# changelog

author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.15-4
changelog:
  - Related: rhbz#543948
  - TPROXY needs libcap. Also increases security a little.
  - merged relevant upstream bugfixes waiting for next 3.1 release


author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.16-1
changelog:
  - Resolves: #564296 - Rebase to new upstream tarball (fixes licensing issues)
  - Resolves: #561743 - CVE-2010-0308 squid: temporary DoS (assertion failure) triggered by truncated DNS packet (SQUID-2010:1)
  - fixes rpmlint issues in spec file
  - fixed rpmlint issue initscript file


author: Jiri Skala <jskala@redhat.com> -7:3.1.4-1
changelog:
  - Resolves: #564296 - Rebase squid to stable upstream tarball 3.1.4
  - bugfix release, issues relating to IPv6, TPROXY, Memory
    management, follow_x_forwarded_for, and stability fixes


author: Jiri Skala <jskala@redhat.com> -7:3.1.10-1
changelog:
  - Resolves: #639365 - Rebase squid to version 3.1.10
  - Resolves: #666533 - small memleak in squid-3.1.4


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-5
changelog:
  - spec cleanup
  - simplified packaging (merge -perl in -utils)
  - remove obsoleted and/or unmaintained additional sources/patches
  - remove long time not used files from the cvs/srpm
  - update additional sources/patches from their upstream


author: Than Ngo <than@redhat.com> - 4.6.2-9
changelog:
  - Resolves: bz#575248, rebase to 4.6.2
  - fix build issue in webkit on s390x
  - fix a crash when reparenting an item in QGraphicsView, QTBUG-6932


author: Than Ngo <than@redhat.com> - 4.6.2-15
changelog:
  - Resolves: bz#589165
     fix multiple flaws in webkit
     CVE-2010-0047, CVE-2010-0648, CVE-2010-0656


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-9
changelog:
  - Handle non-existent dependency sets correctly in python (#593621)
  - Permit DOS-style line-endings in PGP armor headers (#532992)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-10
changelog:
  - Fix empty reply from server on url retrieve (#598988)
  - Drop suid/sgid bits and capabilities on upgrade/erase (#598832)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-13
changelog:
  - Require matching arch for freshen on colored transactions (#553108, #479608)
  - Verify that generated signature can be used by rpm (#608599)
  - Fix broken pipe on font provide generation + better error message (#609117)
  - Fix find-debuginfo.sh behavior on cross-directory hardlinks (#618428)
  - Generate gdb index for debuginfos (#652787)
  - Fix verifyscript return code on failure (#668629)


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-14
changelog:
  - Fix signature comparison on package resigning (#608608)
  - Let error messages from gpg through on passphrase checking (#607222)
  - Only enforce default umask during transaction (#565843)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-3
changelog:
  - core: fix access to NMAccessPoint objects HwAddress property (rh #606147)
  - core: more cleanly handle s390-specific options
  - core: better behavior when missing firmware appears (rh #609587)
  - core: map hostname to current IP address (rh #613821)
  - ifcfg-rh: match initscripts behavior for persistent hostnames (rh #613841)
  - editor: fix crash checking permissions during editor window close (rh #603566) (rh #614057)
  - editor: fix listing of connections on ppc64 (rh #608663)
  - applet: fix remembering "Don't warn me again" for missing CA certs (rh #610084)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-4
changelog:
  - core: enable DHCPv6-only configurations (rh #612445)
  - core: don't fail connection immediately if DHCP lease expires (rh #616084) (rh #590874)
  - core: read deprecated nm-system-settings.conf first (rh #606160)
  - core: fix editing of PPPoE system connections
  - core: work around twitchy frequency reporting of various wifi drivers
  - core: don't tear down user connections on console changes (rh #614556)
  - editor: fix crash when canceling editing in IP address pages (rh #610891)
  - editor: fix handling of s390-specific options


author: Dan Williams <dcbw@redhat.com> - 0.8.1-5
changelog:
  - core: quiet annoying warnings (rh #612991)
  - core: fix retrieval of various IP options in libnm-glib (rh #611141)
  - core: ship NetworkManager.conf instead of deprecated nm-system-settings.conf (rh #606160)
  - core: add short hostname to /etc/hosts too (rh #621910)
  - core: recheck autoactivation when new system connections appear
  - cli: wait a bit for NM's permissions check to complete (rh #614866)
  - ifcfg-rh: ignore BRIDGE and VLAN configs and treat as unmanaged (rh #619863)
  - man: add manpage for nm-online
  - applet: fix crash saving ignore-missing-CA-cert preference (rh #619775)
  - applet: hide PIN/PUK by default in the mobile PIN/PUK dialog (rh #615085)
  - applet: ensure Enter closes the PIN/PUK dialog (rh #611831)
  - applet: fix another crash in ignore-CA-certificate handling (rh #557495)
  - editor: fix handling of Wired/s390 connections (rh #618620)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-6
changelog:
  - core: enable proactive key caching when using PEAP-GTC (rh #636877)
  - applet: fix inital sensitivity of context menu checkboxes (rh #633501)
  - applet: fix Punjabi translations (rh #589230)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-7
changelog:
  - core: add DHCP lease-change events to the dispatcher (rh #662730)
  - core: validate Enable/Disable WiFi and WWAN requests (rh #626337)
  - core: don't update /etc/hosts with current hostname (rh #668830)
  - wifi: ensure Enabled state is preserved regardless of rfkill (rh #584271)
  - ifcfg-rh: respect GATEWAYDEV for ibft/iSCSI configs (rh #665027)
  - ifcfg-rh: handle IPv6 gateway correctly for static addressing configs (rh #666078)


author: Jiří Klimeš <jklimes@redhat.com> - 0.8.1-8
changelog:
  - applet: display IPv6 info under applet's 'Connection Information' (rh #634152)
  - applet,nm: fix translations (rh #589230)


author: Elio Maldonado <emaldona@redhat.com> - 3.12.4-16
changelog:
  - allow prelink of softoken and freebl. Change the verify code to use
    prelink -u if prelink is installed. Fix by Robert Relyea


author: Elio Maldonado <emaldona@redhat.com> - 3.12.6-2.1
changelog:
  - Don't enable FIPS when CONFIG_CRYPTO_FIPS=n
  - Fix typo in the package description
  - Fix capitalization error in prelink conflict statement
  - Require nspr 4.8.4


