# changelog

author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.10.1.el6]
changelog:
  - [sound] Fix USB audio issues (wrong URB_ISO_ASAP semantics) (Jaroslav Kysela) [1273916 1255071]
  - [security] keys: Don't permit request_key() to construct a new keyring (David Howells) [1275927 1273463] {CVE-2015-7872}
  - [security] keys: Fix crash when attempt to garbage collect an uninstantiated keyring (David Howells) [1275927 1273463] {CVE-2015-7872}
  - [security] keys: Fix race between key destruction and finding a keyring by name (David Howells) [1275927 1273463] {CVE-2015-7872}
  - [ipc] Initialize msg/shm IPC objects before doing ipc_addid() (Stanislav Kozina) [1271504 1271505] {CVE-2015-7613}
  - [fs] vfs: Test for and handle paths that are unreachable from their mnt_root (Eric W. Biederman) [1209368 1209369] {CVE-2015-2925}
  - [fs] dcache: Handle escaped paths in prepend_path (Eric W. Biederman) [1209368 1209369] {CVE-2015-2925}
  - [netdrv] igb: add support for 1512 PHY (Stefan Assmann) [1278275 1238551]
  - [hid] fix unused rsize usage (Don Zickus) [1268203 1256568]
  - [hid] fix data access in implement() (Don Zickus) [1268203 1256568]
  - [fs] NFS: Hold i_lock in nfs_wb_page_cancel() while locking a request (Benjamin Coddington) [1273721 1135601]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.11.1.el6]
changelog:
  - [kvm] svm: unconditionally intercept DB (Paolo Bonzini) [1279467 1279468] {CVE-2015-8104}
  - [x86] virt: guest to host DoS by triggering an infinite loop in microcode (Paolo Bonzini) [1277557 1277559] {CVE-2015-5307}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.13.1.el6]
changelog:
  - [security] Don't leak a key reference if request_key tries to use a revoked keyring (David Howells) [1288095 1188442]
  - [fs] gfs2: Protect freeing directory hash table with i_lock spin_lock (Robert S Peterson) [1288093 1250663]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.14.1.el6]
changelog:
  - [scsi] bfa: Fix incorrect de-reference of pointer (Chad Dupuis) [1292370 1258533]
  - [netdrv] genetlink-compat: register multicast groups (Stanislaw Gruszka) [1291978 1259870]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.16.1.el6]
changelog:
  - [net] bonding: propagate LRO disable to slave devices (Jarod Wilson) [1287993 1259008]
  - [net] Move bonding headers under include/net (Jarod Wilson) [1287993 1259008]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.17.1.el6]
changelog:
  - [kernel] hrtimer: add force_hrtimer_reprogram kernel parameter (Prarit Bhargava) [1292082 1285142]
  - [mm] fix anon_vma->degree underflow in anon_vma endless growing prevention (Jerome Marchand) [1285693 1151823]
  - [mm] fix corner case in anon_vma endless growing prevention (Jerome Marchand) [1285693 1151823]
  - [mm] prevent endless growth of anon_vma hierarchy (Jerome Marchand) [1285693 1151823]
  - [mm] avoid anon_vma_chain allocation under anon_vma lock (Jerome Marchand) [1285693 1151823]
  - [mm] avoid repeated anon_vma lock/unlock sequences in unlink_anon_vmas() (Jerome Marchand) [1285693 1151823]
  - [mm] avoid repeated anon_vma lock/unlock sequences in anon_vma_clone() (Jerome Marchand) [1285693 1151823]
  - [scsi] only re-lock door after EH on devices that were reset (Ewan Milne) [1282464 995234]
  - [fs] fs: Unhash and evict unused children dentries after rmdir (Lukas Czerner) [1282621 1241030]
  - [fs] revert 'vfs: Unhash and evict unused children dentries after rmdir' (Carlos Maiolino) [1282621 1241030]
  - [netdrv] macvtap: fix network header pointer for VLAN tagged pkts (Ivan Vecera) [1280206 1213846]
  - [net] Fix vlan_get_protocol for stacked vlan (Ivan Vecera) [1280206 1213846]
  - [scsi] ipr: Fix incorrect trace indexing (Gustavo Duarte) [1280211 1209543]
  - [scsi] ipr: Fix invalid array indexing for HRRQ (Gustavo Duarte) [1280211 1209543]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-573.18.1.el6]
changelog:
  - [netdrv] bonding: "primary_reselect" with "failure" is not working properly (Jarod Wilson) [1295924 1290672]
  - [net] netpoll: Close race condition between poll_one_napi and napi_disable (Neil Horman) [1295370 1252212]


