network: NO_DHCP_HOSTNAME option introduced
  - ipv6_add_addr_on_device: replace the existing address on NIC


author: Dan Horák <dan@danny.cz> - 1.28-1
changelog:
  - update to version 1.28
  - added fixes from RHEL to rescan-scsi-bus.sh
  - added scsi-rescan symlink to the rescan-scsi-bus.sh script


author: David Knox <dknox@redhat.com> 0:6.0.24-80
changelog:
  - Related: CVE-2013-4590  - remove xml schema names javaee_5,
  - javaee_web_services_1_2, and javaee_web_services_1_2_client
  - from descriptor.DigesterFactory initialization. These
  - schema definitions are not relevant to 6.0.24 as the version
  - of their spec did not exist at the time.
  - Resolves: rhbz#1140855 - request parameter truncated


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.58.1.11.10
changelog:
  - Updated to icedtea6 1.11.10
  - rewritten java-1.6.0-openjdk-java-access-bridge-security.patch
  - excluded aarch64.patch
    - by patch 8 -  removingOfAarch64.patch.patch
  - Resolves: rhbz#950386


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.59.1.11.11
changelog:
  - Updated to icedtea6 1.11.11 - fixed xalan/xerxes privledges
  - removed patch 8 -  removingOfAarch64.patch.patch - fixed upstream
  - Resolves: rhbz#950386


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.60.1.11.11
changelog:
  - added and applied (temporally) one more patch to xalan/xerces privileges
   - patch9 jaxp-backport-factoryfinder.patch
  - will be upstreamed
  - Resolves: rhbz#950386


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950386


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.62.1.11.11.90
changelog:
  - updated to icedtea6-1.11.11.90.tar.gz
  - removed upstreamed patch9 jaxp-backport-factoryfinder.patch
  - removed upstreamed patch10 fixToFontSecurityFix.patch.
  - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#973129


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.63.1.11.13
changelog:
  - removed upstreamed  patch100  8000791-regression-fix.patch
  - bumped release
  - updated to icedtea-1.11.13
  - Resolves: rhbz#992909


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-1.66.1.13.0
changelog:
  - updated to icedtea 1.13
  - updated to openjdk-6-src-b28-04_oct_2013
  - added --disable-lcms2 configure switch to fix tck
  - removed upstreamed patch7,java-1.6.0-openjdk-jstack.patch
  - added patch7 1.13_fixes.patch to fix 1.13 build issues
  - adapted patch0 java-1.6.0-openjdk-optflags.patch
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - adapted patch8 java-1.6.0-openjdk-timezone-id.patch
  - removed useless runtests parts
  - included also java.security.old files
  - Resolves: rhbz#1017618


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.68.1.11.14
changelog:
  - updated to icedtea6-1.11.14.tar.gz
  - added and applied 1.11.14-fixes.patch, patch10 to fix build issues
  - adapted patch8 java-1.6.0-openjdk-timezone-id.patch
  - Resolves: rhbz#1017618


author: Richard Hughes <rhughes@redhat.com> - 2.28.3-1
changelog:
  - Update to 2.28.3
  - When we ask to logout, actually logout, rather than shutdown
  - Don't hide the restart status icon just because the daemon exited
  - Don't check for updates every day when the user had specified 'Never'
  - Allow the user to select the GPG key information to be able to verify it
  - Fix the error when the user clicks the about menu item
  - Fix a crash where the desktop file that was installed has no root directory
  - Fix a crash when the process-working icon has zero height
  - Resolves: #585086


author: Richard Hughes <rhughes@redhat.com> - 2.28.3-2
changelog:
  - Backport a patch from upstream that adds support for support media repos
    such as those found on additional CDs or DVDs.
  - This patch just calls GetUpdates after a detected media repo is inserted,
    which is enough for PackageKit to add the repo to the default set, and for
    the repo to be used in all the GNOME and KDE tools.
  - This patch will not add explicit support for media repos in client programs,
    so the media is not requested if it is not inserted when the package tools
    are open. This functionality can be backported at a later time if required.
  - Resolves: #591534


author: Richard Hughes <rhughes@redhat.com> - 2.28.3-4
changelog:
  - Don't allow shutting down when a transaction is active and cannot
    be cancelled.
  - Resolves: #669798


author: Richard Hughes <rhughes@redhat.com> - 2.28.3-6
changelog:
  - Fix the progress update of the update viewer when multiarch packages
    are installed.
  - Resolves: #744906


author: Richard Hughes <rhughes@redhat.com> - 2.28.3-7
changelog:
  - Do not attempt to refresh the updates list when a transaction is in
    progress. This prevents the update UI from going blank.
  - Resolves: #744980


author: Jiri Vanek <jvanek@redhat.com> - 1.6.0.0-1.31.b17
changelog:
  - excluded bin/javaws files
  		exclude  /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/bin/javaws
  		files devel
  		exclude  /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/bin/javaws

  - garbage removed to separated file
  - Resolves: rhbz#639954


author: Laine Stump <laine@redhat.com> - 0.2.4-1
changelog:
  - rebase to netcf-0.2.4
   - resolves rhbz#851748
   - avoid use of uninitialized data when getting mac address
     resolves rhbz#1052156
   - eliminate duplicate quotes in bonding options
   - resolves rhbz#879055
   - wait for IFF_UP and IFF_RUNNING after calling ifup
   - don't require IFF_RUNNING for bridge devices
   - avoid memory leak in debian when listing interfaces
   - limit interface names to IFNAMSIZ-1 characters in length
   - support systemd for netcf-transaction


author: Warren Togami <wtogami@redhat.com> - 2.6.6-2
changelog:
  - Upstream backports:
      0e3079d15adeb12c1e57ceaf5bf037f9b71c8abd Fix AIM SSL clientLogin
      b14ee507e932a395a0e1f29298af162c8614ca0f Fix AIM clientLogin with proxy


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.2.el6]
changelog:
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.3.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-2
changelog:
  - Revert the version not to be rebased.
  - Fix bug 608988 - Cannot de-select Hanja lock in applet menu
    Resolves: #608988


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-4
changelog:
  - Resolves: #651915 Wrong window position with ibus-x11
    Added ibus-651915-x11-position.patch
  - Resolves: #633330 Fixed kn.po
  - Resolves: #635541 Fixed gu.po
    Added ibus-1.3.4-po-2010-11-17.tar.bz2


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-6
changelog:
  - Fixed Bug 667031 - ibus requires dbus-x11
  - Fixed Bug 670137 - QT_IM_MODULE=xim in ibus.conf without ibus-qt


author: Doug Ledford <dledford@redhat.com> - 3.2.1-1
changelog:
  - Update to latest upstream release
  - Don't report mismatch counts on either raid1 or raid10 devices
  - Check both active and idle arrays during raid check runs
  - Move raid-check script to /usr/sbin, add a crontab entry to /etc/cron.d
    and mark it config(noreplace) so that users can select their own
    raid check frequency and it will be preserved across updates
  - Allow the raid check script to set both the cpu and io priority on the
    raid check process in an effort to minimize the impact to users on the
    system
  - Related: bz633306


author: Doug Ledford <dledford@redhat.com> - 3.2.2-1
changelog:
  - Update to latest upstream release (many bugfixes related to the new
    automatic rebuild support: bz716413, bz694083, bz694092, bz694103,
    bz694121, bz694779, bz695336, bz702270)
  - Correct typo in /etc/sysconfig/raid-check file (bz708280)
  - Fix a bug related to readding devices into an array (bz706500)
  - Resolves: bz716413, bz694083, bz694092, bz694103, bz694121, bz694779
  - Resolves: bz695336, bz702270, bz708280, bz706500


author: Doug Ledford <dledford@redhat.com> - 3.2.2-2
changelog:
  - When using writemostly on a raid1 array, if you remove a device that
    is readwrite and then readd it, it can end up being listed as writemostly
    if the device used to pull the superblock info from was writemostly.
    Properly clear the writemostly bit when adding/readding a device.
  - Related: bz706500


author: Doug Ledford <dledford@redhat.com> - 3.2.2-3
changelog:
  - Be robust when running on a version 3.0 kernel
  - Properly set the default chunk size on orom devices
  - Fix getinfo_super_imsm so a hack in create.c can be dropped
  - Make the output of --detail more accurately communicate the state of
    a device that is waiting on a resync because another resync is
    already running
  - A few tweaks to the man page for mdadm to clarify usage in relation to
    imsm arrays
  - Resolves: bz727216, bz727207, bz727210, bz727212, bz727203


author: Doug Ledford <dledford@redhat.com> - 3.2.2-4
changelog:
  - Minor tweaks to wording in the comments of the /etc/sysconfig/raid-check
    file
  - Resolves: bz708280


author: Doug Ledford <dledford@redhat.com> - 3.2.2-5
changelog:
  - Fix multiple issues in the udev incremental assembly rules file.  We should
    now properly support:
    1) Nested md raid arrays
    2) md raid arrays built on top of dm device (like LUKS encrypted devices)
    3) md raid arrays build on top of dm multipath devices (we should no longer
      attempt to grab the path device instead of waiting for the logical
      multipath device to come live and grabbing it for our md raid usage)
  - Resolves: bz598513, bz609122


author: Doug Ledford <dledford@redhat.com> - 3.2.2-6
changelog:
  - Fix several new coverity issues introduced by changes between the rhel6.1
    and rhel6.2 mdadm package (this does not attempt to address coverity
    issues that also exist in rhel6.1)
  - Resolves: bz734716


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.2-7
changelog:
  - Fix problem where a dirty IMSM RAID isn't assembled correctly during
    boot, preventing booting from this RAID device.
  - Resolves: bz692261


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.2-8
changelog:
  - Fix problem where an IMSM RAID is rejected because of unexpected
    attribute settings.
  - Resolves: bz733153


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.2-9
changelog:
  - Fix problem where an IMSM RAID is rejected because of unexpected
    attribute settings. Additional fix being extra cautious from -8.
  - Resolves: bz733153


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852021


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017837)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065843) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.8-19
changelog:
  - fixed problem with wrong kernel oops duplicates - rhbz#953813
  - updated translation rhbz#993564
  - Resolves: #953813


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.8-21
changelog:
  - updated translation (ko, po) #952773
  - added support for MCE errors rhbz#812537
  - Resolves: #812537, #952773


author: Jakub Filak <jfilak@redhat.com> - 2.0.8-22
changelog:
  - desktop file is named redhat-abrt.desktop rhbz#905822
  - dependency missing for abrt-addon-vmcore
  - removed unnecessary debug message "Can't open file '/*/uid': No such file or directory"
  - fix post-create reporter-uploader examples
  - add abrt-harvest-vmcore manual page
  - Resolves: #812284, #888282, #905822, #984065, #1022160


author: Jakub Filak <jfilak@redhat.com> - 2.0.8-26.el6_6.1
changelog:
  - remove old dump directories in upgrade
  - remove outdated rmp scriptlets
  - daemon: allow only root to submit CCpp, Koops, VMCore and Xorg problems
  - abrt-action-install-debuginfo-to-abrt-cache: sanitize arguments and umask
  - make the problem directories owned by abrt and the group root
  - validate uploaded problem directories in abrt-handle-upload
  - don't override nor remove files with user core dump files
  - fix symbolic link and race condition flaws
  - Resolves: #1211966