author: Elio Maldonado <emaldona@redhat.com> - 3.12.9-7
changelog:
  - Update expired PayPayEE.cert test certificate
  - Conditionalize some database tests on user not being root


author: Matthias Clasen <mclasen@redhat.com> - 2.16.0-4
changelog:
  - Don't call xmlCleanupParser, it breaks other users of thread-private
    storage
    Resolves: #578568


author: Tomas Heinrich <theinric@redhat.com> - 4.4.2-1
changelog:
  - upgrade to new upstream stable version 4.4.2
    Resolves: #554998
  - add support for arbitrary number of open file descriptors
  - run libtoolize to avoid errors due mismatching libtool version
  - change exec-prefix to /


author: Tomas Heinrich <theinric@redhat.com> - 4.4.2-3
changelog:
  - remove '_smp_mflags' make argument as it seems to be
    producing corrupted builds
    Resolves: #556522


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-1
changelog:
  - upgrade to new upstream stable version 4.6.2
    Resolves: #554998
  - correct the default value of the OMFileFlushOnTXEnd directive
  - add upstream fix for message-induced off-by-one error
  - change the default value of the HUPisRestart directive to enabled
  - remove autoconf, automake, libtool from BuildRequires
  - change exec-prefix to nil
  - redefine _libdir as it doesn't use _exec_prefix
    Resolves: #591860


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-2
changelog:
  - Fix a potential segfault upon SIGHUP induced restart
    Resolves: #598421
  - Add Obsoletes: sysklogd
    Resolves: #513277


author: Tomas Heinrich <theinric@redhat.com> 4.6.2-3
changelog:
  - build rsyslog with PIE and RELRO
    Resolves: #642994
  - add ChangeLog file to documentation
  - add /etc/pki/rsyslog directory


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-11.el6
changelog:
  - Support vram specification for qxl graphics (rhbz#673578)
  - Fix parsing int options in virsh (rhbz#639587)
  - Use -o encryption=on instead of -e for qemu-img (rhbz#676984)
  - Support domain snapshots with current QMP (rhbz#589076)
  - Update auditing support (rhbz#642785)
  - Only request sound cgroup ACL when required (rhbz#680398)
  - Allow fine-tuning of device ACL permissions (rhbz#683163)
  - Support vhost in attach-interface (rhbz#683276)
  - Don't request cgroup ACL access for /dev/net/tun (rhbz#683305)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-12.el6
changelog:
  - Fix vram settings for qxl graphics (rhbz#673578)
  - Free stream when domain shuts down while its console is open (rhbz#682741)
  - Use hardcoded python path in libvirt.py (rhbz#684204)
  - Add missing checks for read only connections (CVE-2011-1146)
  - Eliminate potential null pointer deref when auditing macvtap devices (rhbz#642785)
  - Insert error messages to avoid a quiet abortion of commands (rhbz#605660)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-13.el6
changelog:
  - Properly report error in virConnectDomainXMLToNative (CVE-2011-1146)
  - Handle DNS over IPv6 (rhbz#687896)
  - Start dnsmasq even if no dhcp ranges/hosts are specified (rhbz#687291)
  - Use a separate dhcp leases file for each network (rhbz#687551)
  - Fix a possible crash in storage driver (rhbz#684712)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-14.el6
changelog:
  - Fix delayed events when SASL is active (rhbz#624252)
  - Fix ref-counting bugs (rhbz#688774)
  - Log an error if on failure to connect to netlink socket (rhbz#689001)
  - Log error and abort network startup when radvd isn't found (rhbz#688957)
  - Add PCI sysfs reset access rights to qemu (rhbz#689002)
  - Fix regression with qemu:///session URI (rhbz#684655)
  - Avoid leaking PCI config fd into qemu (rhbz#687993)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-15.el6
changelog:
  - Fix return value for virJSONValueFromString if it fails (rhbz#688723)
  - Fix positioning to end of qemu log file (rhbz#689986)
  - Initialization error of qemuCgroupData in Qemu host usb hotplug (rhbz#690183)
  - 8021Qbh: Use preassociate-rr during the migration prepare stage (rhbz#684870)
  - Make error reporting in libvirtd thread safe (rhbz#689374)
  - Add missing dependencies (rhbz#690022)
  - Fix restoring a compressed save image (rhbz#691034)
  - Fix label restore bugs in qemu driver (rhbz#690737)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-16.el6
changelog:
  - nwfilter: Enable rejection of packets (rhbz#681948)
  - Revert all previous error log priority hacks (rhbz#587603)
  - Filter out certain expected error messages from libvirtd (rhbz#587603)
  - qemu: Unlock qemu driver before return from domain save (rhbz#688774)
  - Do not send monitor command after monitor meet error (rhbz#688774)
  - qemu: Ignore libvirt debug messages in qemu log (rhbz#681492)
  - virsh: Fix memtune's help message for swap_hard_limit (rhbz#680190)
  - virsh: Fix documentation for memtune command (rhbz#680190)
  - docs: Fix typo (rhbz#680190)
  - Fix typo in systemtap tapset directory name (rhbz#693701)
  - qemu: Ignore unusable binaries (rhbz#676563)
  - qemu: Support for overriding NPROC limit (rhbz#674602)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-17.el6
changelog:
  - Don't return an error on failure to create blkio controller (rhbz#689030)
  - Fix possible infinite loop in remote driver (rhbz#691514)
  - qemu: Remove the managed state file only if restoring succeeded (rhbz#692998)
  - docs: Tweak virsh restore warning (rhbz#692998)


author: Jiri Denemark <jdenemar@redhat.com> - 0.8.7-18.el6
changelog:
  - network: Fix NULL dereference during error recovery (rhbz#696660)
  - virsh: Fix regression in parsing optional integer (rhbz#693963)
  - util: Fix crash when removing entries during hash iteration (rhbz#693385)
  - Experimental libvirtd upstart job (rhbz#678084)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.8.7-18.el6_1.1
changelog:
  - debug: Avoid null dereference on uuid lookup api (rhbz#728546)
  - Fix auditing of disk hotunplug operations (rhbz#728516)
  - storage: Fix regression with backing format (rhbz#726617)
  - Fix performance problem of virStorageVolCreateXMLFrom() (rhbz#715400)
  - qemu: Translate boot config into bootindex if possible (rhbz#715401)
  - remote: Protect against integer overflow (rhbz#717202)
  Resolves: rhbz#728546, rhbz#728516, rhbz#715400, rhbz#715401, rhbz#717202
  Resolves: rhbz#726617