author: Ian Wells <esmith@wellsi.com> - 0.98.4-2.sme
changelog:
  - Add BuildRequires for openssl-devel and libxml2-devel [SME: 8457]
  - Remove Packager and Vendor from spec file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.117-1
changelog:
  - Update to latest upstream release with various fixes and
    enhancementsdetailed in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-1
changelog:
  - Fix LV processing with selection to always do the selection on initial state.
  - Store metadata size + checksum in lvmcache and add struct lvmcache_vgsummary.
  - Remove inaccessible clustered PVs from 'pvs -a'.
  - Don't invalidate cached orphan information while global lock is held.
  - Avoid rescan of all devices when requested pvscan for removed device.
  - Measure configuration timestamps with nanoseconds when available.
  - Disable lvchange of major and minor of pool LVs.
  - Fix pvscan --cache to not scan and read ignored metadata areas on PVs.
  - Disallow vgconvert from changing metadata format when lvmetad is used.
  - Don't do a full read of VG when creating a new VG with an existing name.
  - Reduce amount of VG metadata parsing when looking for vgname on a PV.
  - Avoid reparsing same metadata when reading same metadata from multiple PVs.
  - Save extra device open/close when scanning device for size.
  - Fix seg_monitor field to report status also for mirrors and thick snapshots.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-2
changelog:
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Add --enable-halvm and --disable-halvm options to lvmconf script.
  - Add --services, --mirrorservice and --startstopservices option to lvmconf.
  - Use proper default value of global/use_lvmetad when processing lvmconf script.
  - Set correct vgid when updating cache when writing PV metadata.
  - Don't silently accept lvcreate -m with raid4/5/6.
  - Add A_PARTITION_BY_TAGS set when allocated areas should not share tags.
  - Respect allocation/cling_tag_list during intial contiguous allocation.
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Log relevant PV tags when using cling allocation.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-3.el6_7.2
changelog:
  - Fix alloc segfault when extending LV with fewer stripes than in first seg.
  - Fix regression in cache causing some PVs to bypass filters (2.02.105).


author: Andreas Schneider <asn@redhat.com> - 3.6.23-15
changelog:
  - resolves: #1165750 - Fix guid retrieval for published printers.
  - resolves: #1163383 - Fix 'net ads join -k' with existing keytab entries.
  - resolves: #1195456 - Fix starting daemons on read only filesystems.
  - resolves: #1138552 - Fix CPU utilization when re-reading the printcap info.
  - resolves: #1144916 - Fix smbclient NTLMv2 authentication.
  - resolves: #1164336 - Document 'sharesec' command for
                         'access based share enum' option.


author: Andreas Schneider <asn@redhat.com> - 3.6.23-21
changelog:
  - resolves: #1252180 - Fix 'force group' with 'winbind use default domain'.
  - resolves: #1250100 - Fix segfault in pam_winbind if option parsing fails


author: Andreas Schneider <asn@redhat.com> - 3.6.23-22
changelog:
  - resolves: #1290706 - CVE-2015-5299
  - related: #1290706 - CVE-2015-5296
  - related: #1290706 - CVE-2015-5252
  - related: #1290706 - CVE-2015-5330


author: Ian Wells <esmith@wellsi.com> 2.4.0-8.sme
changelog:
  - Add e-smith as a Requires(pre) and remove adding users in %pre
  - Fix uid and gid to be the same in create-system-user [SME: 7547]