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-1
changelog:
  - Don't try to issue discards to a missing PV to avoid segfault.
  - Fix vgchange -aay not to activate non-matching LVs that follow a matching LV.
  - Fix lvchange --resync for RAID LVs which had no effect.
  - Add RAID10 support (--type raid10).
  - Introduce blkdeactivate script to deactivate block devs with dependencies.
  - Apply 'dmsetup mangle' for dm UUIDs besides dm names.
  - Use -q as short form of --quiet.
  - Suppress non-essential stdout with -qq.
  - Add log/silent to lvm.conf equivalent to -qq.
  - Add (p)artial attribute to lvs.
  - Implement devices/global_filter to hide devices from lvmetad.
  - Add lvmdump -l, to collect a state dump from lvmetad.
  - Add --discards to lvconvert.
  - Add --poolmetadata to lvconvert and support thin meta/data dev stacking.
  - Support creation of read-only thin volumes (lvcreate -p r).
  - Support changes of permissions for thin snapshot volumes.
  - Make lvremove ask before discarding data areas.
  - Prohibit not yet supported change of thin-pool to read-only.
  - Using autoextend percent 0 for thin pool fails 'lvextend --use-policies'.
  - Make vgscan --cache an alias for pvscan --cache.
  - Clear lvmetad metadata/PV cache before a rescan.
  - Fix a segmentation fault upon receiving a corrupt lvmetad response.
  - Give inconsistent metadata warnings in pvscan --cache.
  - Avoid overlapping locks that could cause a deadlock in lvmetad.
  - Fix memory leaks in libdaemon and lvmetad.
  - Optimize libdaemon logging for a fast no-output path.
  - Only create lvmetad pidfile when running as a daemon (no -f).
  - Warn if lvmetad is running but disabled.
  - Warn about running lvmetad with use_lvmetad = 0 in example.conf.
  - Update lvmetad help output (flags and their meaning).
  - Make pvscan --cache read metadata from LVM1 PVs.
  - Make libdaemon buffer handling asymptotically more efficient.
  - Make --sysinit suppress lvmetad connection failure warnings.
  - Prohibit usage of lvcreate --thinpool with --mirrors.
  - Fix lvm2api origin reporting for thin snapshot volume.
  - Add implementation of lvm2api function lvm_percent_to_float.
  - Allow non power of 2 thin chunk sizes if thin pool driver supports that.
  - Allow limited metadata changes when PVs are missing via [vg|lv]change.
  - Do not start dmeventd for lvchange --resync when monitoring is off.
  - Remove pvscan --cache from lvm2-lvmetad init script.
  - Report invalid percentage for property snap_percent of non-snaphot LVs.
  - Disallow conversion of thin LVs to mirrors.
  - Fix lvm2api data_percent reporting for thin volumes.
  - Do not allow RAID LVs in a clustered volume group.
  - Enhance insert_layer_for_lv() with recursive rename for _tdata LVs.
  - Skip building dm tree for thin pool when called with origin_only flag.
  - Ensure descriptors 0,1,2 are always available, using /dev/null if necessary.
  - Use /proc/self/fd when available for closing opened descriptors efficiently.
  - Fix inability to create, extend or convert to a large (> 1TiB) RAID LV.
  - Update lvmetad communications to cope with clients using different filters.
  - Clear LV_NOSYNCED flag when a RAID1 LV is converted to a linear LV.
  - Disallow RAID1 upconvert if the LV was created with --nosync.
  - Disallow addition of RAID images until the array is in-sync.
  - Fix RAID LV creation with '--test' so valid commands do not fail.
  - Add lvm_lv_rename() to lvm2api.
  - Fix setvbuf code by closing and reopening stream before changing buffer.
  - Disable private buffering when using liblvm.
  - When private stdin/stdout buffering is not used always use silent mode.
  - Fix 32-bit device size arithmetic needing 64-bit casting throughout tree.
  - Fix dereference of NULL in lvmetad error path logging.
  - Fix buffer memory leak in lvmetad logging.
  - Change lvmetad logging syntax from -ddd to -l {all|wire|debug}.
  - Add new libdaemon logging infrastructure.
  - Support unmount of thin volumes from pool above thin pool threshold.
  - Update man page to reflect that dm UUIDs are being mangled as well.
  - Add 'mangled_uuid' and 'unmangled_uuid' fields to dmsetup info -c -o.
  - Mangle device UUID on dm_task_set_uuid/newuuid call if necessary.
  - Add dm_task_get_uuid_mangled/unmangled to libdevmapper.
  - Always reset delay_resume_if_new flag when stacking thin pool over anything.
  - Don't create value for dm_config_node and require dm_config_create_value call.
  - Check for existing new_name for dmsetup rename.
  - Fix memory leak in dmsetup _get_split_name() error path.
  - Add Requires: bash >= 4.0 for blkdeactivate script.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.98-3
changelog:
  - Init lvmetad lazily to avoid early socket access on config overrides.
  - Hardcode use_lvmetad=0 if cluster locking used and issue a warning msg.
  - Avoid reading mirrors with failed devices in its mirrored log.
  - Avoid reading from mirrors that have failed devices if they block I/O.
  - Change lvs heading Copy% to Cpy%Sync and print RAID4/5/6 sync% there too.
  - Fix dm_task_set_cookie to properly process udev flags if udev_sync disabled.
  - Add Requires: device-mapper-persistent-data for thin provisioning support.


author: Marek Kasik <mkasik@redhat.com> 2.3.11-4
changelog:
  - Add freetype-2.3.11-CVE-2010-2498.patch
      (Assure that `end_point' is not larger than `glyph->num_points')
  - Add freetype-2.3.11-CVE-2010-2499.patch
      (Check the buffer size during gathering PFB fragments)
  - Add freetype-2.3.11-CVE-2010-2500.patch
      (Use smaller threshold values for `width' and `height')
  - Add freetype-2.3.11-CVE-2010-2519.patch
      (Check `rlen' the length of fragment declared in the POST fragment header)
  - Add freetype-2.3.11-CVE-2010-2520.patch
      (Fix bounds check)
  - Add freetype-2.3.11-CVE-2010-2527.patch
      (Use precision for `%s' where appropriate to avoid buffer overflows)
  - Add freetype-2.3.11-axis-name-overflow.patch
      (Avoid overflow when dealing with names of axes)
  - Resolves: #613298


author: Daniel Veillard <veillard@redhat.com> - 0.4.0-1
changelog:
  - update to 0.4.0
  - Modified the dependency to be libvirt-client instead of libvirt.
  - Added libvirt APIs up through 0.7.0
  - Added maven building tools.
  - Fixed connection and domain bugs found by Thomas Treutner
  - Resolves: rhbz#554348


author: Daniel Veillard <veillard@redhat.com> - 0.4.1-1
changelog:
  - update to upstream 0.4.1
  - better scheduler parameters checking and error reporting 
  - Resolves: rhbz#557066


author: Daniel Veillard <veillard@redhat.com> - 0.4.2-2
changelog:
  - Missing /usr/share/javadoc/libvirt symlink
  - Resolves: rhbz#579037
  - Allow libvirt-java build on all architecture, lower require to java >= 1.5
  - Resolves: rhbz#582294


author: Daniel Veillard <veillard@redhat.com> - 0.4.5-1
changelog:
  - rebase to 0.4.5
  - Added libvirt support up to 0.8.1 API
  - Improved packaging for javadocs
  - Better Free/Close handling
  - Resolves: rhbz#582332


author: Daniel Veillard <veillard@redhat.com> - 0.4.7-1
changelog:
  - rebase to 0.4.7
  - Added libvirt support up to 0.8.2 API
  - Only throw errors on real errors.
  - Remote non thread safe error reporting
  - fix 600819 Incorrect scheduler parameter value passed to native API.
  - Resolves: rhbz#675044


author: Milan Broz <mbroz@redhat.com> - 1.1.1-0.2
changelog:
  - Update to cryptsetup 1.1.1-rc2.
  - Align device using topology info if available.
    Resolves: #569949


author: Milan Broz <mbroz@redhat.com> - 1.1.2-1
changelog:
  - Fix handling of newline with keyfile on standard input.
  - Fix alignment ioctl use.
  - Fix API activation calls to handle NULL device name.
    Resolves: #598523 #569949 #599617


author: Milan Broz <mbroz@redhat.com> - 1.2.0-1
changelog:
  - Update to cryptsetup 1.2.0
  - Use generic crypto backend interface.
  - Add fipscheck compile option.
  - Use gcrypt RNG in FIPS mode for key generation.
  - Add FAQ to documentation.
    Resolves: #658817 #663870 #663869


author: Milan Broz <mbroz@redhat.com> - 1.2.0-2
changelog:
  - Require libgcrypt and device-mapper versions supporting FIPS extensions.
  - Request buffer wipe for dm-ioctl when sending key data.
    Resolves: #674825


author: Milan Broz <mbroz@redhat.com> - 1.2.0-3
changelog:
  - Require updated device mapper library (secure flag).
  - Use FIPS RNG for keyslot salt in FIPS mode.
    Resolves: #692512 #693371


author: David Malcolm <dmalcolm@redhat.com> - 2.6.6-29.el6_2.1
changelog:
  - distutils.config: create ~/.pypirc securely
  Resolves: CVE-2011-4944
  - fix endless loop in SimpleXMLRPCServer upon malformed POST request
  Resolves: CVE-2012-0845
  - send encoding in SimpleHTTPServer.list_directory to protect IE7 against
  potential XSS attacks
  Resolves: CVE-2011-4940
  - oCERT-2011-003: add -R command-line option and PYTHONHASHSEED environment
  variable, to provide an opt-in way to protect against denial of service
  attacks due to hash collisions within the dict and set types
  Resolves: CVE-2012-1150


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-16.1
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171208)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-16.2
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173566)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173566)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-16.3
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183671)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183679)


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-2
changelog:
  - Remove CVE-2018-3639 mitigation due to performance regression and
      OpenJDK position on speculative execution vulnerabilities.
      https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-3
changelog:
  - Revert SSBD removal for now, until appropriate messaging has been decided.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Chris Lumens <clumens@redhat.com> - 1.71-1
changelog:
  - Don't overwrite the excluded group list after every %packages line (#577334). (clumens)
  - Add a bunch of test cases for the packages section. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.74-1
changelog:
  - If an option is deprecated, do not care if it takes a value (#602303). (clumens)
  - Don't compare the dest ("telnet") with the option string ("--telnet"). (clumens)
  - The --connect= parameter wasn't really deprecated in FC6. (clumens)


author: Chris Lumens <clumens@redhat.com> - 1.74.2-1
changelog:
  - Add the documentation from the website to this package. (clumens)
  - F14 TestCase classes won't work on rhel6-branch, use RHEL6. (akozumpl)
  - support noverifyssl on the rhel6-branch (method, repo) (#660340). (akozumpl)
  - method: new parameter '--noverifyssl' after --url. (akozumpl)
  - repo: new parameter '--noverifyssl'. (akozumpl)
  - Add bootloader --iscrypted (#554870). (clumens)


author: Chris Lumens <clumens@redhat.com> 1.74.5-1
changelog:
  - Don't set new attrs on the RHEL6_Network object. (clumens)
  - Add kickstart network --nodefroute option (#668417) (rvykydal)
  - Add support for network --bootproto ibft option (#668417) (rvykydal)
  - Add network --activate option (#668417) (rvykydal)


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-284
changelog:
  - Allow ipsec_mgmt_t to access netlink route socket and set attributes for /var/run/pluto directories.
  Resolves:#1287182


author: Brian C. Lane <bcl@redhat.com> 2.1-21
changelog:
  - Raise size limit on loop devices
    Resolves: #869743
  - Remove dm device when last partition is removed
    Resolves: #851705


author: Brian C. Lane <bcl@redhat.com> 2.1-22
changelog:
  - Add PreP GUID support
    Resolves: rhbz#1054283
  - Fix busy partition detection on devices witout sequential minor device numbers
    Resolves: rhbz#1018075
  - Fix align-check in interactive mode
    Resolves: rhbz#975478


author: Brian C. Lane <bcl@redhat.com> 2.1-23
changelog:
  - Drop the warning about greater than 512-byte sector sizes being experimental
    Resolves: rhbz#929319


author: Brian C. Lane <bcl@redhat.com> 2.1-26
changelog:
  - libparted: device mapper uses 512b sectors
    Resolves: rhbz#1189328
  - tests: Add a test for device-mapper partition sizes
    Related: rhbz#1189328
  - tests: Turn on testing of other blocksizes
    Related: rhbz#1189328


author: Brian C. Lane <bcl@redhat.com> 2.1-27
changelog:
  - libparted: fix gpt end of disk handling
    Resolves: rhbz#1180683
  - tests: Add tests for gpt end of disk handling
    Related: rhbz#1180683


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.2
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.5
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.6
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.8
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.9
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.10
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Miroslav Lichvar <mlichvar@redhat.com> 8.14.3-10
changelog:
  - fix verification of SSL certificate with NUL in name (#553390, CVE-2009-4565)
  - don't start service by default (#529686)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-1
changelog:
  - new version 8.14.4 (#552078)
  - RPM attributes S, 5, T not recorded for statistics file
  - adapted patches: makemapman, dynamic, switchfile (#552078)
  - movefiles patch incorporated into aliases_dir patch
  - dropped patches (fixed upstream): exitpanic, certcnnul


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-5
changelog:
  - used noreplace for sasl config
  - used ghost instead of explicit provides
  - deffattr changed to (-,root,root,-)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-9
changelog:
  - fixed MAXHOSTNAMELEN for FQDN
    resolves: rhbz#640234
  - fixed assertion if server connection is lost while making LDAP query
    resolves: rhbz#837007
  - fixed milterfdleaks patch to check socket before using fcntl on it
    resolves: rhbz#845821
  - fixed ldap_routing macro
    resolves: rhbz#890227
  - properly set {client_port} value on little endian machines,
    patch by Kelsey Cumminngs <kgc@corp.sonic.net>
    resolves: rhbz#1106852


author: Joe Orton <jorton@redhat.com> - 1.3.9-4
changelog:
  - add fix for apr_fnmatch() regression (CVE-2011-1928, #706352)
  - add fix for CVE-2011-0419 (#703520)


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-20
changelog:
  - chcat: Change the isSensitivity() detection
  Resolves: rhbz#965397
  - Move sepolgen utility from policycoreutils-gui to policycoreutils-python
  Resolves: rhbz#995778
  - audit2allow: use date time format compatible with ausearch
  Resolves: rhbz#1111999


author: Adam Jackson <ajax@redhat.com> 6.9.3-4
changelog:
  - Disable EXA and DRI, use ShadowFB by default, and don't gratuitously disable
    Render when using ShadowFB. (#860676)