author: Joe Orton <jorton@redhat.com> - 2.2.15-2
changelog:
  - init script fixes for LSB compliance (#546252)
   * exit code 2 for an unknown script argument
   * exit code 6 for a reload if config-test fails
   * exit code 7 for a reload on a stopped service
   * fixed help output to cover all options
  - mod_dav: handle PUT failure more cleanly (#572911)


author: Joe Orton <jorton@redhat.com> - 2.2.15-3
changelog:
  - add "Satisfy All" for .htaccess in httpd.conf (#594981)
  - adjust user/group creation in %pre (#594395)
  - mod_ssl: tweak OID() evaluation of unknown exts (#594980)


author: Joe Orton <jorton@redhat.com> - 2.2.15-4
changelog:
  - use init script to rotate logs (#606955)
  - disable keepalive for 100-continue and error response (#606964)


author: Joe Orton <jorton@redhat.com> - 2.2.15-6
changelog:
  - ab: fail gracefully for OOM allocating stats structures (#645846)
  - init script: use $STOP_DELAY as delay before SIGKILL of parent (#657480)
  - stop multiple invocations of filter init functions (#631849)
  - mod_ssl: avoid overlapping memcpy (#652335)
  - mark httpd.conf as noreplace


author: Joe Orton <jorton@redhat.com> - 2.2.15-7
changelog:
  - mod_ldap: fix caching with per-vhost directive use (#676635)
  - mod_ssl: fix startup with duplicate SSL vhost configurations (#676831)
  - prefork: ensure early child exit during graceful restart (#679476)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0-0.6.beta6.20100515
changelog:
  - use reserved uid and gid for dovecot user and group
  - create /var/run/dovecot/empty in advance in rpm


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0-0.8.beta6.20100630
changelog:
  - dovecot and pigeonhole updated
  - moved disable_plaintext_auth to 10-auth.conf
  - moved ACL and quota settings to a separate .conf files


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.8-1
changelog:
  - dovecot updated to 2.0.8 (fixes #654226), pigeonhole updated to 0.2.2
  - IMAP: Fixed SELECT QRESYNC not to crash on mailbox close if a lot of changes were being sent. 
  - Fixed leaking fds when writing to dovecot.mailbox.log.
  - Fixed rare dovecot.index.cache corruption
  - zlib: Fixed several crashes, which mainly showed up with mbox.
  - acl: Fixed crashing when sometimes listing shared mailboxes via dict proxy.
  - mdbox: Fixed potential assert-crash when saving multiple messages
    in one transaction
  - dsync: a lot of fixes
  - fixed lda + sieve crash


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-1
changelog:
  - dovecot updated to 2.0.9
  - fixed a high system CPU usage / high context switch count performance problem
  - lda: Fixed a crash when trying to send "out of quota" reply


author: Michal Hlavinka <mhlavink@redhat.com> - 82-6.1
changelog:
  - security fixes:
  - privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832)
  - race condition when checking source during mount (CVE-2011-1833)
  - mtab corruption via improper handling (CVE-2011-1834)
  - key poisoning via insecure temp directory handling (CVE-2011-1835)
  - arbitrary file overwrite via lock counter race (CVE-2011-1837)


author: Joe Orton <jorton@redhat.com> - 2010-3
changelog:
  - update to certdata.txt r1.58
  - add /etc/pki/tls/certs/ca-bundle.trust.crt using 'TRUSTED CERTICATE' format
  - exclude ECC certs from the Java cacerts database
  - catch keytool failures
  - fail parsing certdata.txt on finding untrusted but not blacklisted cert