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-15.sme
changelog:
  - Added a password creation (set_secret) [SME: 8943]
  - code from Charlie Brady <charlieb-contribs-bugzilla@budge.apana.org.au>


author: Bill Nottingham <notting@redhat.com> 1.3.49.1-1
changelog:
  - backport LSB fixes from head
  - fixes: #693202/#771455, #649227/#771452, #750446/#771454, #701573/#771741, #696305 (<jbastian@redhat.com>)


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 5.1.6-5
changelog:
  - add pdo_dblib module for php-mssql
  - add php-interbase support (both interbase and pdo_firebird modules)
    (initial patch from Remi Collet <fedora@famillecollet.com>)


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 5.3.2-3
changelog:
  - drop readline (now in the main php package)
  - drop mhash (no more provided in php, hash used instead)
  - spec file cleanup


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 5.3.3-2
changelog:
  - drop tidy (now in the main php package, #1031936)
  - spec file and build scripts cleanup
  - improve package descriptions
  - fix mcrypt tests on ppc64 (backport from php-5.4)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-105
changelog:
  - Fix ControlPersist option with ProxyCommand (#1160487)
  - Backport fix of ssh-keygen with error : gethostname: File name too long (#1161454)
  - Backport show remote address instead of UNKNOWN after timeout at password prompt (#1161449)
  - Fix printing of extensions in v01 certificates (#1093869)
  - Fix confusing audit trail for unsuccessful logins (#1127312)
  - Don't close fds for internal sftp sessions (#1085710)
  - Fix config parsing quotes (backport) (#1134938)
  - Enable logging in chroot into separate file (#1172224)
  - Fix auditing when using combination of ForcedCommand and PTY (#1131585)
  - Fix ssh-copy-id on non-sh remote shells (#1135521)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-106
changelog:
  - Add missing ControlPersist option to man ssh (#1197763)
  - Add sftp option to force mode of created files (#1191055)
  - Do not load RSA1 keys in FIPS mode (#1197072)
  - Add missing support for ECDSA in ssh-keyscan (#1196331)
  - Fix coverity/gcc issues (#1196063)
  - Backport wildcard functionality for PermitOpen in sshd_config file (#1159055)
  - Ability to specify an arbitrary LDAP filter in ldap.conf (#1119506)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-109
changelog:
  - Fix problems with failing persistent connections (#1131585)
  - Fix memory leaks in auditing patch (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-110
changelog:
  - Fix minor problems found by covscan/gcc (#1196063)
  - Add missing options in man ssh (#1197763)
  - Add KbdInteractiveAuthentication documentation to man sshd_config (#1109251)
  - Correct freeing newkeys structure when privileged monitor exits (#1208584)


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.3
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Require softokn build 22 to ensure runtime compatibility.
  - Relax the requirement from pkcs11-devel to nss-softokn-freebl-devel
    to allow same or newer.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-8
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289881


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-11.sme
changelog:
  - Add a migrate fragment to sanitize the host comment [SME: 8723]
  - Code done by  Charlie Brady <charlieb-contribs-bugzilla@budge.apana.org.au>
  - and Huib <sme@artixdesign.com>


author: Daniel Berteaud <daniel@firewall-services.com> 5.4.0-13.sme
changelog:
  - Don't overwrite the ldif dump if slapcat's output is empty
    (code from Charlie Brady) [SME: 8621]


author: Remi Collet <rcollet@redhat.com> - 5.3.3-38
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-39
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Daniel Berteaud <daniel@firewall-services.com> - 3.3.2-58.sme
changelog:
  - Update RegistrarBoundaries.pm to the one from 3.4.1 so URIBL tests are
    done on new tld [SME: 8980]