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.3-4.3
changelog:
  - Add missing checks for small/truncated files
    resolves: rhbz#1158993
  - Fix typo in man page Win::Hivex.3.pm
    resolves: rhbz#1164693


author: Jan Safranek <jsafrane@redhat.com> 0.36-4
changelog:
  - Fix libcgroup.so link to the right soname (#599367)
  - Fix segmentation fault in cgget tool (#601071)
  - Fix lscgroup commandline parsing (#601095)


author: Jan Safranek <jsafrane@redhat.com> 0.36-5
changelog:
  - Relax the dependency on redhat-lsb package (#607537)
  - Fix installation of -devel libraries (#607538)


author: Jan Safranek <jsafrane@redhat.com> 0.37-1.el6
changelog:
  - Updated to 0.37
    - added new 'cgsnapshot' tool to generate cgconfig.conf (#649195)
    - fixed 'cgget' reading long variable values like devices.list (#626127)
    - fixed reading list of mounted controllers on library init (#635984)
    - fixed the library not to change current working directory when creating
      groups (#628895)
    - new user 'cgred' was added for better security - /bin/cgexec tool is no
      longer SUID to root but SGID to the new 'cgred' user, which has write
      access to /var/run/cgred.socket
    - may other fixes an enhancements
  - Removed rpath from compiled binaries
  - Fixed spelling and rpmlint errors in the .spec file (#634939)
  - Fixed exit code of cgclassify tool (#667957)


author: Jan Safranek <jsafrane@redhat.com> 0.37-2.el6
changelog:
  - Fixed buffer overflow when parsing cgexec command line parameters.
  - Added checking of source of netlink messages to cgrulesengd daemon.
  - Resolves: CVE-2011-1006 CVE-2011-1022


author: Jan Safranek <jsafrane@redhat.com> 0.37-3.el6
changelog:
  - Fixed 'cgred' group not being created as system-group during installation
    of the package.
  - Resolves: #715413


author: Jiri Moskovcak <jmoskovc@redhat.com> 2.0.5-15
changelog:
  - fix the kbase searching rhbz#743198
  - updated translation Related: #731037
  - Resolves: #743198 #731037


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-33
changelog:
  - Resolves #1051382 - IPA Replica installation fails when using an external CA
  - Test patch to filter out invalid XML and provide additional debugging
    information
  - Resolves #1083170 - Prevent LDAP Attributes from being affected by Locale
  - Resolves #1096142 - IPA replica setup fails during CA setup with
                        "unable to parse xml"
  - Resolves #1061442 - RFE - ipa-server should keep backup of CS.cfg
  - Resolves #1055080 - Giant /var/log/pki-ca/debug


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-5
changelog:
  - fixed option parser problem (mark matches with mark options) (rhbz#725879)
    based on upstream commits:
      600f38db82548a683775fd89b6e136673e924097
      59e8114c6792242e80785f4461d5e663fb9a3d64
      d3b2e391e3b944581e20e216af76339cc87d0590
      2d68ae7ce6e40e3977ee11a57296cf76801ae320
      1dc27393b7ba401e6228a5ee2472a6eb72836c43
      1e128bd804b676ee91beca48312de9b251845d09
      fa503ad59f73d20d85f4cdf53324a01d2ad8591e


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-6
changelog:
  - reverted upstream patches, because they are breaking the ABI
  - created new patch based on upstream but without ABI break (rhbz#725879)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
  - Restrict debug builds to shipped JIT architectures, excluding unshipped ppc64
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-5.b18
changelog:
  - Disable -ffp-no-contract option introduced by 8170873 as not available on RHEL 6 GCC.
  - Resolves: rhbz#1410612


author: Dan Horák <dhorak@redhat.com> 2.4-2
changelog:
  - don't add root to pkcs11 group (#732756)
  - document implications of the pkcs11 group membership (#730903)
  - Resolves: #732756, #730903


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.5.1.el6]
changelog:
  - [kernel] cgroupfs: use init_cred when populating new cgroupfs mount (Eric Paris) [713135 700538]
  - [netdrv] ixgbe: adding FdirMode module option (Andy Gospodarek) [711550 707287]
  - [crypto] testmgr: add xts-aes-256 self-test (Jarod Wilson) [711548 706167]
  - [fs] ext3: Fix lost extented attributes for inode with ino == 11 (Eric Sandeen) [712413 662666]
  - [mm] Prevent Disk IO throughput degradation due to memory allocation stalls (Larry Woodman) [711540 679526]
  - [net] sock: adjust prot->obj_size always (Jiri Pirko) [709381 704231]
  - [fs] GFS2: resource group bitmap corruption resulting in panics and withdraws (Robert S Peterson) [711528 702057]
  - [x86] kprobes: Disable irqs during optimized callback (Jiri Olsa) [711545 699865]
  - [mm] slab, kmemleak: pass the correct pointer to kmemleak_erase() (Steve Best) [712414 698023]
  - [net] fix netns vs proto registration ordering (Wade Mealing) [702305 702306] {CVE-2011-1767 CVE-2011-1768}
  - [ppc] Fix oops if scan_dispatch_log is called too early (Steve Best) [711524 696777]
  - [virt] i8259: initialize isr_ack (Avi Kivity) [711520 670765]
  - [virt] VMX: Save and restore tr selector across mode switches (Gleb Natapov) [711535 693894]
  - [virt] VMX: update live TR selector if it changes in real mode (Gleb Natapov) [711535 693894]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.6.1.el6]
changelog:
  - [audit] ia32entry.S sign extend error codes when calling 64 bit code (Eric Paris) [713831 703935]
  - [audit] push audit success and retcode into arch ptrace.h (Eric Paris) [713831 703935]
  - [x86] intel-iommu: Flush unmaps at domain_exit (Alex Williamson) [713458 705441]
  - [x86] intel-iommu: Only unlink device domains from iommu (Alex Williamson) [713458 705441]
  - [virt] x86: Mask out unsupported CPUID features if running on xen (Igor Mammedov) [711546 703055]
  - [block] fix accounting bug on cross partition merges (Jerome Marchand) [682989 669363]
  - [net] vlan: remove multiqueue ability from vlan device (Neil Horman) [713494 703245]
  - [net] Fix netif_set_real_num_tx_queues (Neil Horman) [713492 702742]
  - [scsi] mpt2sas: move event handling of MPT2SAS_TURN_ON_FAULT_LED in process context (Tomas Henzl) [714190 701951]
  - [mm] thp: simple fix for /dev/zero THP mprotect bug (Andrea Arcangeli) [714762 690444]


author: Zdenek Pavlas <zpavlas@redhat.com> - 1.1.30-15
changelog:
  - yum-complete-transaction: fix interrupted update processing.
  - Resolves: bug#1013475
  - fs-snapshot: add the "-c" option to dmsetup.
  - Resolves: bug#850612
  - fs-snapshot: new dmsetup does not support "-o".
  - Resolves: bug#954358


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-18.el6
changelog:
  - CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1149086)
  - Fix html serialization error and htmlSetMetaEncoding (rhbz#1004513)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-19.el6
changelog:
  - Stop parsing on entities boundaries errors
  - Fix missing entities after CVE-2014-3660 fix (rhbz#1149086)


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-20.1
changelog:
  - Fix a series of CVEs (rhbz#1286495)
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - Libxml violates the zlib interface and crashes


author: Peter Hutterer <peter.hutterer@redhat.com> 2.7.3-2
changelog:
  - Merge evdev 2.7.3 from F18 (#835225)
  - Restore RHEL6.x middle mouse button emulation default (auto)
  - Restore RHEL6.x lid patch to re-scan xrandr outputs
  - Disable smooth scrolling, no client stack support


author: Peter Hutterer <peter.hutterer@redhat.com> 2.8.2-3
changelog:
  - Drop undef for HAVE_SMOOTH_SCROLLING. Nothing client-side can make use of
    this anyway so enabling has no drawbacks but aligns the code with the
    other products.
  - Don't crash when exceeding MAXDEVICES


author: Adam Jackson <ajax@redhat.com> 10.1.1-0.1
changelog:
  - Rebase to Mesa 10.1.1
  - Initial rebuild against llvm 3.4
  - Add llvm_rebase macro for future convenience


author: Jakub Jelinek <jakub@redhat.com> 4.4.5-1
changelog:
  - update from gcc-4_4-branch
    - GCC 4.4.5 release
    - PRs boehm-gc/34544, c++/44991, c++/45315, c/44555, fortran/31588,
  	fortran/43954, fortran/44660, fortran/45595, libffi/45677,
  	libfortran/45532, middle-end/40386, middle-end/41551,
  	middle-end/42245, middle-end/42509, middle-end/44554,
  	middle-end/44632, middle-end/44763, middle-end/45234,
  	middle-end/45262, middle-end/45312, middle-end/45423,
  	middle-end/45678, other/45443, rtl-optimization/39453,
  	rtl-optimization/40101, rtl-optimization/41697,
  	rtl-optimization/42246, rtl-optimization/42249,
  	rtl-optimization/42294, rtl-optimization/42388,
  	rtl-optimization/42389, rtl-optimization/42775,
  	rtl-optimization/44691, rtl-optimization/44919,
  	rtl-optimization/45353, rtl-optimization/45728, target/35664,
  	target/41484, target/44452, target/44575, target/44805,
  	target/45070, target/45296, target/45843, tree-optimization/44977,
  	tree-optimization/45109, tree-optimization/45709
  - yet another -Wunused-but-set* fix for C++ consts in
    templates (PR c++/45588)
  - emit slightly more compact .eh_frame
  - VTA backports
    - PRs debug/45055, debug/45500, middle-end/45484, rtl-optimization/45137
  - fix ICE in output_die with function local types (#527510, PR debug/41063)
  - speed up locale::locale() ctor if _S_global hasn't been changed
    (#635708, PR libstdc++/40088)
  - fix ICE in dwarf2out_finish (#632847, PR debug/45660)
  - fix VTA ICE in caller-save.c (#622060, PR debug/45259)
  - fix -freorder-blocks-and-partition -fnon-call-exceptions
    (PR middle-end/45458)
  - ivopts improvements (#592502)


author: Jakub Jelinek <jakub@redhat.com> 4.4.5-2
changelog:
  - update from gcc-4_4-branch
    - PRs bootstrap/44621, c++/18451, c++/40738, c++/46024, fortran/33595,
  	fortran/42169, fortran/46140, libfortran/45710, libgfortran/46010,
  	libgfortran/46373, middle-end/43690, middle-end/44569,
  	middle-end/46019, middle-end/46419, target/45820, target/45946,
  	target/46419, testsuite/40858, testsuite/45543,
  	tree-optimization/46107
  - fix asm goto handling (PR rtl-opt/46226)
  - -Wunused-but-set* fix for computed goto (PR c/46015)
  - fix -Wunused-but-set* for ObjC and ObjC++
  - VTA backports
    - PRs debug/45656, debug/45939, debug/46252, debug/46255,
  	tree-optimization/46066, tree-optimization/46099


author: Jakub Jelinek <jakub@redhat.com> 4.4.5-3
changelog:
  - update from gcc-4_4-branch
    - PRs c++/46538, fortran/45742, fortran/46638, fortran/46668,
  	fortran/46753, libgomp/45240, middle-end/46534,
  	rtl-optimization/46337, tree-optimization/46663
  - VTA backports
    - PRs debug/46258, debug/46387, debug/46771, rtl-optimization/46571,
  	target/45870
  - z196 support (#633375)
  - s390{,x} prefetch improvements (#632366)
  - s390{,x} literal pool ref handling fix for qrst constraints
    and fp zero load improvement (#632370)
  - power7 single precision smax/smin improvement (#630169)
  - power7 double precision sqrt improvement (PR target/42747)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)


author: David Vossel <dvossel@redhat.com> - 1.1.10-14.3
changelog:
  - Fix: pengine: fixes invalid transition caused by clones with more than 10 instances
      Resolves: rhbz#1087754


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.23
changelog:
  - Add 0055-RHBZ-602257-update-on-show-topology.patch
    * make multipathd updated state with the kernel before showing topology
  - Add 0056-RHBZ-603812-better-type-check.patch
    * only count files a path devices, if they are block devices, and are not
      device-mapper devices.
  - Add 0057-RHBZ-607869-fix-resize.patch
    * use the resize calls that don't set noflush, when you reload for size
      changes.
  - Add 0058-RHBZ-601665-assemble-features.patch
    * When multipathd reloads paths, add queue_if_no_path to the features
      based on the no_path_retry value.
  - Add 0059-RHBZ-607874-handle-offlined-paths.patch
    * get the sysfs pathinfo in multipath if necessary, and only retry
      failed ev_add_path reloads 3 times.
  - Resolves: bz #602257, #603812, #607869, #601665, #607874