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.5.1.el6]
changelog:
  - [kernel] cgroupfs: use init_cred when populating new cgroupfs mount (Eric Paris) [713135 700538]
  - [netdrv] ixgbe: adding FdirMode module option (Andy Gospodarek) [711550 707287]
  - [crypto] testmgr: add xts-aes-256 self-test (Jarod Wilson) [711548 706167]
  - [fs] ext3: Fix lost extented attributes for inode with ino == 11 (Eric Sandeen) [712413 662666]
  - [mm] Prevent Disk IO throughput degradation due to memory allocation stalls (Larry Woodman) [711540 679526]
  - [net] sock: adjust prot->obj_size always (Jiri Pirko) [709381 704231]
  - [fs] GFS2: resource group bitmap corruption resulting in panics and withdraws (Robert S Peterson) [711528 702057]
  - [x86] kprobes: Disable irqs during optimized callback (Jiri Olsa) [711545 699865]
  - [mm] slab, kmemleak: pass the correct pointer to kmemleak_erase() (Steve Best) [712414 698023]
  - [net] fix netns vs proto registration ordering (Wade Mealing) [702305 702306] {CVE-2011-1767 CVE-2011-1768}
  - [ppc] Fix oops if scan_dispatch_log is called too early (Steve Best) [711524 696777]
  - [virt] i8259: initialize isr_ack (Avi Kivity) [711520 670765]
  - [virt] VMX: Save and restore tr selector across mode switches (Gleb Natapov) [711535 693894]
  - [virt] VMX: update live TR selector if it changes in real mode (Gleb Natapov) [711535 693894]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.6.1.el6]
changelog:
  - [audit] ia32entry.S sign extend error codes when calling 64 bit code (Eric Paris) [713831 703935]
  - [audit] push audit success and retcode into arch ptrace.h (Eric Paris) [713831 703935]
  - [x86] intel-iommu: Flush unmaps at domain_exit (Alex Williamson) [713458 705441]
  - [x86] intel-iommu: Only unlink device domains from iommu (Alex Williamson) [713458 705441]
  - [virt] x86: Mask out unsupported CPUID features if running on xen (Igor Mammedov) [711546 703055]
  - [block] fix accounting bug on cross partition merges (Jerome Marchand) [682989 669363]
  - [net] vlan: remove multiqueue ability from vlan device (Neil Horman) [713494 703245]
  - [net] Fix netif_set_real_num_tx_queues (Neil Horman) [713492 702742]
  - [scsi] mpt2sas: move event handling of MPT2SAS_TURN_ON_FAULT_LED in process context (Tomas Henzl) [714190 701951]
  - [mm] thp: simple fix for /dev/zero THP mprotect bug (Andrea Arcangeli) [714762 690444]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.8.1.el6]
changelog:
  - [fs] GFS2: force a log flush when invalidating the rindex glock (Benjamin Marzinski) [717018 702263]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.9.1.el6]
changelog:
  - [scsi] cciss: Annotate cciss_kdump_soft_reset and cciss_sent_reset as __devinit (Tomas Henzl) [715397 698268]
  - [scsi] cciss: Don't wait forever for soft reset to complete, give up after awhile (Tomas Henzl) [715397 698268]
  - [scsi] cciss: use cmd_alloc not cmd_special_alloc for the kdump soft reset command (Tomas Henzl) [715397 698268]
  - [scsi] cciss: do not use bit 2 doorbell reset (Tomas Henzl) [715397 698268]
  - [scsi] cciss: do not attempt PCI power management reset method if we know it won't work (Tomas Henzl) [715397 698268]
  - [scsi] cciss: increase timeouts for post-reset no-ops (Tomas Henzl) [715397 698268]
  - [scsi] cciss: remove superfluous sleeps around reset code (Tomas Henzl) [715397 698268]
  - [scsi] cciss: do soft reset if hard reset is broken (Tomas Henzl) [715397 698268]
  - [scsi] cciss: clarify messages around reset behavior (Tomas Henzl) [715397 698268]
  - [scsi] cciss: increase time to wait for board reset to start (Tomas Henzl) [715397 698268]
  - [scsi] cciss: factor out irq_request code (Tomas Henzl) [715397 698268]
  - [scsi] cciss: factor out scatterlist allocation functions (Tomas Henzl) [715397 698268]
  - [scsi] cciss: factor out command pool allocation functions (Tomas Henzl) [715397 698268]
  - [scsi] cciss: use new doorbell-bit-5 reset method (Tomas Henzl) [715397 698268]
  - [scsi] cciss: wait longer for no-op to complete after resetting controller (Tomas Henzl) [715397 698268]
  - [scsi] cciss: do a better job of detecting controller reset failure (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: do not attempt PCI PM reset if we know it will not work (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: remove superfluous sleeps around reset code (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: do soft reset if hard reset is broken (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: clarify messages around reset behavior (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: factor out irq request code (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: factor out cmd_pool allocation functions (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: do not use bit 2 doorbell reset, it causes NMIs (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: wait longer for no-op to complete after resetting controller (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: use new doorbell-bit-5 reset method (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: adjust timing of post-reset sleeps (Tomas Henzl) [715397 698268]
  - [scsi] hpsa: do a better job of detecting controller reset failure (Tomas Henzl) [715397 698268]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.10.1.el6]
changelog:
  - [virt] ksm: fix race between ksmd and exiting task (Andrea Arcangeli) [710340 710341] {CVE-2011-2183}
  - [kernel] proc: signedness issue in next_pidmap() (Jerome Marchand) [697824 697825] {CVE-2011-1593}
  - [net] bluetooth: Prevent buffer overflow in l2cap config request (Jiri Pirko) [716809 716810] {CVE-2011-2497}
  - [fs] NLM: Don't hang forever on NLM unlock requests (Jeff Layton) [709548 709549] {CVE-2011-2491}
  - [fs] NFS: Fix NFSv3 exclusive open semantics (Jeff Layton) [719925 694210]
  - [fs] GFS2: Incorrect inode state during deallocation (Steven Whitehouse) [714982 712139]
  - [virt] KVM: Fix register corruption in pvclock_scale_delta (Avi Kivity) [719910 712102]
  - [netdrv] ehea: Fix memory hotplug oops (Steve Best) [720914 702036]
  - [net] Fix memory leak/corruption on VLAN GRO_DROP (Herbert Xu) [695175 695176] {CVE-2011-1576}
  - [md] Fix resync hang after surprise removal (James Paradis) [719928 707268]
  - GFS2: make sure fallocate bytes is a multiple of blksize (Benjamin Marzinski) [720863 695763] {CVE-2011-2689}
  - [kernel] Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code (Oleg Nesterov) [715521 690033] {CVE-2011-1182}
  - [redhat] config: enable parallel port printer support (Aristeu Rozanski) [713827 635968]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.11.1.el6]
changelog:
  - [mm] hold the page lock until after set_page_stable_node (Andrea Arcangeli) [726095 683658]
  - [netdrv] be2net: remove certain cmd failure logging (Ivan Vecera) [725329 719304]
  - [net] nl80211: missing check for valid SSID size in scan operation (Stanislaw Gruszka) [718157 718158] {CVE-2011-2517}
  - [net] bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace. (Thomas Graf) [703022 703023] {CVE-2011-2492}
  - [net] inet_diag: fix validation of user data in inet_diag_bc_audit() (Thomas Graf) [714540 714541] {CVE-2011-2213}
  - [fs] proc: restrict access to /proc/PID/io (Oleg Nesterov) [716829 716830] {CVE-2011-2495}
  - [fs] validate size of EFI GUID partition entries (Anton Arapov) [703029 703030] {CVE-2011-1776}
  - [fs] ext4: Fix max file size and logical block counting of extent format file (Lukas Czerner) [722568 722569] {CVE-2011-2695}
  - [virt] kvm: Disable device assignment without interrupt remapping (Alex Williamson) [716306 711504] {CVE-2011-1898}
  - [virt] iommu-api: Extension to check for interrupt remapping (Alex Williamson) [716306 711504] {CVE-2011-1898}
  - [netdrv] r8169: fix Rx checksum offloading bugs (Ivan Vecera) [723807 635596]
  - [netdrv] be2net: changes for BE3 native mode support (Ivan Vecera) [723820 695231]