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-1
changelog:
  - update to 4.2.6p5 (#654004, #641800, #714079, #714084, #716968, #819781,
    - bind broadcast client to new interfaces (#973807)
  - allow selection of cipher for private key files (#749530)
  - retry few times in ntpdate init script before giving up (#673198)
  - print synchronization distance instead of dispersion in ntpstat (#830821)
  - ignore duplicate servers from dhclient (#862983)
  - add fourth server to default ntp.conf and use iburst (#667524, #623616)
  - drop comment enabling local driver in default config (#816645)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5.el6_7.2
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Akira TAGOH <tagoh@redhat.com> - 1.28.1-10
changelog:
  - Avoid the error message at %postun on upgrading to rhel7. (#1086690)
  - Use correct rpm macro for man page (#885846)


author: John H. Bennett III <bennettj@johnbennettservices.com> 2.4.0-7.sme
changelog:
  - Re-do patch to add missing default httpd.conf modules [SME: 7874]
  - Add authz_groupfile as a loadable Module [SME: 7875]


author: Steve Dickson <steved@redhat.com> - 0.2.0-10
changelog:
  - Make is_loopback check more permissive (bz 731542)
  - Removed the rpcbind(3) reference in the man page (bz 813898)


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Carlos O'Donell <carlos@redhat.com> -2.12-1.166.1
changelog:
  - The malloc deadlock avoidance support has been temporarily removed since it
    triggers deadlocks in certain applications (#1244002).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.166.2
changelog:
  - Unlock main arena after allocation in calloc (#1256812).
  - Enable robust malloc change again (#1256812).
  - Fix perturbing in malloc on free and simply perturb_byte (#1256812).
  - Don't fall back to mmap prematurely (#1256812).


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.166.3
changelog:
  - Check for NULL arena pointer in _int_pvalloc (#1256890).
  - Don't change no_dyn_threshold on mallopt failure (#1256891).


author: Daniel Berteaud <daniel@firewall-services.com> 2.4.0-5.sme
changelog:
  - Allow setting SSL protocols from DB (and set TLSv1 back to enabled
    on a default install) [SME: 9175]


author: Daniel Berteaud <daniel@firewall-services.com> - 1.4.0-19.sme
changelog:
  - Allow settings SSL protocols from DB (and set TLSv1 back to enabled
    on a default install) [SME: 9175]


author: Honza Horak <hhorak@redhat.com> - 7.1-6
changelog:
  - Allow buffer length of the block to be shorter than multiple of 16,
    even in case of DAO writing
    Resolves: #807474


author: Dan Horák <dan@danny.cz> - 1.28-1
changelog:
  - update to version 1.28
  - added fixes from RHEL to rescan-scsi-bus.sh
  - added scsi-rescan symlink to the rescan-scsi-bus.sh script


author: Dan Horák <dan@danny.cz> - 1.28-2
changelog:
  - include rescan-scsi-bus script 1.35
  - rebase patches and add fix for issue mentioned in #538787
  - Related: #538787


author: Zdenek Prikryl <zprikryl@redhat.com> - 1.0.8-1
changelog:
  - Updated to version 1.0.8
  - power.sh works with ConsoleKit >= 0.3.0 (#470752)
  - Fixed conditions in power.sh, which look for power-managers (#470752)
  - Added check to init script


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-3
changelog:
  - Synchronize javazic tool for OpenJDK 6 & 7 with upstream. (#1212549)
  - Fix Africa/Casablanca transitions from 2027 forward. (#1217109)


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.8-1
changelog:
  - New upstream release 1.1.8
  - Required for latest Samba 4 beta
  - Fixes for pyldb
  - Revert to using tdb1 by default
  - Drop support for tdb_compat
  - CCAN is no longer built as a static library


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.9-1
changelog:
  - New upstream release 1.1.9
  - Required for Samba 4 Beta 5
  - Ensure rename target does not exist before deleting old record
  - Add parameter to avoid NULL format string flagged by -Werror=format


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.13-3
changelog:
  - use the proper %patch stanza to make rpmdiff happy
  - related: rhbz#873422 - LDB 1.1.13 exports improper ABI


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.13-3.1
changelog:
  - Resolves: rhbz#1290712 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.2.z]
  - Remove the patch from the previous commit, it doesn't fix a remotely
    eploitable issue. Add patches from upstream #11636 instead.