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.24
changelog:
  - Modify 0055-RHBZ-602257-update-on-show-topology.patch
    * fix patch so that multipath only syncs with the kernel, and doesn't
      update other features
  - Add 0060-RHBZ-606420-fix-remove-map.patch
    * multipathd will now only report a success for remove map when it
      actually succeeds.
  - Resolves: bz #602257, #606420


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.25
changelog:
  - Add 0061-RHBZ-620479-find-rport.patch
    * multipath now will correctly set the dev_loss_tmo and fast_io_fail_tmo
      for setups where a devices rport id doesn't match its target id.
  - Resolves: bz #620479


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.27
changelog:
  - Add 0063-RHBZ-595719-udev_link_priority.patch
     * Increase the priority of multipath symlinks
  - Resolves: bz #595719


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.28
changelog:
  - Add 0064-RHBZ-612173-fix-reverse-lookup.patch
     * Fix multipath's wwid bindings file reverse lookup
  - Resolves: bz #612173


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.29
changelog:
  - Modify 0063-RHBZ-595719-udev_link_priority.patch
      * Change link priority from 5 to 10
  - Resolves: bz #595719


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.30
changelog:
  - Modify 0063-RHBZ-595719-udev_link_priority.patch
      * move link_priority line up in the udev rules. Hopefully this is the
        actual fix.
  - Resolves: bz #595719


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.31
changelog:
  - Modify 0063-RHBZ-595719-udev_link_priority.patch
      * make link_priority only work on multipath devices and partitions.
  - Resolves: bz #595719


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.31.el6_0.1
changelog:
  - Add 0065-RHBZ-635088-update-priority.patch
      * refresh all priorities when a new path comes online
  - Resolves: bz #658937


author: Gilboa Davara <gilboad[AT]gmail.com> - 1.3.7-1
changelog:
  - Switch to 1.3.7 tree.
  - Fixes bugs: #694532, #689804, #696291, #694622, #716218, #754124.
  - Add Marcus Moeller's menu icon size and wmclient patches.
  - Missing license information for icewm-xdg-menu.


author: Gilboa Davara <gilboad[AT]gmail.com> - 1.3.7-3
changelog:
  - Fix missing bluecurve-icon-theme in EL-6.
  - Start menu icon should now be generated correctly on both Fedora and EPEL.


author: John Dennis <jdennis@redhat.com> - 2.1.9-1
changelog:
  - update to latest upstream, mainly bug fix release
  - Resolves: bug #584101
    Feature improvements
    * Add radmin command "stats detail <file>" to see what
      is going on inside of a detail file reader.
    * Added documentation for CoA.  See raddb/sites-available/coa
    * Add sub-option support for Option 82.  See dictionary.dhcp
    * Add "server" field to default SQL NAS table, and documented it.

    Bug fixes
    * Reset "received ping" counter for Status-Server checks.  In some
      corner cases it was not getting reset.
    * Handle large VMPS attributes.
    * Count accounting responses from a home server in SNMP / statistics
      code.
    * Set EAP-Session-Resumed = Yes, not "No" when session is resumed.
    * radmin packet counter statistics are now unsigned, for numbers
      2^31..2^32.  After that they roll over to zero.
    * Be more careful about expanding data in PAP and MS-CHAP modules.
      This prevents login failures when passwords contain '{'.
    * Clean up zombie children if there were many "exec" modules being
      run for one packet, all with "wait = no".
    * re-open log file after HUP.  Closes bug #63.
    * Fix "no response to proxied packet" complaint for Coa / Disconnect
      packets.  It shouldn't ignore replies to packets it sent.
    * Calculate IPv6 netmasks correctly.  Closes bug #69.
    * Fix SQL module to re-open sockets if they unexpectedly close.
    * Track scope for IPv6 addresses.  This lets us use link-local
      addresses properly.  Closes bug #70.
    * Updated Makefiles to no longer use the shell for recursing into
      subdirs.  "make -j 2" should now work.
    * Updated raddb/sql/mysql/ippool.conf to use "= NULL".  Closes
      bug #75.
    * Updated Makefiles so that "make reconfig" no longer uses the shell
      for recursing into subdirs, and re-builds all "configure" files.
    * Used above method to regenerate all configure scripts.
      Closes bug #34.
    * Updated SQL module to allow "server" field of "nas" table
      to be blank: "".  This means the same as it being NULL.
    * Fixed regex realm example.  Create Realm attribute with value
      of realm from User-Name, not from regex.  Closes bug #40.
    * If processing a DHCP Discover returns "fail / reject", ignore
      the packet rather than sending a NAK.
    * Allow '%' to be escaped in sqlcounter module.
    * Fix typo internal hash table.
    * For PEAP and TTLS, the tunneled reply is added to the reply,
      rather than integrated via the operators.  This allows multiple
      VSAs to be added, where they would previously be discarded.
    * Make request number unsigned.  This changes nothing other than
      the debug output when the server receives more than 2^31 packets.
    * Don't block when reading child output in 'exec wait'.  This means
      that blocked children get killed, instead of blocking the server.
    * Enabled building without any proxy functionality
    * radclient now prefers IPv4, to match the default server config.
    * Print useful error when a realm regex is invalid
    * relaxed rules for preprocess module "with_cisco_vsa_hack".  The
      attributes can now be integer, ipaddr, etc.  (i.e. non-string)
    * Allow rlm_ldap to build if ldap_set_rebind_proc() has only
      2 arguments.
    * Update configure script for rlm_python to avoid dynamic linking
      problems on some platforms.
    * Work-around for bug #35
    * Do suid to "user" when running in debug mode as root
    * Make "allow_core_dumps" work in more situations.
    * In detail file reader, treat bad records as EOF.
      This allows it to continue working when the disk is full.
    * Fix Oracle default accounting queries to work when there are no
      gigawords attributes.  Other databases already had the fix.
    * Fix rlm_sql to show when it opens and closes sockets.  It already
      says when it cannot connect, so it should say when it can connect.
    * "chmod -x" for a few C source files.
    * Pull update spec files, etc. from RedHat into the redhat/ directory.
    * Allow spaces when parsing integer values.  This helps people who
      put "too much" into an SQL value field.


author: Nalin Dahyabhai <nalin@redhat.com> - 2.1.9-3
changelog:
  - Resolves: bug #629951
    override LINK_MODE at compile-time to add -pie to linker flags, so that
    radiusd will be built as a PIE


author: John Dennis <jdennis@redhat.com> - 2.1.10-1
changelog:
  - Upgrade to latest upstream release
    Feature improvements
    * Install the "radcrypt" program.
    * Enable radclient to send requests containing MS-CHAPv1
      Send packets with: MS-CHAP-Password = "password".  It will
      be automatically converted to the correct MS-CHAP attributes.
    * Added "-t" command-line option to radtest.  You can use "-t pap",
     "-t chap", "-t mschap", or "-t eap-md5".  The default is "-t pap"
    * Make the "inner-tunnel" virtual server listen on 127.0.0.1:18120
      This change and the previous one makes PEAP testing much easier.
    * Added more documentation and examples for the "passwd" module.
    * Added dictionaries for RFC 5607 and RFC 5904.
    * Added note in proxy.conf that we recommend setting
      "require_message_authenticator = yes" for all home servers.
    * Added example of second "files" configuration, with documentation.
      This shows how and where to use two instances of a module.
    * Updated radsniff to have it write pcap files, too.  See '-w'.
    * Print out large WARNING message if we send an Access-Challenge
      for EAP, and receive no follow-up messages from the client.
    * Added Cached-Session-Policy for EAP session resumption.  See
      raddb/eap.conf.
    * Added support for TLS-Cert-* attributes. For details, see
      raddb/sites-available/default, "post-auth" section.
    * Added sample raddb/modules/{opendirectory,dynamic_clients}
    * Updated Cisco and Huawei, HP, Redback, and ERX dictionaries.
    * Added RFCs 5607, 5904, and 5997.
    * For EAP-TLS, client certificates can now be validated using an
      external command.  See eap.conf, "validate" subsection of "tls".
    * Made rlm_pap aware of {nthash} prefix, for compatibility with
      legacy RADIUS systems.
    * Add Module-Failure-Message for mschap module (ntlm_auth)
    * made rlm_sql_sqlite database configurable.  Use "filename"
      in sql{} section.
    * Added %{tolower: ...string ... }, which returns the lowercase
      version of the string.  Also added %{toupper: ... } for uppercase.

    Bug fixes
    * Fix endless loop when there are multiple sub-options for
      DHCP option 82.
    * More debug output when sending / receiving DHCP packets.
    * EAP-MSCHAPv2 should return the MPPE keys when used outside
      of a TLS tunnel.  This is needed for IKE.
    * Added SSL "no ticket" option to prevent SSL from creating sessions
      without IDs.  We need the IDs, so this option should be set.
    * Fix proxying of packets from inside a TTLS/PEAP tunnel.
      Closes bug #25.
    * Allow IPv6 address attributes to be created from domain names
      Closes bug #82.
    * Set the string length to the correct value when parsing double
      quotes.  Closes bug #88.
    * No longer look users up in /etc/passwd in the default configuration.
      This can be reverted by enabling "unix" in the "authorize" section.
    * More #ifdef's to enable building on systems without certain
      features.
    * Fixed SQL-Group comparison to register only if the group
      query is defined.
    * Fixed SQL-Group comparison to register <instance>-SQL-Group,
      just like rlm_ldap.  This lets you have multiple SQL group checks.
    * Fix scanning of octal numbers in "unlang".  Closes bug #89.
    * Be less aggressive about freeing "stuck" requests.  Closes bug #35.
    * Fix example in "originate-coa" to refer to the correct packet.
    * Change default timeout for dynamic clients to 1 hour, not 1 day.
    * Allow passwd module to map IP addresses, too.
    * Allow passwd module to be used for CoA packets
    * Put boot filename into DHCP header when DHCP-Boot-Filename
      is specified.
    * raddb/certs/Makefile no longer has certs depend on index.txt and
       serial.  Closes bug #64.
    * Ignore NULL errorcode in PostgreSQL client.  Closes bug #39
    * Made Exec-Program and Exec-Program-Wait work in accounting
      section again.  See sites-available/default.
    * Fix long-standing memory leak in esoteric conditions.  Found
      by Jerry Nichols.
    * Added "Password-With-Header == userPassword" to raddb/ldap.attrmap
      This will automatically convert more passwords.
    * Updated rlm_pap to decode Password-With-Header, if it was base64
      encoded, and to treat the contents as potentially binary data.
    * Fix Novell eDir code to use the right function parameters.
      Closes bug #86.
    * Allow spaces to be escaped when executing external programs.
      Closes bug #93.
    * Be less restrictive about checking permissions on control socket.
      If we're root, allow connecting to a non-root socket.
    * Remove control socket on normal server exit.  If the server isn't
      running, the control socket should not exist.
    * Use MS-CHAP-User-Name as Name field from EAP-MSCHAPv2 for MS-CHAP
      calculations.  It *MAY* be different (upper / lower case) from
      the User-Name attribute.  Closes bug #17.
    * If the EAP-TLS methods have problems, more SSL errors are now
      available in the Module-Failure-Message attribute.
    * Update Oracle configure scripts.  Closes bug #57.
    * Added text to DESC fields of doc/examples/openldap.schema
    * Updated more documentation to use "Restructured Text" format.
      Thanks to James Lockie.
    * Fixed typos in raddb/sql/mssql/dialup.conf.  Closes bug #11.
    * Return error for potential proxy loops when using "-XC"
    * Produce better error messages when slow databases block
      the server.
    * Added notes on DHCP broadcast packets for FreeBSD.
    * Fixed crash when parsing some date strings.  Closes bug #98
    * Improperly formatted Attributes are now printed as "Attr-##".
      If they are not correct, they should not use the dictionary name.
    * Fix rlm_digest to be check the format of the Digest attributes,
      and return "noop" rather than "fail" if they're not right.
    * Enable "digest" in raddb/sites-available/default.  This change
      enables digest authentication to work "out of the box".
    * Be less aggressive about marking home servers as zombie.
      If they are responding to some packets, they are still alive.
    * Added Packet-Transmit-Counter, to track detail file retransmits.
      Closes bug #13.
    * Added configure check for lt_dladvise_init().  If it exists, then
      using it solves some issues related to libraries loading libraries.
    * Added indexes to the MySQL IP Pool schema.
    * Print WARNING message if too many attributes are put into a packet.
    * Include dhcp test client (not built by default)
    * Added checks for LDAP constraint violation.  Closes bug #18.
    * Change default raddebug timeout to 60 seconds.
    * Made error / warning messages more consistent.
    * Correct back-slash handling in variable expansion.  Closes bug #46.
      You SHOULD check your configuration for backslash expansion!
    * Fix typo in "configure" script (--enable-libltdl-install)
    * Use local libltdl in more situations.  This helps to avoid
      compile issues complaining about lt__PROGRAM__LTX_preloaded_symbols.
    * Fix hang on startup when multiple home servers were defined
      with "src_ipaddr" field.
    * Fix 32/64 bit issue in rlm_ldap.  Closes bug #105.
    * If the first "listen" section defines 127.0.0.1, don't use that
      as a source IP for proxying.  It won't work.
    * When Proxy-To-Realm is set to a non-existent realm, the EAP module
      should handle the request, rather than expecting it to be proxied.
    * Fix IPv4 issues with udpfromto.  Closes bug #110.
    * Clean up child processes of raddebug.  Closes bugs #108 and #109
    * retry OTP if the OTP daemon fails.  Closes bug #58.
    * Multiple calls to ber_printf seem to work better.  Closes #106.
    * Fix "unlang" so that "attribute not found" is treated as a "false"
      comparison, rather than a syntax error in the configuration.
    * Fix issue with "Group" attribute.