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-93.el6_1.1
changelog:
  - Make xinetd trusted to write outbound packets regardless of the network's or node's MLS range
  - Make vhostd device MLS trusted
  - Allow secadm to manage selinux config files


author: Andreas Schwab <schwab@redhat.com> - 2010k-1
changelog:
  - Upadate to 2010k (#618600)
    - No DST in Egypt during Ramadan in 2010
    - Bahía de Banderas moved to UTC-6 on April 4, 2010, new time zone
      America/Bahia_Banderas
    - Rename Pacific/Truk to Pacific/Chuuk and Pacific/Ponape to Pacific/Pohnpei
    - Update historical data of Europe/Helsinki
    - Update tz-links page


author: Petr Machata <pmachata@redhat.com> - 2010l-1
changelog:
  - Upstream 2010l:
    - Change Cairo's 2010 reversion to DST from the midnight between
      September 8 and 9 to the midnight between September 9 and 10.
    - Change Gaza's 2010 return to standard time to the midnight between
      August 10 and 11.
    - Bahia de Banderas (Mexican state of Nayarit) changed time zone
      UTC-7 to new time zone UTC-6 on April 4, 2010
  - Resolves: #628645


author: Petr Machata <pmachata@redhat.com> - 2010o-1
changelog:
  - Upstream 2010m:
    - Hong Kong didn't observe DST in 1977
    - In zone.tab, remove obsolete association of Vostok Station with
      South Magnetic Pole; add association with Lake Vostok
  - Upstream 2010n:
    - Change end of DST in Samoa in 2011 from 2011-04-03 0:00 to
      2011-04-03 1:00
  - Upstream 2010o:
    - Fiji will end DST on March 6, 2011, not March 27, 2011
  - Resolves: #662781


author: Petr Machata <pmachata@redhat.com> - 2011b-1
changelog:
  - Upstream 2011a:
    - Updates of historical stamps for Hawaii
  - Upstream 2011b:
    - America/North_Dakota/Beulah: Mercer County, North Dakota, changed
      from the mountain time zone to the central time zone
  - Kemerovo oblast should use OMST/OMSST abbreviation (tzdata-2011b-kemerovo.patch)
  - Resolves: #596800
  - tzdata-2011b-c.patch
    - Update of historical stamps for Juneau, Sitka, and histcurrent
      stamps for Metlakatla.  Sitka and Metlakatla are new zones.
    - Delay end of DST in Chile in 2011 until first Sunday in April.
  - Resolves: #681907


author: Petr Machata <pmachata@redhat.com> - 2011d-1
changelog:
  - Upstream 2011d:
    - Change end of DST in Samoa in 2011.
    - Change start of DST in Cuba in 2011.
    - Move start of DST in Turkey by one day in 2011.
  - Dropped tzdata-2011b-c.patch
  - Resolves: #684213


author: Petr Machata <pmachata@redhat.com> - 2011d-3
changelog:
  - Morocco introduced DST for 2011 from April 2 to July 31. (tzdata-2011d-morocco.patch)
  - Resolves: #692031


author: Petr Machata <pmachata@redhat.com> - 2011g-1
changelog:
  - Upstream 2011e:
    - Morocco introduced DST for 2011 from April 2 to July 31.
    - Delay end of DST in Chile in 2011 until May 7.
  - Resolves: #694521
  - Upstream 2011f:
    - The Falkland Islands will not turn back clocks this winter, but
      stay on daylight saving time.
  - Upstream 2011g:
    - Egypt abandons DST in 2011 (and forward)
  - Resolves: #698613
  - Dropped tzdata-2011d-chile.patch
  - Dropped tzdata-2011d-morocco.patch


author: Petr Machata <pmachata@redhat.com> - 2011h-2
changelog:
  - Upstream 2011h:
    - Russia abandons DST in 2011.
    - *.tab: change AN (Netherlands Antilles) to CW (Curacao)
  - Resolves: #716936


author: Petr Machata <pmachata@redhat.com> - 2011h-3
changelog:
  - Patch for upcoming change in Newfoundland.  The transition time
    changes from 12:01 AM to 2:00 AM.
  - Resolves: #729693


author: Jeff Layton <jlayton@redhat.com> 4.7-2
changelog:
  - rebase to version 4.7 (bz 658981)
  - fix hardcoded paths in manpages (bz 658981)
  - set GSSAPI checksum in SPNEGO blobs (bz 645127)


author: Jeff Layton <jlayton@redhat.com> 4.7-4
changelog:
  - make cifs.upcall take the '-l' flag (bz 667382)
  - fix segfault in cifs.upcall when passing an invalid option (bz 667382)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-1
changelog:
  - core: allow S390 subchannels for connection locking (rh #591533)
  - core: don't request wifi scans when connection is BSSID-locked
  - core: handle MAC spoofing/cloning (rh #447827)
  - core: add domain part of hostname to resolv.conf search list (rh #600407)
  - core: protect various network functions via PolicyKit (rh #585182)


author: Dan Williams <dcbw@redhat.com> - 0.8.1-2
changelog:
  - core: fix crash getting IPv6 nameservers via D-Bus
  - core: fix possible crash updating VPN secrets (rh #587784)
  - cli: print IPv6 settings too
  - dhcp: look for interface-specific options in /etc/dhcp too (rh #607759)


author: Adam Tkac <atkac redhat com> 32:9.7.2-2.P3
changelog:
  - host utility now honors "attempts", "timeout" and "debug" options in
    resolv.conf (#622764)
  - initscript should kill only the "correct" named process (#622785)
  - attempt to reconnect to PostgreSQL during each query if the initial
    connection failed (#623190)


author: Adam Tkac <atkac redhat com> 32:9.7.2-3.P3
changelog:
  - use same atomic operations on both ppc and ppc64 (#623638)
  - add new option DISABLE_ZONE_CHECKING to sysconfig/named (#623673)
  - document dig exit codes
  - add Requires: bind-libs to bind subpkgs
  - remove statement about system-config-bind from named.8 manpage (#660676)


author: Adam Tkac <atkac redhat com> 32:9.7.2-4.P3
changelog:
  - solve conflict between i686 and x86_64 bind-devel packages (#658045)
  - fix "service named status" when used with named-sdb
  - fix "krb5-self" update-policy rule processing (#664401)
  - don't check MD5, size and mtime of sysconfig/named


author: Adam Tkac <atkac redhat com> 32:9.7.2-7.P3
changelog:
  - improve host/dig resolv.conf parser (#rh669163)
  - improve internal test suite
  - don't mention that HMAC-MD5 is the only one TSIG algorighm
    in nsupdate manpage
  - initscript: sybsys name is always named, not named-sdb


author: Adam Tkac <atkac redhat com> 32:9.7.3-1
changelog:
  - update to 9.7.3 (CVE-2011-0414)
  - patches merged
    - bind97-gsstsig.patch
    - bind97-rh664401.patch
    - bind97-rh623638.patch