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-47.1
changelog:
  - mod_proxy: fix regression caused inherited workers to use a different
    scoreboard slot then the original one (#1252574)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-18.el6
changelog:
  - CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1149086)
  - Fix html serialization error and htmlSetMetaEncoding (rhbz#1004513)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-19.el6
changelog:
  - Stop parsing on entities boundaries errors
  - Fix missing entities after CVE-2014-3660 fix (rhbz#1149086)


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-20.1
changelog:
  - Fix a series of CVEs (rhbz#1286495)
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - Libxml violates the zlib interface and crashes


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-278
changelog:
  - Allow logrotate get attributes of all unallocated tty device nodes.
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
  - Allow glusterd to connect to init.
  Resolves:#1230371
  - Allow gluster do dbus chat with domain running as initrc_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.1
changelog:
  - Backport gluster fixes from RHEL7
   - execute showmount in own domain
  Resolves:#1248520
   - execute nsfd in own domain
   - allow gluster to connect to all ports
   - Add support for /usr/sbin/ctdbd_wrapper.
   - nrpe needs kill capability to make gluster moniterd nodes working.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.2
changelog:
  - Allow nmbd to create pids files/dirs under /var/run/samba with correct labeling.
  Resolves:#1248520


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.6
changelog:
  - Allow qpidd to be working with MRG. It requires to manage symlinks in /var/lib/qpidd.
  Resolves:#1257318
  Resolves:#1257319


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.8
changelog:
  - Allow ipsec_mgmt_t to access netlink route socket and set attributes for /var/run/pluto directories.
  Resolves:#1289019


author: Harald Hoyer <harald@redhat.com> 147-2.58
changelog:
  - do not print error, if /sys/class/firmware/timeout does
    not exist (yet)
  Resolves: rhbz#1140336
  - always call modprobe, even when a driver is bound to the device
  Resolves: rhbz#1084513
  - fixed for every modprobe locked worker, increase max_childs
    use ncnt instead of zcnt
  Resolves: rhbz#1164960
  - print warning in start_udev, if udevlog is used
  Resolves: rhbz#876535


author: Harald Hoyer <harald@redhat.com> 147-2.60
changelog:
  - ata_id - fixup all 8 not only 6 bytes of the fw_rev string
  Resolves: rhbz#794561
  - udev: properly handle symlink removal by 'change' event
  Resolves: rhbz#1018171


author: Michal Sekletar <msekleta@redhat.com> - 147-2.63.1
changelog:
  - also limit the additional modprobe locked workers (#1281469)
  - 80-drivers.rules: only make an exception for ipmi for modprobe with DRIVER set (#1281467)


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-17
changelog:
  - fix #841520 - do not try to change owner of log if it is not needed
  - fix #848131 - fix bad umask value while creating temp file
  - fix #920030 - set SELinux context before compress files creation
  - fix #922169 - remove temp files on error
  - fix #847338 - do not overwrite create directive value by ACL setting
  - fix #847339 - fix race condition between fchmod and acl_set_fd


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-18
changelog:
  - fix #722209 - do not redirect output of logrotate to /dev/null, mark
    logrotate.conf as config
  - fix #1117189 - sort logs according to dateformat when removing the old one
  - fix #625034 - update logrotate.status atomically
  - fix #984965 - fix possible overflow in "create" directive parsing
  - fix #1012485 - use permissions 0700 for cron.daily script