author: John Dennis <jdennis@redhat.com> - 2.1.10-3
changelog:
  - Resolves: #644100, Rebase to current release
  - Fix 666589 - removing freeradius from system does not delete the user "radiusd"
    fix scriptlet argument testing, simplify always exiting with zero


author: Dan Winship <danw@redhat.com> - 0.3.0-6
changelog:
  - Fix build with xulrunner 17 (#916973)
  - Fix to not look for proxy.conf in current directory (#802765)
  - Fix a crash with webkit and invalid PAC file (#874492)
  - Fix a crash with URLs containing a username but no password (#979356)


author: jiri Vanek <jvanek@redhat.com> - 1.7.0.5-2.2.1.el6
changelog:
  - Updated priority to be > 17000 and to depend on buildver variable
  - Variable buildver increased to 5 as it should be
  - Resolves: rhbz#828759


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.5-2.2.1.1.el6
changelog:
  - Added patch 304 java-1.7.0-openjdk-beans-isPackageAccessible.patch
    to fix vulnerability until it is fixed in upstream sources. 
  - Resolves: rhbz#852299


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.5-2.2.1.el6.3
changelog:
  - Removed patch 304 java-1.7.0-openjdk-beans-isPackageAccessible.patch
  - Applied upstream patches for same issue:
     patch 1001 sec-webrevs-openjdk7-29_aug_2012-7162473.patch
     patch 1002 sec-webrevs-openjdk7-29_aug_2012-7162476.patch
     patch 1003 sec-webrevs-openjdk7-29_aug_2012-7163201.patch
     patch 1004 sec-webrevs-openjdk7-29_aug_2012-7194567.patch
     patch 1005 sec-webrevs-openjdk7-29_aug_2012-78e01a6ca8d3.patch
  - Resolves: rhbz#852299


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.5-2.2.1.1.el6.4
changelog:
  - Cleanup before security release
  - Removed patches:
     patch 1001 sec-webrevs-openjdk7-29_aug_2012-7162473.patch
     patch 1002 sec-webrevs-openjdk7-29_aug_2012-7162476.patch
     patch 1003 sec-webrevs-openjdk7-29_aug_2012-7163201.patch
     patch 1004 sec-webrevs-openjdk7-29_aug_2012-7194567.patch
     patch 1005 sec-webrevs-openjdk7-29_aug_2012-78e01a6ca8d3.patch
  - Resolves: rhbz#852299


author: Deepak Bhole <dbhole@redhat.com> - 1.7.0.9-2.3.3.el6
changelog:
  - Updated to 2.3.3
  - Updated java-1.7.0-openjdk-java-access-bridge-security.patch
  - Resolves rhbz#s 856124, 865346, 865348, 865350, 865352, 865354, 865357,
    865359, 865363, 865365, 865370, 865428, 865471, 865434, 865511, 865514,
    865519, 865531, 865541, 865568


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.3.2.el6
changelog:
  - Sync with 6.4
  - introduced tmp-patches source tarball
  - release tag moved before dist (see 875245)
  - Resolves: rhbz#880352


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.11-2.4.0.1.el6
changelog:
  - Rewritten patch105: java-1.7.0-openjdk-disable-system-lcms.patch
  - Added jxmd and idlj to alternatives
  - make executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
  - Unapplied patch302 and deleted systemtap.patch
  - buildver increased to 11
  - icedtea_version set to 2.4.0
  - Added and applied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
  - removed tmp-patches source tarball
  - Added /lib/security/US_export_policy.jar and lib/security/local_policy.jar
  - Resolves: rhbz#895033


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.4.1.el6
changelog:
  - Rewerted to IcedTea 2.3.4
    - rewerted patch105: java-1.7.0-openjdk-disable-system-lcms.patch
    - removed jxmd and idlj to alternatives
    - make NOT executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
    - re-applied patch302 and restored systemtap.patch
    - buildver set to 9
    - icedtea_version set to 2.3.4
    - unapplied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
    - restored tmp-patches source tarball
    - removed /lib/security/US_export_policy.jar and lib/security/local_policy.jar
    - java-1.7.0-openjdk-java-access-bridge-security.patch's path moved from 
      java.security-linux back to java.security
  - Resolves: rhbz#895033


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-46.el6_6.2
changelog:
  - qemu: allow restore with non-migratable XML input (rhbz#1155564)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1155564)
  - Make ABI stability issue easier to debug (rhbz#1155564)
  - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)
  - domain_conf: fix domain deadlock (CVE-2014-3657)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-33
changelog:
  - Fix build-time double-free on file capability processing (#904818)
  - Fix include-directive getting processed on false branch (#920190)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-38
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163059)


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Rebase to NSS 3.36.0 BETA
  - Remove upstreamed nss-is-token-present-race.patch
  - Revert the upstream changes that default to sql database


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Use the correct tarball of NSS 3.36 release
  - Ignore EncryptDeriveTest which only works with newer nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-5
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-188
changelog:
  - Allow rpcd_t to read /var/run/utmp
  - Make glance domains as permissive instead of just glance_t
  - Allow kill capability for ftpd
  - Add labeling for prespawn helper script
  Resolves:#886619
  - Allow winbind to stream connect to nmbd
  - Allow transition from virt domains to bridgehelper domain
  - Add support for watchdog script from sanlock
  - Add labeling for tmp-inst
  - Fix rhev policy
  - Update virt_qemu_ga policy
  - Backport wm_domain policy
  - Backport virtd_lxc_t and make it as unconfined domain


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-189
changelog:
  - Allow virt_qemu_ga to execute shutdown
  - sssd needs to connect to kerberos password port if a user changes his password
  - More fixes for the dspam domain
  - Allow dovecot to execute bash
  - Additional fixes for passenger
  Resolves:#886619
  - Add labeling for /var/run/checkquorum-timer


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-190
changelog:
  - Allow virtd to settattr on virt image dirs in MLS
  Resolves:#885045
  - Allow all postfix domains to connect to mysql stream
  - Call init_daemon_domain for rsync_t
  - Add labeling for /var/lib/pgsql/ssh 
  - Allow certmonger to send signal to itself
  - Allow rsyslog to read user tmp files using logging_syslog_can_read_tmp boolean
  - Add support for 1228/tcp and 1228/udp ports and allow corosync touse them
  - Allow corosync to read wdmd tmpfs
  - Allow wdmd to execute consoletype
  - Update man pages using sepolicy from Fedora
  - Fix admin interfaces


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-191
changelog:
  - Remove pam_selinux due to conflict
  - Add labeling for /etc/multipath - lvm_metadata_t
  Resolves:#880407
  - Add additional gitolite3 labeling


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-192
changelog:
  - Label /usr/lib/yaboot/addnote as bin_t
  - Allow postfix_local to read/write /var/spool/postfix/active
  - Allow postfix domains to list /tmp
  - Allow wdmd to transition to kdump
  Resolves:#887793
  - Add labeling for /var/named/chroot/etc/localtime


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-193
changelog:
  - Fix ssh_sysadm_login boolean for MLS
  Resolves:#865759
  - Allow rpm_script_t to dbus communicate with certmonger_t
  - More fixes for qemu-ga to make "guest-fsfreeze-freeze" working


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-194
changelog:
  - qdiskd needs to read usr_t/bin_t files
  - Allow dpsam to connect/bind to spamd ports
  - Allow munin services plugins to bind to generic node
  Resolves:#865759


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-195
changelog:
  - Make matahari domains as unconfined
  - Allow nscd to connect to nmbd
  Resolves:#901565
  - Allow setcap/getcap for syslogd


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.500.el6
changelog:
  - kvm-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Disable-086.patch [bz#1405882]
  - kvm-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-iotests-Use-_img_info.patch [bz#1405882]
  - Resolves: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.501.el6
changelog:
  - kvm-Revert-iotests-Use-_img_info.patch [bz#1405882]
  - kvm-Revert-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-Revert-iotests-Disable-086.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-Revert-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-Revert-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-net-check-packet-payload-length.patch [bz#1398214]
  - Resolves: bz#1398214
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-6.9])
  - Reverts: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Adam Jackson <ajax@redhat.com> 1.0.4-4
changelog:
  - xau-1.0.4-local.patch: When looking for an auth cookie on local transport,
    don't bother checking hostname, it can't possibly help.


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-17
changelog:
  - avoid CURLE_OUT_OF_MEMORY given a file name without any slash (#623663)
  - proxy tunnel support for LDAP requests (#655134)
  - proxy with kerberos authentication for https (#625685)
  - improve handling of FTP server session timeout (#651592)


author: John Dennis <jdennis@redhat.com> - 0.10-1
changelog:
  - Resolves: #619743, Update to latest upstream, changes include:
  - The following classes were added:
      InitParameters
      InitContext

  -The following module functions were added:
      nss.nss.nss_initialize()
      nss.nss.nss_init_context()
      nss.nss.nss_shutdown_context()
      nss.nss.nss_init_flags()

  - add nss_is_initialized()

  - Remove nss_init_nodb() when nss modules loads from previous version
    apparently this prevents subsequent calls to nss_init with a
    database to silently fail.
  - Clean up some cruft in doc/examples/verify_server.py

  - Invoke nss_init_nodb() when nss modules loads, this prevents segfaults
    in NSS if Python programmer forgot to call one of the NSS
    initialization routines.

  - Rename the classes X500Name, X500RDN, X500AVA to DN, RDN, AVA
    respectively.

  - DN and RDN objects now return a list of their contents when indexed by
    type, this is to support multi-valued items.

  - Fix bug where AVA object's string representation did not include it's
    type.

  - Enhance test/test_cert_components.py unit test to test for above
    changes.

  - Add CertificateRequest object

  - Fix incomplete read bug (due to read ahead buffer bookkeeping).
  - Remove python-nss specific httplib.py, no longer needed
    python-nss now compatible with standard library
  - Rewrite httplib_example.py to use standard library and illustrate
    ssl, non-ssl, connection class, http class usage

  - add nss.cert_usage_flags(), use it in ssl_example.py

  - Add format_lines() & format() methods to the new certificate extension objects.
  - Add printing of certificate extensions.
  - Add BasicContstraints certificate extension.
  - Fix several reference counting and memory problems discovered with valgrind.

  - fold in more ref counting patches from Miloslav Trmač <mitr@redhat.com>
    into upstream.
    Did not bump upstream version, just bumped release ver in this spec file.

  - Unicode objects now accepted as well as str objects for
    interfaces expecting a string.

  - Sockets were enhanced thusly:
      - Threads will now yield during blocking IO.
      - Socket.makefile() reimplemented
            file object methods that had been missing (readlines(), sendall(),
            and iteration) were implemented, makefile now just returns the same
            Socket object but increments an "open" ref count. Thus a Socket
            object behaves like a file object and must be closed once for each
            makefile() call before it's actually closed.
      - Sockets now support the iter protocol
      - Add Socket.readlines(), Socket.sendall()

  - The following classes were added:
      AuthKeyID
      BasicConstraints
      CRLDistributionPoint
      CRLDistributionPts
      CertificateExtension
      GeneralName
      SignedCRL
      X500AVA
      X500Name
      X500RDN

  - The following module functions were added:
      nss.nss.cert_crl_reason_from_name()
      nss.nss.cert_crl_reason_name()
      nss.nss.cert_general_name_type_from_name()
      nss.nss.cert_general_name_type_name()
      nss.nss.cert_usage_flags()
      nss.nss.decode_der_crl()
      nss.nss.der_universal_secitem_fmt_lines()
      nss.nss.import_crl()
      nss.nss.make_line_pairs()
      nss.nss.oid_dotted_decimal()
      nss.nss.oid_str()
      nss.nss.oid_tag()
      nss.nss.oid_tag_name()
      nss.nss.read_der_from_file()
      nss.nss.x509_alt_name()
      nss.nss.x509_ext_key_usage()
      nss.nss.x509_key_usage()

  - The following class methods and properties were added:
    Note: it's a method if the name is suffixed with (), a propety otherwise
      Socket.next()
      Socket.readlines()
      Socket.sendall()
      SSLSocket.next()
      SSLSocket.readlines()
      SSLSocket.sendall()
      AuthKeyID.key_id
      AuthKeyID.serial_number
      AuthKeyID.get_general_names()
      CRLDistributionPoint.issuer
      CRLDistributionPoint.get_general_names()
      CRLDistributionPoint.get_reasons()
      CertDB.find_crl_by_cert()
      CertDB.find_crl_by_name()
      Certificate.extensions
      CertificateExtension.critical
      CertificateExtension.name
      CertificateExtension.oid
      CertificateExtension.oid_tag
      CertificateExtension.value
      GeneralName.type_enum
      GeneralName.type_name
      GeneralName.type_string
      SecItem.der_to_hex()
      SecItem.get_oid_sequence()
      SecItem.to_hex()
      SignedCRL.delete_permanently()
      X500AVA.oid
      X500AVA.oid_tag
      X500AVA.value
      X500AVA.value_str
      X500Name.cert_uid
      X500Name.common_name
      X500Name.country_name
      X500Name.dc_name
      X500Name.email_address
      X500Name.locality_name
      X500Name.org_name
      X500Name.org_unit_name
      X500Name.state_name
      X500Name.add_rdn()
      X500Name.has_key()
      X500RDN.has_key()

  - The following module functions were removed:
    Note: use nss.nss.oid_tag() instead
      nss.nss.sec_oid_tag_from_name()
      nss.nss.sec_oid_tag_name()
      nss.nss.sec_oid_tag_str()

  - The following files were added:
      doc/examples/cert_dump.py
      test/test_cert_components.py

  - Apply patches from  Miloslav Trmač <mitr@redhat.com>
    for ref counting and threading support. Thanks Miloslav!