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-26
changelog:
  - force NSS to ask for a new client certificate when connecting second time
    to the same host (#694294)


author: Nils Philippsen <nils@redhat.com> - 2:2.6.9-1
changelog:
  - version 2.6.9

    Overview of Changes from GIMP 2.6.8 to GIMP 2.6.9
    =================================================

    * Bugs fixed:

     612618 - Font selection remains visible
     622234 - gimp.desktop: image/x-psd in MimeTypes twice
     622196 - Unportable test(1) construct in configure script
     620604 - Description of "histogram" procedure is slightly inaccurate
     541586 - Tool options not saved/loaded correctly?
     614153 - Importing PDF files with long titles
     600112 - blur-gauss-selective.exe crashes
     599233 - Dialog of "Save as BMP" ignores changes which are not made
              with a mous
     565001 - Text-Tool crashes when edit a 2.4.2 version xcf
     610478 - Layer preview suddenly stops getting updated
     609026 - leaks shared memory
     609056 - Exporting to Alias PIX format fails
     608188 - a few strings in Save as... > Raw image data dialog are always
              in English
     604820 - GEGL Operation "path" crashes GIMP
     603711 - Crashes when using path tool
     607242 - GIMP 2.7.0 fails to build against libpng 1.4.0
     606372 - Saving to .ppm fails on indexed colorspace
     605237 - the "Antialiasing..." message in the progress bar does not show
              translated
     604508 - gimp-layer-new-from-visible should work from updated projection

    * Updated and new translations:

     Asturian (ast)
     Basque (eu)
     Burmese (my)
     Catalan (ca)
     Chinese (Hong Kong) (zh_HK)
     Chinese (Taiwan) (zh_HK)
     German (de)
     Italian (it)
     Latvian (lv)
     Low German (nds)
     Romanian (ro)
     Simplified Chinese (zh_CN)
     Slovenian (sl)
     Ukrainian (uk)
     Valencian (ca@valencia)

  - remove obsolete gtk219, never-stack-trace-desktop, indexed-pnm patches
  - don't manually provide "gimp-libs%{?_isa}" in gimp-libs
  - don't package %{_datadir}/gtk-doc/html, but dirs beneath


author: Tim Waugh <twaugh@redhat.com> - 4.0.3-10
changelog:
  - Removed old explicit provides for perl(Foomatic::GrovePath).
  - Fixed macro in changelog.
  - Avoid mixed spaces and tabs.
  - Ship COPYING files.
  - Added comments for sources.
  - Use Requires not PreReq (bug #225768).


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-1
changelog:
  - Updated to 4.0.4 (bug #570234).  No longer buildrequires
    ghostscript-devel (but requires ghostscript) or
    foomatic-filters-int-options patch.


author: Tim Waugh <twaugh@redhat.com> - 4.0.4-1:.1
changelog:
  - Applied patch to fix improper sanitization of command line options
    (CVE-2011-2697, bug #721001).


author: Marek Kasik <mkasik@redhat.com> 2.3.11-4
changelog:
  - Add freetype-2.3.11-CVE-2010-2498.patch
      (Assure that `end_point' is not larger than `glyph->num_points')
  - Add freetype-2.3.11-CVE-2010-2499.patch
      (Check the buffer size during gathering PFB fragments)
  - Add freetype-2.3.11-CVE-2010-2500.patch
      (Use smaller threshold values for `width' and `height')
  - Add freetype-2.3.11-CVE-2010-2519.patch
      (Check `rlen' the length of fragment declared in the POST fragment header)
  - Add freetype-2.3.11-CVE-2010-2520.patch
      (Fix bounds check)
  - Add freetype-2.3.11-CVE-2010-2527.patch
      (Use precision for `%s' where appropriate to avoid buffer overflows)
  - Add freetype-2.3.11-axis-name-overflow.patch
      (Avoid overflow when dealing with names of axes)
  - Resolves: #613298


author: Marek Kasik <mkasik@redhat.com> 2.3.11-5
changelog:
  - Add freetype-2.3.11-CVE-2010-1797.patch
      (Check stack after execution of operations too.
       Skip the evaluations of the values in decoder, if
       cff_decoder_parse_charstrings() returns any error.)
  - Resolves: #621624


author: Marek Kasik <mkasik@redhat.com> 2.3.11-6.el6_0.1
changelog:
  - Add freetype-2.3.11-CVE-2010-2805.patch
      (Fix comparison.)
  - Add freetype-2.3.11-CVE-2010-2806.patch
      (Protect against negative string_size. Fix comparison.)
  - Add freetype-2.3.11-CVE-2010-2808.patch
      (Check the total length of collected POST segments.)
  - Add freetype-2.3.11-CVE-2010-3311.patch
      (Don't seek behind end of stream.)
  - Resolves: #638838


author: Marek Kasik <mkasik@redhat.com> 2.3.11-6.el6_0.2
changelog:
  - Add freetype-2.3.11-CVE-2010-3855.patch
      (Protect against invalid `runcnt' values.)
  - Resolves: #651761


author: Marek Kasik <mkasik@redhat.com> 2.3.11-6.el6_1.3
changelog:
  - Add freetype-2.3.11-CVE-2011-0226.patch
      (Add better argument check for `callothersubr'.)
      - based on patches by Werner Lemberg,
        Alexei Podtelezhnikov and Matthias Drochner
  - Resolves: #723467


author: Deepak Bhole <dbhole@redhat.com> - 1.0-5
changelog:
  - Minor comment/group/etc. updates from omajid@redhat.com
  - Added base package requirement for javadoc subpackage


author: Deepak Bhole <dbhole@redhat.com> - 1.0.1-1
changelog:
  - Bumped to 1.0.1
  - Removed icedtea-web-pkg-access.patch (now upstream)
  - Resolves CVE-2011-0706 and CVE-2010-4450


author: Deepak Bhole <dbhole@redhat.com> - 1.0.1-3
changelog:
  - Resolves rhbz#645781 (desktop sharing now works)
  - Updated the classloader sharing patch to fix loader sharing rules
  - Added version and release string in plugin display


author: Deepak Bhole <dbhole@redhat.com> 1.0.2-1
changelog:
  - Resolves rhbz#693601 
  - Update to IcedTea-Web 1.0.2
  - Dropped patch0 (instance validity check). Now part of 1.0.2
  - Also resolves #682674 by adding a javaws Provides


author: Jiri Vanek <jvanek@redhat.com> - 1.6.0.0-1.31.b17
changelog:
  - excluded bin/javaws files
  		exclude  /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/bin/javaws
  		files devel
  		exclude  /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/bin/javaws