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-19
changelog:
  - fix #1047899 - add support for "maxsize" directive
  - fix #1125769 - add support for "createolddir" directive


author: Pavel Šimerda <psimerda@redhat.com> - 32:9.8.2-0.37.rc1
changelog:
  - Resolves: 1215687 - DNS resolution failure in high load environment with
    SERVFAIL and "out of memory/success" in the log


author: Ian Wells <esmith@wellsi.com> 2.4.0-6.sme
changelog:
  - Provide the ability to restrict ibay access to https, by JPP [SME: 882]
  - Remove old migrate fragment [SME: 8080]
  - Whitespace cleanup, mainly tab removal, of 90e-smithAccess40ibays


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-8.sme
changelog:
  - Add more PHP options to ibays only by db commands [SME: 8239]
  - Add SSLRequireSSL to ibays  when SSL is set to enabled [SME: 8239]


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-9.sme
changelog:
  - Perl::critic syntax modifications  [SME: 8239]
  - Add more PHP options to ibays only by db commands [SME: 8239]
  - Add SSLRequireSSL to ibays  when SSL is set to enabled [SME: 8239]


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-11.sme
changelog:
  - Add an upload_tmp_folder setting by db command [SME: 7011]
  - Thanks to Michael McCarn and Jean-philippe Pialasse


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-12.sme
changelog:
  - Add an upload_tmp_folder setting by db command [SME: 7011]
  - Thanks to Michael McCarn and Jean-philippe Pialasse
  - init-ibays create the folder tmp within all i-bays root directory
  - ibay-modify create/chown/chmod the folder tmp within the i-bays root directory


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-26
changelog:
  - #1089817 - Return value of pgrep is incorrect
  - #950748 - /lib64/libproc.so package both in procps and procps-devel
  - #1011216 - Backport man page fix of top utility - RES = CODE + DATA
  - #1082877 - top/man: RES - physical memory a task 'has used'->'is using'
  - #1034337 - Include man pages for openproc(), readproc() and readproctab()
  - Resolves: rhbz#1089817 rhbz#950748 rhbz#1011216 rhbz#1082877 rhbz#1034337


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-27
changelog:
  - #1060681 - ps -p cycles over all PIDs instead of just one
  - #963799 - Should shared memory be accounted in cached in free output?
  - Resolves: rhbz#1060681 rhbz#963799


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-28
changelog:
  - #1105125 - Locale dependent float delay in top and watch utilities
  - #1039013 - Include an API in RHEL to return the number of opened file descriptors for a process
  - Resolves: rhbz#1105125
  - Related: rhbz#1034337


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-31
changelog:
  - #993072 - Make the "free" command a little more human friendly
  - #1172059 - ps coredump in stat2proc()
  - #1120580 - [RFE] Have sysctl -p read info from /etc/sysctl.d
  - #1123311 - RFE: "w" should have "-n" flag to suppress reverse name resolution of IP addresses
  - #1163404 - [procps] find_elf_note invalid read if setenv has been called before libproc init
  - Resolves: rhbz#993072 rhbz#1172059 rhbz#1120580 rhbz#1123311 rhbz#1163404


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-9.sme
changelog:
  - allow IP relayclient stored by DB [SME: 8704]
  - Code from Stefano ZAmboni <zamboni@mind-at-work.it>


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-10.sme
changelog:
  - allow IP relayclient stored by DB [SME: 8704]
  - Code from Stefano ZAmboni <zamboni@mind-at-work.it>
  - & Charlie Brady <charlieb-contribs-bugzilla@budge.apana.org.au>


author: Paul Howarth <paul@city-fan.org> - 0.21-1
changelog:
  - Update to 0.21
    - Fix spanner clean() docs (CPAN RT#14535)
    - Undef dereference with empty object (CPAN RT#25898)
    - Add short_list_range() method (CPAN RT#30777)
    - clean() or list() before add() causes error (CPAN RT#48308)
    - spanner add() did not accept non-object (CPAN RT#50042)
    - "::" not accepted as valid IPv6 address (CPAN RT#52571)
  - Don't create license files


author: Ian Wells <esmith@wellsi.com> 2.4.0-21.sme
changelog:
  - Move support.pl from e-smith-base to smeserver-support [SME: 8264]
  - This console license page now uses dialog's textbox.