  - Review all ref counting, numerous ref counting fixes

  - Implement cyclic garbage collection support by
    adding object traversal and clear methods

  - Identify static variables, move to thread local storage


author: John Dennis <jdennis@redhat.com> - 0.10-2
changelog:
  - Related: #619743
  - split documentation out into separate doc sub-package
    and make building api documentation optional


author: John Dennis <jdennis@redhat.com> - 0.10-3
changelog:
  - Related: #619743
  - Fix all rpmlint warnings
  - doc for license, changelog etc. now in main package,
    doc subpackage now only contains api doc, examples, test, etc.
  - Filter provides for .so files
  - Remove execute permission on everything in docdir
  - Capitalize description


author: John Dennis <jdennis@redhat.com> - 0.11-1
changelog:
  - Resolves: #670951
  - Resolves: #674014

    * Better support for IPv6

    * Add AddrInfo class to support IPv6 address resolution. Supports
      iteration over it's set of NetworkAddress objects and provides
      hostname, canonical_name object properties.

    * Add PR_AI_* constants.

    * NetworkAddress constructor and NetworkAddress.set_from_string() added
      optional family parameter. This is necessary for utilizing
      PR_GetAddrInfoByName().

    * NetworkAddress initialized via a string paramter are now initalized via
      PR_GetAddrInfoByName using family.

    * Add NetworkAddress.address property to return the address sans the
      port as a string. NetworkAddress.str() includes the port. For IPv6 the
      a hex string must be enclosed in brackets if a port is appended to it,
      the bracketed hex address with appended with a port is unappropriate
      in some circumstances, hence the new address property to permit either
      the address string with a port or without a port.

    * Fix the implementation of the NetworkAddress.family property, it was
      returning bogus data due to wrong native data size.

    * HostEntry objects now support iteration and indexing of their
      NetworkAddress members.

    * Add io.addr_family_name() function to return string representation of
      PR_AF_* constants.

    * Modify example and test code to utilize AddrInfo instead of deprecated
      NetworkAddress functionality. Add address family command argument to
      ssl_example.

    * Fix pty import statement in test/setup_certs.py

      Deprecated Functionality:
      -------------------------

    * NetworkAddress initialized via a string paramter is now
      deprecated. AddrInfo should be used instead.

    * NetworkAddress.set_from_string is now deprecated. AddrInfo should be
      used instead.

    * NetworkAddress.hostentry is deprecated. It was a bad idea,
      NetworkAddress objects can support both IPv4 and IPv6, but a HostEntry
      object can only support IPv4. Plus the implementation depdended on
      being able to perform a reverse DNS lookup which is not always
      possible.

    * HostEntry.get_network_addresses() and HostEntry.get_network_address()
      are now deprecated. In addition their port parameter is now no longer
      respected. HostEntry objects now support iteration and
      indexing of their NetworkAddress and that should be used to access
      their NetworkAddress objects instead.


author: John Dennis <jdennis@redhat.com> - 0.11-2
changelog:
  - Resolves: #670951
  - Resolves: #674014
    Rebuild enabling api doc generation, it had been disabled because
    the buildroots on 6.1 contained a verion of epydoc that crashed,
    release engineering has updated epydoc in the buildroots.
    There are NO changes in the package source.


author: John Dennis <jdennis@redhat.com> - 0.11-3
changelog:
  - Resolves: #689807
    Add family parameter to Socket constructors in examples and doc.
    Mark implicit family parameter as deprecated.
    Raise exception if Socket family does not match NetworkAddress family.
    Add --server-subject to setup_certs.py (made testing IPv6 easier without DNS)


author: John Dennis <jdennis@redhat.com> - 0.13-0
changelog:
  - Resolves: #827616
  - Resolves: #642795
  - Resolves: #698663
  - Resolves: #796295

    Introduced in 0.13:

    * Fix NSS SECITEM_CompareItem bug via workaround.

    * Fix incorrect format strings in PyArg_ParseTuple* for:
      - GeneralName
      - BasicConstraints
      - cert_x509_key_usage

    * Fix bug when decoding certificate BasicConstraints extension

    * Fix hang in setup_certs.

    * For NSS >= 3.13 support CERTDB_TERMINAL_RECORD

    * You can now query for a specific certificate extension
      Certficate.get_extension()

    * The following classes were added:
      - RSAGenParams

    * The following class methods were added:
      - nss.nss.Certificate.get_extension
      - nss.nss.PK11Slot.generate_key_pair
      - nss.nss.DSAPublicKey.format
      - nss.nss.DSAPublicKey.format_lines

    * The following module functions were added:
      - nss.nss.pub_wrap_sym_key

    * The following internal utilities were added:
      - PyString_UTF8
      - SecItem_new_alloc()

    * The following class constructors were modified to accept
      intialization parameters

      - KEYPQGParams (DSA generation parameters)

    * The PublicKey formatting (i.e. format_lines) was augmented
      to format DSA keys (formerly it only recognized RSA keys).

    * Allow lables and values to be justified when printing objects

    * The following were deprecated:
      - nss.nss.make_line_pairs (replaced by nss.nss.make_line_fmt_tuples)

      Deprecated Functionality:
      -------------------------
      - make_line_pairs() has been replaced by make_line_fmt_tuples()
        because 2-valued tuples were not sufficently general. It is
        expected very few programs will have used this function, it's mostly
        used internally but provided as a support utility.

    Introduced in 0.12:

    * Major new enhancement is additon of PKCS12 support and
      AlgorithmID's.

    * setup.py build enhancements
      - Now searches for the NSS and NSPR header files rather
        than hardcoding their location. This makes building friendlier
        on other systems (i.e. debian)
      - Now takes optional command line arguments, -d or --debug
        will turn on debug options during the build.

    * Fix reference counting bug in PK11_password_callback() which
      contributed to NSS not being able to shutdown due to
      resources still in use.

    * Add UTF-8 support to ssl.config_server_session_id_cache()

    * Added unit tests for cipher, digest, client_server.

    * All unittests now run, added test/run_tests to invoke
      full test suite.

    * Fix bug in test/setup_certs.py, hardcoded full path to
      libnssckbi.so was causing failures on 64-bit systems,
      just use the libnssckbi.so basename, modutil will find
      it on the standard search path.

    * doc/examples/cert_dump.py uses new AlgorithmID class to
      dump Signature Algorithm

    * doc/examples/ssl_example.py now can cleanly shutdown NSS.

    * Exception error messages now include PR error text if available.

    * The following classes were replaced:
      - SignatureAlgorithm replaced by new class AlgorithmID

    * The following classes were added:
      - AlgorithmID
      - PKCS12DecodeItem
      - PKCS12Decoder

    * The following class methods were added:
      - PK11Slot.authenticate()
      - PK11Slot.get_disabled_reason()
      - PK11Slot.has_protected_authentication_path()
      - PK11Slot.has_root_certs()
      - PK11Slot.is_disabled()
      - PK11Slot.is_friendly()
      - PK11Slot.is_internal()
      - PK11Slot.is_logged_in()
      - PK11Slot.is_removable()
      - PK11Slot.logout()
      - PK11Slot.need_login()
      - PK11Slot.need_user_init()
      - PK11Slot.user_disable()
      - PK11Slot.user_enable()
      - PKCS12DecodeItem.format()
      - PKCS12DecodeItem.format_lines()
      - PKCS12Decoder.database_import()
      - PKCS12Decoder.format()
      - PKCS12Decoder.format_lines()

    * The following class properties were added:
      - AlgorithmID.id_oid
      - AlgorithmID.id_str
      - AlgorithmID.id_tag
      - AlgorithmID.parameters
      - PKCS12DecodeItem.certificate
      - PKCS12DecodeItem.friendly_name
      - PKCS12DecodeItem.has_key
      - PKCS12DecodeItem.shroud_algorithm_id
      - PKCS12DecodeItem.signed_cert_der
      - PKCS12DecodeItem.type
      - SignedData.data
      - SignedData.der

    * The following module functions were added:
      - nss.nss.dump_certificate_cache_info()
      - nss.nss.find_slot_by_name()
      - nss.nss.fingerprint_format_lines()
      - nss.nss.get_internal_slot()
      - nss.nss.is_fips()
      - nss.nss.need_pw_init()
      - nss.nss.nss_init_read_write()
      - nss.nss.pk11_disabled_reason_name()
      - nss.nss.pk11_disabled_reason_str()
      - nss.nss.pk11_logout_all()
      - nss.nss.pkcs12_cipher_from_name()
      - nss.nss.pkcs12_cipher_name()
      - nss.nss.pkcs12_enable_all_ciphers()
      - nss.nss.pkcs12_enable_cipher()
      - nss.nss.pkcs12_export()
      - nss.nss.pkcs12_map_cipher()
      - nss.nss.pkcs12_set_nickname_collision_callback()
      - nss.nss.pkcs12_set_preferred_cipher()
      - nss.nss.token_exists()
      - nss.ssl.config_mp_server_sid_cache()
      - nss.ssl.config_server_session_id_cache_with_opt()
      - nss.ssl.get_max_server_cache_locks()
      - nss.ssl.set_max_server_cache_locks()
      - nss.ssl.shutdown_server_session_id_cache()

    * The following constants were added:
      - nss.nss.int.PK11_DIS_COULD_NOT_INIT_TOKEN
      - nss.nss.int.PK11_DIS_NONE
      - nss.nss.int.PK11_DIS_TOKEN_NOT_PRESENT
      - nss.nss.int.PK11_DIS_TOKEN_VERIFY_FAILED
      - nss.nss.int.PK11_DIS_USER_SELECTED
      - nss.nss.int.PKCS12_DES_56
      - nss.nss.int.PKCS12_DES_EDE3_168
      - nss.nss.int.PKCS12_RC2_CBC_128
      - nss.nss.int.PKCS12_RC2_CBC_40
      - nss.nss.int.PKCS12_RC4_128
      - nss.nss.int.PKCS12_RC4_40

    * The following files were added:
      - test/run_tests
      - test/test_cipher.py (replaces cipher_test.py)
      - test/test_client_server.py
      - test/test_digest.py (replaces digest_test.py)
      - test/test_pkcs12.py

    * The following were deprecated:
      - SignatureAlgorithm


author: John Dennis <jdennis@redhat.com> - 0.13-1
changelog:
  - Resolves: #642795
    add python-nss-size_t.patch, some types involved with ssize_t were
    improperly defined causing a segfault on the s390x and ppc64 arches.


author: John Dennis <jdennis@redhat.com> - 0.16-1
changelog:
  - Resolves: #1154776  Add API call for SSL_VersionRangeSet (rebase)
  - See doc/Changelog for details concerning changes in versions
    0.14, 0.15, and 0.16 which this rebase encompasses.