  - garbage removed to separated file
  - Resolves: rhbz#639954


author: Deepak Bhole <dbhole@redhat.com> - 1.6.0.0-1.33.1.b20
changelog:
  - Bump to IcedTea 1.9.3
  - Build with --disable-webstart and remove all javaws and plugin references
  - Moved pre 2009 changelog entries to a separate file to keep spec file small
  - Resolves: rhbz#658208


author: Deepak Bhole <dbhole@redhat.com> - 1.6.0.0-1.39.1.9.8
changelog:
  - Resolves: rhbz#709375
  - Bumped to IcedTea6 1.9.8
  - Copy fontconfig files to match names for current and next release
  - RH706250, S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent
    disabled get still selected for read ops (win)
  - RH706106, S6618658, CVE-2011-0865: Vulnerability in deserialization
  - RH706111, S7012520, CVE-2011-0815: Heap overflow vulnerability in 
    FileDialog.show()
  - RH706139, S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D 
    code
  - RH706153, S7013969, CVE-2011-0867: NetworkInterface.toString can reveal 
    bindings
  - RH706234, S7013971, CVE-2011-0869: Vulnerability in SAAJ
  - RH706239, S7016340, CVE-2011-0870: Vulnerability in SAAJ
  - RH706241, S7016495, CVE-2011-0868: Crash in Java 2D transforming an image 
    with scale close to zero
  - RH706248, S7020198, CVE-2011-0871: ImageIcon creates Component with null acc
  - RH706245, S7020373, CVE-2011-0864: JSR rewriting can overflow memory address
    size variables


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-131.0.8.el6]
changelog:
  - [scsi] mark bfa fc adapters tech preview (Rob Evers) [698384]
  - [virt] Revert pdpte registers are not flushed when PGD entry is changed in x86 PAE mode (Aristeu Rozanski) [691310]
  - [i686] nmi watchdog: Enable panic on hardlockup (Don Zickus) [677532]
  - [netdrv] Adding Chelsio Firmware for cxgb4 (Neil Horman) [691929]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-131.0.9.el6]
changelog:
  - [net] limit socket backlog add operation to prevent possible DoS (Jiri Pirko) [694396] {CVE-2010-4251}
  - [scsi] mpt2sas: prevent heap overflows and unchecked (Tomas Henzl) [694023] {CVE-2011-1494 CVE-2011-1495}
  - [fs] epoll: prevent creating circular epoll structures (Don Howard) [681683] {CVE-2011-1082}
  - [mm] Prevent page_fault at do_mm_track_pte+0xc when Stratus dirty page tracking is active (Larry Woodman) [693786]
  - [fs] GFS2 causes kernel panic in spectator mode (Steven Whitehouse) [696535]
  - [net] bonding: interface doesn't issue IGMP report on slave interface during failover (Flavio Leitner) [640690]
  - [scsi] isci: validate oem parameters early, and fallback (David Milburn) [698016]
  - [scsi] isci: fix oem parameter header definition (David Milburn) [698016]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-131.0.10.el6]
changelog:
  - [netdrv] cnic: fix hang due to rtnl_lock (Mike Christie) [694874]
  - [netdrv] firmware: re-add the recently deleted bnx2x fw 6.2.5.0 (Michal Schmidt) [690470]
  - [netdrv] firmware/bnx2x: add 6.2.9.0 fw, remove unused fw (Michal Schmidt) [690470]
  - [netdrv] bnx2x, cnic: Disable iSCSI if DCBX negotiation is successful (Michal Schmidt) [690470]
  - [netdrv] bnx2x: don't write dcb/llfc fields in STORM memory (Michal Schmidt) [690470]
  - [netdrv] bnx2x: Update firmware to 6.2.9 (Michal Schmidt) [690470]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-131.0.12.el6]
changelog:
  - [scsi] beiscsi: update version (Mike Christie) [674340]
  - [scsi] be2iscsi: fix chip cleanup (Mike Christie) [674340]
  - [scsi] be2iscsi: fix boot hang due to interrupts not getting rearmed (Mike Christie) [674340]
  - [scsi] bnx2fc: fix regression due to incorrect setup of em for npiv port (Mike Christie) [700672]
  - [ppc] pseries: Use a kmem cache for DTL buffers (Steve Best) [695678]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-131.0.13.el6]
changelog:
  - [scsi] hpsa: fix lost command problem (Tomas Henzl) [700430]
  - [scsi] cciss: fix lost command problem (Tomas Henzl) [700430]
  - [scsi] ibft: fix oops during boot (Mike Christie) [698737]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-131.0.14.el6]
changelog:
  - [scsi] hpsa: fix reading a write only register causes a hang (Rob Evers) [703262]
  - [scsi] mpt2sas: remove the use of writeq, since writeq is not atomic (Tomas Henzl) [701947]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.1.1.el6]
changelog:
  - [net] dccp: handle invalid feature options length (Jiri Pirko) [703012 703013] {CVE-2011-1770}
  - [fs] cifs: check for private_data before trying to put it (Jeff Layton) [703017 702642] {CVE-2011-1771}
  - [net] can: add missing socket check in can/raw and can/bcm release (Jiri Pirko) [698482 698483] {CVE-2011-1748 CVE-2011-1598}
  - [netdrv] ixgbe: do not clear FCoE DDP error status for received ABTS (Andy Gospodarek) [704011 695966]
  - [netdrv] ixgbe: DCB remove ixgbe_fcoe_getapp routine (Andy Gospodarek) [704002 694358]
  - [fs] setup_arg_pages: diagnose excessive argument size (Oleg Nesterov) [645228 645229] {CVE-2010-3858}
  - [scsi] bfa: change tech-preview to cover all cases (Rob Evers) [704014 703251]
  - [scsi] bfa: driver version update (Rob Evers) [704282 703265]
  - [scsi] bfa: kdump fix (Rob Evers) [704282 703265]
  - [scsi] bfa: firmware download fix (Rob Evers) [704282 703265]
  - [netdrv] bna: fix memory leak during RX path cleanup (Ivan Vecera) [704000 698625]
  - [netdrv] bna: fix for clean fw re-initialization (Ivan Vecera) [704000 698625]
  - [scsi] ipr: improve interrupt service routine performance (Steve Best) [704009 696754]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-131.2.1.el6]
changelog:
  - [kernel] lib/vsprintf.c: add %pU to print UUID/GUIDs (Frantisek Hrbata) [704280 700299]
  - [scsi] megaraid_sas: Driver only report tape drive, JBOD and logic drives (Tomas Henzl) [704601 619422]