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.6.0-4.sme
changelog:
  - added a motd message to increase involvements or donations [SME: 8939]
  - Code done by John Crisp <jcrisp@safeandsoundit.co.uk> and 
  - Stefano Zamboni <zamboni@mind-at-work.it>


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.6.0-5.sme
changelog:
  - created a template for /etc/system-release [SME: 8939]
  - Added smeserver-support-2.6.0.bz8939.system-release-template.patch


author: Karel Klic <kklic@redhat.com> - 6.0-1
changelog:
  - Rebase to upstream 6.0
    Resolves: #594860
  - Fixed a buffer overflow (rhbz#532380, unzip-6.0-attribs-overflow.patch)
  - Generate debuginfos (rhbz#540220, unzip-6.0-nostrip.patch)
  - New upstream version
  - Compiled using `make generic_gcc` (includes asm)
  - Removed unzip542-rpmoptflags.patch, because RPM_OPT_FLAGS
    are provided using command line
  - Removed unzip-5.51-link-segv.patch, because the link file
    is not reopened in the current version
  - Removed unzip-5.51-link-segv2.patch, the bug was already fixed
    in open_outfile in 5.52
  - Removed unzip-5.52-toctou.patch (CAN-2005-2475), the vulnerability
    is fixed in the current version
  - Removed unzip-5.52-near-4GB.patch, unzip-5.52-near-4GB2.patch,
    unzip-5.52-4GB3.patch, and unzip-5.52-4GB_types.patch, because
    the current version supports large files
  - Removed unzip-5.52-long-filename.patch, the current version
    fixes the vulnerability by checking the length of command line
    arguments in unzip.c
  - Removed unzip-5.52-makefile.patch, because we no longer create
    the link manually
  - Removed unzip-5.52-open.patch, the current version uses umask.
  - Removed unzip-5.52-cve-2008-0888.patch, the current version
    fixes this vulnerability
  - Ported unzip-5.52-249057.patch to current version (unzip-6.0-close)


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-2
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196133 #1196121 #1196125 #1196129


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-3
changelog:
  - Fix problem with symlink errors in archive with many files
  - add support of non-latin and non-unicode encodings for filenames
    Resolves: rhbz#740012 rhbz#885540


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-4
changelog:
  - Added patch for build option "-Werror=format-security"
  - Fix print of non-ascii filenames
    Resolves: rhbz#1284896


author: Ian Wells <esmith@wellsi.com> 2.4.0-5.sme
changelog:
  - Remove workarounds for how qpsmtpd tags spam email [SME: 8109]
  - Fix whitespace in 10required_score


author: stephane de Labrusse <stephdl@de-labrusse.fr> 0.84-11.sme
changelog:
  - Modify whitelist_soft transaction to interact with dnsbl filter [SME: 8747]
  - by John Crisp <jcrisp@safeandsoundit.co.uk>


author: Daniel Berteaud <daniel@firewall-services.com> 0.84-12.sme
changelog:
  - Revert forcing TLSv1 patch as it breaks some inbound delivery [SME: 8851]
  - Revert whitelist_soft dnsbl as it hasn't been verified yet and we need to
    push the fix for TLSv1 [SME: 8747]


author: stephane de Labrusse <stephdl@de-labrusse.fr> 0.84-15.sme
changelog:
  - Modify whitelist_soft transaction to interact with dnsbl filter [SME: 8747]
  - by John Crisp <jcrisp@safeandsoundit.co.uk>
  - Added qpsmtpd-0.84-make-dnsbl-more-whitelist_soft-aware.patch


author: Daniel Berteaud <daniel@firewall-services.com> 0.84-18.sme
changelog:
  - Allow reading SSL_version from the tls_protocols config file (and turn
    TLSv1 back on by default) [SME: 9162]