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.4-3.3
changelog:
  - Drop ocaml-camomile* dependency (RHBZ#661783).
  - Document background noise of RX packets from bridges (RHBZ#647987).
  - Fix pad function to work for negative widths (RHBZ#634435).
  - Fix virt-top --end-time option when TZ<>UTC (RHBZ#637964).
  - Document that memory option shows total guest memory (RHBZ#647991).
  - Remove references to xm/xentop manual pages (RHBZ#648186).
  - Record and print full exception stack traces to aid debugging.
    This also requires OCaml 3.11.0 so update BR.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.4-3.8
changelog:
  - Fix --end-time option with absolute times.
    resolves: RHBZ#680344
  - Fix documentation for virt-top -c option.
    resolves: RHBZ#676979


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.4-3.10
changelog:
  - docs: Explain how to debug libvirt initialization problems
    resolves: RHBZ#680031
  - Show domain memory information in csv mode.
    resolves: RHBZ#680027
  - Add processcsv.py file and documentation.
    resolves: RHBZ#665817


author: Andreas Schneider <asn@redhat.com> - 3.6.23-26
changelog:
  - resolves: #1322686 - Fix CVE-2015-5370
  - resolves: #1322686 - Fix CVE-2016-2110
  - resolves: #1322686 - Fix CVE-2016-2111
  - resolves: #1322686 - Fix CVE-2016-2112
  - resolves: #1322686 - Fix CVE-2016-2115
  - resolves: #1322686 - Fix CVE-2016-2118 (Known as Badlock)


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.13.1.el6]
changelog:
  - [net] af_packet: prevent information leak (Jiri Pirko) [728032 728033] {CVE-2011-2898}
  - [net] gro: Only reset frag0 when skb can be pulled (Jiri Pirko) [726555 726556] {CVE-2011-2723}
  - [fs] FS-Cache: Only call mark_tech_preview() when caching is actually begun (David Howells) [713463 696396]
  - [fs] Fix mark_tech_preview() to not disable lock debugging (David Howells) [713463 696396]
  - [fs] ext4: Rewrite ext4_page_mkwrite() to use generic helpers (Eric Sandeen) [723551 692167]
  - [fs] vfs: Block mmapped writes while the fs is frozen (Eric Sandeen) [723551 692167]
  - [fs] vfs: Create __block_page_mkwrite() helper passing error values back (Eric Sandeen) [723551 692167]
  - [mm] avoid wrapping vm_pgoff in mremap() and stack expansion (Jerome Marchand) [716540 716541] {CVE-2011-2496}
  - [pci] MSI: Restore read_msi_msg_desc(); add get_cached_msi_msg_desc() (Don Zickus) [728522 696511]
  - [pci] MSI: Remove unsafe and unnecessary hardware access (Don Zickus) [728522 696511]
  - [net] sock: do not change prot->obj_size (Jiri Pirko) [726626 725711]
  - [virt] x86: report valid microcode update ID (Marcelo Tosatti) [727838 694747]
  - [agp] fix arbitrary kernel memory writes (Jerome Marchand) [699307 699308] {CVE-2011-2022 CVE-2011-1745}
  - [agp] fix OOM and buffer overflow (Jerome Marchand) [699305 699306] {CVE-2011-1746}
  - [kernel] taskstats: don't allow duplicate entries in listener mode (Jerome Marchand) [715447 715448] {CVE-2011-2484}
  - [netdrv] bnx2x: remove a log-spamming message (Michal Schmidt) [732379 712000]
  - [scsi] ibmvscsi: Improve CRQ reset reliability (Steve Best) [727618 700165]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.14.1.el6]
changelog:
  - [scsi] megaraid_sas: Convert 6, 10, 12 byte CDB's for FastPath IO (Tomas Henzl) [710047 705835]
  - [x86] perf, x86: Fix Intel fixed counters base initialization (Don Zickus) [719229 736284] {CVE-2011-2521}
  - [net] ipv6: make fragment identifications less predictable (Jiri Pirko) [723432 723433] {CVE-2011-2699}
  - [fs] Ecryptfs: Add mount option to check uid of device being mounted = expect uid (Eric Sandeen) [731175 731176] {CVE-2011-1833}
  - [char] tpm: Fix uninitialized usage of data buffer (Stanislaw Gruszka) [684674 684675] {CVE-2011-1160}
  - [kernel] perf: Fix software event overflow (Frantisek Hrbata) [730707 730708] {CVE-2011-2918}
  - [serial] 8250_pci: ifdef for powerpc, to only add functionality to this arch (Steve Best) [732382 696695]
  - [serial] 8250: Fix capabilities when changing the port type (Steve Best) [732382 696695]
  - [serial] 8250_pci Add EEH support to the 8250 driver for IBM/Digi PCIe 2-port Adapter (Steve Best) [732382 696695]
  - [serial] 8250_pci: Add support for the Digi/IBM PCIe 2-port Adapter (Steve Best) [732382 696695]
  - [ppc] pseries/iommu: Add additional checks when changing iommu mask (Steve Best) [736065 704401]
  - [ppc] pseries/iommu: Use correct return type in dupe_ddw_if_already_created (Steve Best) [736065 704401]
  - [ppc] iommu: Restore iommu table pointer when restoring iommu ops (Steve Best) [736065 704401]
  - [ppc] Fix kexec with dynamic dma windows (Steve Best) [736065 704401]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.16.1.el6]
changelog:
  - [net] br_multicast: Ensure to initialize BR_INPUT_SKB_CB(skb)->mrouters_only. (Frantisek Hrbata) [739477 738110]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.17.1.el6]
changelog:
  - Revert: [net] ipv6: make fragment identifications less predictable (Jiri Pirko) [723432 723433] {CVE-2011-2699}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.18.1.el6]
changelog:
  - [sched] wait_for_completion_interruptible_timeout() should return signed long (J. Bruce Fields) [745413 738379]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.19.1.el6]
changelog:
  - [scsi] scan: don't fail scans when host is in recovery (Mike Christie) [734774 713682]
  - [netdrv] b43: allocate receive buffers big enough for max frame len + offset (RuiRui Yang) [738204 738205] {CVE-2011-3359}
  - [fs] fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (RuiRui Yang) [736764 736765] {CVE-2011-3353}
  - [fs] cifs: fix possible memory corruption in CIFSFindNext (Jeff Layton) [737482 730354] {CVE-2011-3191}
  - [kernel] perf tools: do not look at ./config for configuration (Jiri Benc) [730203 730204] {CVE-2011-2905}
  - [x86] mm: Fix pgd_lock deadlock (Andrew Jones) [737570 691310]
  - [mm] pdpte registers are not flushed when PGD entry is changed in x86 PAE mode (Andrew Jones) [737570 691310]
  - [mm] Revert "fix pgd_lock deadlock" (Andrew Jones) [737570 691310]
  - [fs] corrupted GUID partition tables can cause kernel oops (Jerome Marchand) [695981 695982] {CVE-2011-1577}
  - [net] Compute protocol sequence numbers and fragment IDs using MD5. (Jiri Pirko) [732664 732665] {CVE-2011-3188}
  - [crypto] Move md5_transform to lib/md5.c (Jiri Pirko) [732664 732665] {CVE-2011-3188}
  - [fs] SUNRPC: Fix use of static variable in rpcb_getport_async (Steve Dickson) [740230 723650]
  - [fs] NFSv4.1: update nfs4_fattr_bitmap_maxsz (Steve Dickson) [740230 723650]
  - [fs] SUNRPC: Fix a race between work-queue and rpc_killall_tasks (Steve Dickson) [740230 723650]
  - [fs] SUNRPC: Ensure we always run the tk_callback before tk_action (Steve Dickson) [740230 723650]
  - [misc] enclosure: fix error path to actually return ERR_PTR() on error (Tomas Henzl) [741166 713730]
  - [virt] KVM: make guest mode entry to be rcu quiescent state (Gleb Natapov) [740352 712653]
  - [virt] rcu: provide rcu_virt_note_context_switch() function (Gleb Natapov) [740352 712653]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.20.1.el6]
changelog:
  - [net] vlan: fix panic when handling priority tagged frames (Andy Gospodarek) [742849 714936] {CVE-2011-3593}
  - [netdrv] igb: fix WOL on second port of i350 device (Frantisek Hrbata) [743807 718293]
  - [kernel] fix taskstats io infoleak (Jerome Marchand) [716847 716848] {CVE-2011-2494}
  - [tpm] Zero buffer after copying to userspace (Jiri Benc) [732632 732633] {CVE-2011-1162}
  - [scsi] Revert megaraid_sas: Driver only report tape drive, JBOD and logic drives (Tomas Henzl) [741167 736667]
  - [x86] acpi: Prevent acpiphp from deadlocking on PCI-to-PCI bridge remove (Prarit Bhargava) [745557 732706]
  - [net] sctp: deal with multiple COOKIE_ECHO chunks (Frantisek Hrbata) [743510 729220]
  - [scsi] iscsi_tcp: fix locking around iscsi sk user data (Mike Christie) [741704 647268]
  - [kernel] first time swap use results in heavy swapping (Hendrik Brueckner) [747868 722461]
  - [scsi] Reduce error recovery time by reducing use of TURs (Mike Christie) [744811 691945]
  - [fs] cifs: add fallback in is_path_accessible for old servers (Jeff Layton) [738301 692709] {CVE-2011-3363}
  - [fs] cifs: always do is_path_accessible check in cifs_mount (Jeff Layton) [738301 692709] {CVE-2011-3363}
  - [net] ipv6: fix NULL dereference in udp6_ufo_fragment() (Jason Wang) [748808 740465]
  - [net] ipv6: make fragment identifications less predictable (Jiri Pirko) [723432 723433] {CVE-2011-2699}


author: Tom Lane <tgl@redhat.com> 5.1.66-1
changelog:
  - Update to 5.1.66, for assorted upstream bugfixes including
    CVEs announced in July and October 2012
  Resolves: #871814


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-42.el6
changelog:
  - Require 389-ds-base >= 1.2.11.15-38 to fix roken dereference control with
    the FreeIPA 4.0 ACIs (#1112698)


author: Petr Vobornik <pvoborni@redhat.com> - 3.0.0-43.el6
changelog:
  - Release 3.0.0-43
  - Resolves: #1191040 - ipa-client-automount: failing with error LDAP server
                         returned UNWILLING_TO_PERFORM. This likely means that
                         minssf is enabled.
  - Resolves: #1185207 - ipa-client dont end new line character in
                         /etc/nsswitch.conf
  - Resolves: #1166241 - CVE-2010-5312 CVE-2012-6662 ipa: various flaws
  - Resolves: #1161722 - IDM client registration failure in a high load
                         environment
  - Resolves: #1154687 - POODLE: force using safe ciphers (non-SSLv3) in IPA
                         client and server
  - Resolves: #1146870 - ipa-client-install fails with "KerbTransport instance
                         has no attribute '__conn'" traceback
  - Resolves: #1132261 - ipa-client-install failing produces a traceback
                         instead of useful error message
  - Resolves: #1131571 - Do not allow IdM server/replica/client installation
                         in a FIPS-140 mode
  - Resolves: #1198160 - /usr/sbin/ipa-server-install --uninstall does not
                         clean /var/lib/ipa/pki-ca
  - Resolves: #1198339 - ipa-client-install adds extra sss to sudoers in
                         nsswitch.conf
  - Require: 389-ds-base >= 1.2.11.15-51
  - Require: mod_nss >= 1.0.10
  - Require: pki-ca >= 9.0.3-40
  - Require: python-nss >= 0.16


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-155.4
changelog:
  - Make condor_startd_ssh domain as unconfined
  - Allow condor_startd_ssh to connect to kerberos_master port
  Resolves:#852456


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.2.el6]
changelog:
  - x86/speculation: Provide SRBDS late microcode loading support (Waiman Long)
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-54.rc4
changelog:
  - Fix summary and description of dc subpackages.
  - resolves: #896142
  - Remove conflicting libsmbclient.7 manpage.
  - resolves: #896240


author: Peter Hutterer <peter.hutterer@redhat.com> 1.7.5.901-1
changelog:
  - synaptics 1.7.5.901 (#1077486)
  - set secondary top buttons on INPUT_PROP_TOPBUTTONPAD (#1026577)
  - fix bogus changelog date


author: Peter Hutterer <peter.hutterer@redhat.com> 0.10.5-11
changelog:
  - Allow for Twinview Resolution 0 values on TV_NONE (#711619)
  - Fix cintiq calibration issues (#675672)


author: Dan Williams <dcbw@redhat.com> - 1:0.7.3-4
changelog:
  - Fix issues with Opportunistic/Proactive Key Caching (OKC) (rh #813579)
  - Be less aggressive when choosing to roam (rh #837402)
  - Don't install manpage for wpa_gui (rh #672976)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.7.3-5
changelog:
  - Add domain_match config option from upstream (rh #1186806) (rh #1178263)
  - Include peer certificate in EAP events for use by clients
  - Add dbus signal for information about server certification
  - eapol_test: Add option for writing server certificate chain to a file


author: Lubomir Rintel <lrintel@redhat.com> - 1:0.7.3-8
changelog:
  - Enable syslog logging support (rh #822128)
  - Support run-time rotation the debug log file (rh #908306)
  - Fix scriptlet dependencies (rh #712848)
  - Enable timestampes in logs (rh #1150004)


author: Samantha N. Bueno <sbueno+anaconda@redhat.com> - 13.21.254-1
changelog:
  - Revert "Always write splashimage to grub.cfg on UEFI (bcl)"
    Related: rhbz#1325971
    Resolves: rhbz#1325971


author: Radek Vykydal <rvykydal@redhat.com> - 13.21.255-1
changelog:
  - Keep symlinks to thin_* tools in /sbin (mkolman)
    Resolves: rhbz#1350296
  - network: fix static ipv6 config with static gateway (rvykydal)
    Resolves: rhbz#1177984
  - Run efibootmgr for only one device in multipath (jkonecny)
    Resolves: rhbz#1346725
  - Adjust the fraction of the progress bar (vponcova)
    Resolves: rhbz#1324706
  - network: take into account NICs activated in linuxrc.s390 (rvykydal)
    Resolves: rhbz#1329171
    Related: rhbz#1329171
  - network: don't crash on network devices configured in linuxrc.s390 (rvykydal)
    Resolves: rhbz#1329171


author: Radek Vykydal <rvykydal@redhat.com> - 13.21.259-1
changelog:
  - network: don't reactivate devices from linuxrc.s390 for early networking
    (rvykydal)
    Resolves: rhbz#1329171
  - Create lvm.conf with thin_* path overrides (mkolman)
    Resolves: rhbz#1350296


author: Radek Vykydal <rvykydal@redhat.com> - 13.21.261-1
changelog:
  - Remove 3com and bnx2 firmware to meet ppc64 image limit (rvykydal)
    Related: rhbz#1405089
    Resolves: rhbz#1405089


author: Radek Vykydal <rvykydal@redhat.com> - 13.21.263-1
changelog:
  - network: don't reactivate devices from linuxrc.s390 in loader only for IPv6
    (rvykydal)
    Resolves: rhbz#1421039