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-38
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.1
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.4
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Kamil Dudka <kdudka@redhat.com> - 1:4.4.2-4
changelog:
  - make it possible to recognize an autofs filesystem by find
  - add a new find's option -xautofs to not descend directories on autofs
    filesystems


author: Kamil Dudka <kdudka@redhat.com> - 1:4.4.2-8
changelog:
  - fix quotation punctuation in find(1) man page (#659730)
  - fix file descriptor leak with --execdir option (#1223557)


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-67
changelog:
  - dlm_controld: Adjust fence time comparison
    Resolves: #rhbz843160
  - man: update fence_node options
    Resolves: #rhbz886016
  - fenced: Wait for ringid
    gfs_controld: Fix first recovery case
    Resolves: #rhbz982305


author: Andrew Price <anprice@redhat.com> - 3.0.12.1-69
changelog:
  - fsck.gfs2: fix broken i_goal values in inodes
  - gfs2_convert: use correct i_goal values instead of zeros for inodes
  - fsck.gfs2: Reprocess nodes if anything changed - addendum 1 of 2
  - fsck.gfs2: addendum to fix broken i_goal values in inodes - addendum 2 of 2
    Resolves: rhbz#1149516


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-72
changelog:
  - xml: ccs_update_schema: be verbose about extraction fail
    Resolves rhbz#1087286
  - qdiskd: warn if no heuristics defied for >2 node clusters
    Resolves: rhbz#1095418
  - *_controld: better logging if receive_start fails
    Resolves: rhbz#1095657
  - qdiskd: Enable master_wins if votes=1
    Resolves: rbhz#1099223
  - cman: fix cman.5 man page to indicate only 1 altname is allowed
    Resolves: rhbz#1111500
  - cman: Slight fix to message issued for invalid two_node clusters
    Resolves: rhbz#1142947


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-73.1
changelog:
  - gfs_controld: Retry uevent recv() and reconnect uevent socket on error
    Resolves: rhbz#1234443
  - dlm_controld: Retry uevent recv() and reconnect uevent socket on error
    Resolves: rhbz#1233535


author: Daniel Berteaud <daniel@firewall-services.com> 5.6.0-19.sme
changelog:
  - Only fire the ip-change event when IP is assigned to WAN nic
    (Code by Charlie Brady and John Crisp) [SME: 8896]


author: Tom Lane <tgl@redhat.com> 2:1.2.46-1
changelog:
  - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,
    CVE-2011-2691, CVE-2011-2692
  Resolves: #721306


author: Tomas Hozza <thozza@redhat.com> 1.12-5
changelog:
  - Fix the parsing of weblink when doing recursive retrieving (#960137)
  - Fix errors found by static analysis of source code (#873216)


author: Tomas Hozza <thozza@redhat.com> - 1.12-8
changelog:
  - Added build dependency needed to run HTTP unit tests (Related #1295847)
  - Explicitly disabled IDN/IRI support during build due to QA TPS test failures (Related #1295847)


author: stephane de Labrusse <stephdl@de-labrusse.fr> 2.6.0-5.sme
changelog:
  - corrected typo in e-smith-manager-2.4.0-dont_rewrite_to_https_from_localhost.patch
  - code from John H. Bennett III bennettj@johnbennettservices.com [SME: 9271]


author: Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-7.sme
changelog:
  - fix 307 redirection to http when https is used [SME: 8825]
  - update syntaxe for TKT Auth
  - bump 7 for typo


author: Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-12.sme
changelog:
  - Update server-manager to Koozali branding [SME: 9678]
  - We thanks John Crisp for his wonderful work.
  - e-smith-manager-2.6.0-Koozali_manager.patch


author: Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-13.sme
changelog:
  - fix bad redirection parameter that might reveal session information to remote site [SME: 9920]
  - temporarily reverting patch 4 for fast release of security fix
  - please put it back at next release