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-13
changelog:
  - fence_scsi: need stricter regular expression when looking for specific keys
    (fence_scsi_fix_regular_expression_for_grep.patch)
    Resolves: rhbz#670910
  - fence_scsi: unfencing fails when device reports "unit attention"
    (fence_scsi_always_do_sg_turs_before_registration.patch)
    (fence_scsi_always_do_sg_turs_on_dm_mp_devices.patch)
    Resolves: rhbz#640343
  - fence_scsi: verify that actions were successful
    (fence_scsi_verify_that_on_off_actions_succeed.patch)
    Resolves: rhbz#644385
  - fence_scsi: identify dm-multipath devices correctly
    (fence_scsi_identify_dm_multipath_devices_correctly.patch)
    Resolves: rhbz#644389
  - fence_scsi: properly log errors for all commands
    (fence_scsi_properly_log_errors_for_all_commands.patch)
    Resolves: rhbz#672597


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-17
changelog:
  - Allow fence_scsi to use any valid hexadecimal key
    (fence_scsi_allow_use_of_any_valid_hexadecimal_key.patch)
  - fence_scsi: grep for keys should be case insensitive
    (fence_scsi_grep_for_keys_should_be_case_insensitive.patch)
    Resolves: rhbz#653504


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-18
changelog:
  - fence_wti: Unable to parse output when split into several screens
    (fence_wti_unable_to_parse_output_when_split_into_several_screens_part1.patch)
    (fence_wti_unable_to_parse_output_when_split_into_several_screens_part2.patch)
    Resolves: rhbz#678522


author: Marek Grac <mgrac@redhat.com> - 3.0.12-20
changelog:
  - fencing: Accept other values for yes (on, true)
    (fence-agents-Accept-other-values-for-true.patch)
    Resolves: rhbz#679502


author: Marek Grac <mgrac@redhat.com> - 3.0.12-21
changelog:
  - fence_rhevm: Update URL for RHEV-M REST API
    (fence_rhevm-Update-URL-to-RHEV-M-REST-API.patch)
    Resolves: rhbz#681674


author: Marek Grac <mgrac@redhat.com> - 3.0.12-22
changelog:
  - fence_cisco_ucs: Add support for sub-organizations
    (fence_cisco_ucs-Support-for-sub-organization.patch)
    (fence_cisco_ucs-Fix-for-support-for-sub-organization.patch)
    Resolves: rhbz#678904


author: Lon Hohberger <lhh@redhat.com> - Version: 3.0.12-23
changelog:
  - fence_ipmilan: Correct return code for diag operation
    (fence_ipmilan_correct_return_code_for_diag_operation.patch)
    Resolves: rhbz#655764


author: Tomas Hozza <thozza@redhat.com> - 4.0.9-3
changelog:
  - Fix lftp to try also other addresses if connecting to first fails (#732863)
  - Fix lftp hang when using ascii mode with sftp (#842322)
  - Fix lftp to overwrite filename when auto-rename and clobber are enabled (#619777)
  - Add description of xfer:auto-rename into man page (#674875)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-7
changelog:
  - backport PGSTARTTIMEOUT variable from latest RHSCL while reasonably
    changing wait timeout to 2 seconds by default


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-4
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1788447


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-3
changelog:
  - Synchronize javazic tool for OpenJDK 6 & 7 with upstream. (#1212549)
  - Fix Africa/Casablanca transitions from 2027 forward. (#1217109)


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-2
changelog:
  - fixed initscript to be LSB compliant (rhbz#593228)
    - added euid 0 check
    - reload returns 3 (unimplemented feature)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-4
changelog:
  - added IPv6 transparent proxy support (rhbz#590186)
  - added auditing support (rhbz#642393)
    Thanks to Thomas Graf for the patch
  - init: restore context for save and use /etc/sysconfig for temps (rhbz#644273)


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-155
changelog:
  - Allow setroubleshootd to execute rpm
  Resolves:#833053
  - Add labeling for /usr/lib/flash-plugin/libflashplayer.so


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Tony Camuso <tcamuso@redhat.com>
changelog:
  - weak-modules: when adding a module, should collect the symbols from
    external modules of destination kernel
    Resolves: rhbz#1284935

  - weak-modules: Updating kernel was issuing warnings upon removal of
    old kernel.
    Resolves: rhbz#1343376

  - weak-modules: weak-modules does not handle periods in symbol names
    Resolves: rhbz#1389067


author: Will Cohen <wcohen@redhat.com> - 0.9.6-5
changelog:
  - Handle debuginfo section differences. rhbz #591538
  - Produce a 32-bit ppc oprofile packages for java support. rhbz #463223


author: Will Cohen <wcohen@redhat.com> - 0.9.6-10
changelog:
  - Corrections for i386/arch_perfmon filters.
  - Make nehalem events available.
  - Add AMD family 12/14/15h support. Resolves: rhbz #650126
  - Add Intel westmere support. Resolves: rhbz #643478
  - opcontrol numeric argument checking. Resolves: rhbz #589638


author: Paul Howarth <paul@city-fan.org> - 1:1.7.0.4-1.0.cf
changelog:
  - update to 1.7.0.4
    - new JVM (Java HotSpot Virtual Machine, version 23)
    - new supported garbage collector: Garbage First (G1)
    - JavaFX 2.1 Runtime co-installs with JRE 7 during auto-update
    - JAXP upgraded to 1.4.6
    - Java DB upgraded to 10.8.2.2
    - new flag to unlock commercial features


author: David Vossel <dvossel@redhat.com> - 3.9.2-35
changelog:
  - Fixes invalid return statement in LVM retry clvmd activation
  - Adds ability to disable findmnt to avoid autofs complications
    for fs-util based rgmanager agents.

    Resolves: rhbz#974941
    Resolves: rhbz#989284


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-81.el6
changelog:
  - Fix 'backport GDB 7.4 fix to RHEL 6.6 GDB' [Original Sourceware bug
    description: 'C++ (and objc): Internal error on unqualified name
    re-set', PR 11657] (RH BZ 1186476).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-82.el6
changelog:
  - Fix 'gdb/linux-nat.c:1411: internal-error:
   linux_nat_post_attach_wait: Assertion `pid == new_pid' failed.'
   (Pedro Alves, RH BZ 1162264).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 7.2-83.el6
changelog:
  - Fix 'gdb internal error' [Threaded program calls clone, which
    crashes GDB] (Pedro Alves, RH BZ 1099929).


author: Jan Kratochvil <jan.kratochvil@redhat.com> - 7.2-88.el6
changelog:
  - Add --with buildisa, remove %{?_isa} from BuildRequires by default:
    https://github.com/msimacek/koschei/issues/54 (Jan Kratochvil, RH BZ 1287044)


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12-32
changelog:
  - gfs2_edit enhancements:
    * gfs2_edit: handle corrupt file systems better
      (gfs2_edit_handle_corrupt_filesystems_better.patch)
    * gfs2_edit: print large block numbers better
      (gfs2_edit_print_large_block_numbers_better.patch)
    * gfs2_edit: has problems printing gfs1 journals
      (gfs2_edit_has_problems_printing_gfs1_journals.patch)
    * gfs2_edit: add -d option for printing journal details
      (gfs2_edit_add_d_option_for_printing_journal_details.patch)
    * gfs2_edit: Fix error message on blockalloc when outside bitmap
      (gfs2_edit_fix_error_message_blockalloc_when_outside_bitmap.patch)
    * gfs2_edit: fix careless compiler warning
      (gfs2_edit_fix_careless_compiler_warning.patch)
    * gfs2_edit: Fix bitmap editing function
      (gfs2_edit_fix_bitmap_editing_function.patch)
    * gfs2_edit: fix segfault in set_bitmap when block is in rgrp
      (gfs2_edit_fix_segfault_in_set_bitmap_when_block_is_rgrp.patch)
    Resolves: rhbz#674843
  - fenced: emit dbus signals to be handled by foghorn package for SNMP traps
    (fenced_send_dbus_signals_when_node_is_fenced.patch)
    (fenced_update_fenced_man_page_with_q_option.patch)
    (build_allow_dbus_notification_code_to_be_disabled.patch)
    Resolves: rhbz#592964
  - config: Update relax ng schema 
    (config_update_schema_2.patch)
  - doc: Update cluster_conf.html to match schema
    (doc_update_cluster_conf_html.patch)
    Resolves: rhbz#618705


author: Hans de Goede <hdegoede@redhat.com> 2.1-7
changelog:
  - Properly check dm_task_run return value (#585158)
    Resolves: #585158
  - Fix mkpartfs (ext2) on partitions >2TB (#585159)
    Resolves: #585159
  - Add a flag for detecting diagnostics / recovery partitions


author: Marek Kasik <mkasik@redhat.com> - 2.3.11-16
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197738


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-57
changelog:
  - Resolves: rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
  - Resolves: rhbz#745966 - sssd_pam segfaults on sssd restart
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-59
changelog:
  - Resolves: rhbz#742288 - RFC2307bis initgroups calls are slow
  - Resolves: rhbz#746654 - SSSD backend gets killed on slow systems
  - Related:  rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
                            Fixes a crash introduced by the earlier patch.
  - Related:  rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
                            Fixes for internationalization


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-60
changelog:
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-64
changelog:
  - Resolves: rhbz#749822 - SSSD may go into infinite loop during RFC2307bis
                            initgroups when groups appear in multiple nesting
                            levels


author: Than Ngo <than@redhat.com> - 3.5.10-21
changelog:
  - fix security issues in libltdl bundle within kdelibs CVE-2009-3736
  - backport upstream patches
  - patch autoconfigury to build with autoconf >= 2.64 (Stepan Kasal)


author: Than Ngo <than@redhat.com> - 3.5.10-25
changelog:
  - Resolves: bz#681901, drops old Obsoletes/Provides
  - Resolves; bz#734447, use ca-certificates' ca-bundle.crt


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.1
changelog:
  - Require softokn build 22 to ensure runtime compatibility.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
changelog:
  - copy digest algorithm when handling SNI context switch
  - improve documentation of ciphersuites - patch by Hubert Kario
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Jay Fenlason <fenlason@redhat.com> 3.2-10
changelog:
  - Add BuildRequires for libibmad-devel
  - Build against mpich, now that we have a mpi-3 version of it.
  - rebuild against new mvapich2
    R e s o l v e s: rhbz1011910, rhbz1011915


author: Jay Fenlason <fenlason@redhat.com> 3.2.4-1
changelog:
  - Backport from RHEL-7.0
  - Edit old changelog entries so commit can work.
  - Update to latest imb and osu versions, no longer using openfabrics.org
    tarball.
    Resolves: rhbz1093468


author: Michael Stead <mstead@redhat.com> 0.99.10-1
changelog:
  - latest strings from zanata (alikins@redhat.com)
  - 801434: Add at-spi accessibility name to calendar selection widget.
    (awood@redhat.com)
  - 800917: Display service level and type in All Subs tab (dgoodwin@redhat.com)
  - Add support for "release" command (alikins@redhat.com)
  - 801517: Missed translating a label during the registration process
    (bkearney@redhat.com)
  - 801513: One translation had a copy/paste error (bkearney@redhat.com)
  - The migration script should write default proxy auth settings.
    (awood@redhat.com)
  - Revert "801513: A replacement variable was used in a translation file where
    it was not needed" (dgoodwin@redhat.com)
  - 801545: Break apart the string to make them easier for the translators
    (bkearney@redhat.com)
  - 801513: A replacement variable was used in a translation file where it was
    not needed (bkearney@redhat.com)
  - 798015: Migration script should play nicely with proxies. (awood@redhat.com)
  - 742033: Unsubscribe button is not greyed out when nothing is selected
    (wpoteat@redhat.com)
  - 783990: Handle network errors when migrating. (awood@redhat.com)