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-4
changelog:
  - move the package changelog to the end to match the usual style (jdennis)
  - scrub out references to $RPM_SOURCE_DIR (jdennis)
  - include a symlink to the readme with the name LICENSE so that people can
    find it more easily (jdennis)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-6
changelog:
  - fix a null pointer dereference and crash introduced in our PAM patch that
    would happen if ftpd was given the name of a user who wasn't known to the
    local system, limited to being triggerable by gssapi-authenticated clients by
    the default xinetd config (Olivier Fourdan, #569472)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.8-1
changelog:
  - update to 1.8
    - temporarily bundling the krb5-appl package (split upstream as of 1.8)
      until its package review is complete
    - profile.d scriptlets are now only needed by -workstation-clients
    - adjust paths in init scripts
    - drop upstreamed fix for KDC denial of service (CVE-2010-0283)
    - drop patch to check the user's password correctly using crypt(), which
      isn't a code path we hit when we're using PAM


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0-1
changelog:
  - build a split-out krb5-appl package by pruning out all of the non-appl
    parts and resetting the versioning to match the upstream version for the
    newly-split package


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0-3
changelog:
  - when checking for pty-handling functions, do so with the benefit of the
    libutil library we think might include them (#595411)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2
changelog:
  - krshd: don't limit user names to 16 chars when utmp can handle names
    at least a bit longer than that (#632442, RT#6773)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2.1
changelog:
  - ftpd: add candidate patch to detect setegid/setregid/setresgid and check
    for errors when calling them (MITKRB5-SA-2011-005, CVE-2011-1526, #713341)


author: Ray Strode <rstrode@redhat.com> - 1:1.2.16-9
changelog:
  Resolves: #547808
  - Fix activation of daemons (#545267)
  - Fix reload memleak (fdo #24697)
  - Don't forget about pending activations on reload (fdo #24350)
  - Fix reload race (fdo #21597)


author: Colin Walters <walters@verbum.org> - 1:1.2.24-5
changelog:
  - Merge changes from RHEL-6 branch:
    * Drop default patch fuzz
    * Merge CVE-2010-4352.patch from RHEL-6_0-Z
  - Apply patches for CVE-2011-2200
  - Resolves: #725313


author: Urs Beyerle <urs.beyerle@env.ethz.ch> - 3.11.4-6.1.sl6
changelog:
  - Update to 3.11.4 (source from fc15)
  - Link to SL61 LiveCDs
  - Change download link from ftp to http


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-13.P1
changelog:
  - Add LICENSE file to dhclient subpackage (#613683)
  - Add DHCRELAYARGS variable to /etc/sysconfig/dhcrelay (#625846)
  - dhclient logs its pid to make troubleshooting systems
    with multiple dhclients running easier (#627257)
  - Fix parsing of date (#631071)
  - dhclient-script: when updating 'search' statement in resolv.conf,
    add domain part of hostname if it's not already there (#637763)
  - Fix for CVE-2010-3611 (#651914)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-16.P1
changelog:
  - Unexpected abort caused by a DHCPv6 decline message (CVE-2011-0413, #672995)
  - Write/accept a semi-colon at the end of the max-life and preferred-life
    clauses in dhcpv6 lease files (#672551)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-19.P1.1
changelog:
  - A pair of defects cause the server to halt upon processing certain packets
    (CVE-2011-2748, CVE-2011-2749, #729883)


author: Brian C. Lane <bcl@redhat.com> - 13.0-1
changelog:
  - Change version for f13-branch (bcl)
  - Misc. fixups (#652522) (fgrose)
  - Set indentation to 4 spaces (#652522) (fgrose)
  - Add a release target (bcl)
  - Pass dracut args during check (#589778) (bcl)
  - Cleanup EOL spaces (#652522) (fgrose)
  - Typo. Need space before ]. (bruno)
  - Add support for timeout and totaltimeout to livecd-iso-to-disk (#531566)
    (bcl)


author: Brian C. Lane <bcl@redhat.com> - 13.1-1
changelog:
  - Version 13.1 (bcl)
  - Trap copyFile errors (#663849) (fgrose)
  - Create tmpdir if it doesn't exist (#658632) (bcl)
  - Fix partition number selection for MMC bus devices (#587411) (fgrose)
  - Tolerate empty transactions (lkundrak)


author: Brian C. Lane <bcl@redhat.com> - 13.2-1
changelog:
  - Version 13.2 (bcl)
  - Print reason for sudden exit (bcl)
  - Fix skipcopy usage with DVD iso (#644194) (bmj001)
  - Move selinux relabel to after %post (#648591) (bcl)
  - Add support for virtio disks to livecd (#672936) (bcl)
  - Check return value on udevadm (#637258) (bcl)
  - Source may be a file or a block device, mount accordingly (bcl)
  - Align start of partition at 1MiB (#668967) (bcl)
  - Check for one big initrd.img (#671900) (bcl)
  - Update documentation for xz availability. (bruno)
  - Change releasever to a command line option (#667474) (bcl)
  - Assign a device-mapper UUID w/ subsystem prefix to the dm snapshot. (dlehman)
  - Fix git URLs to match reality. (dlehman)


author: Adam Jackson <ajax@redhat.com> 1.3.3-1
changelog:
  - libXfont 1.3.3.
  - libXfont-1.3.1-fast-retry.patch: Retry font server connections faster.
    (#443070)


author: Tom Lane <tgl@redhat.com> 2:1.2.46-1
changelog:
  - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,
    CVE-2011-2691, CVE-2011-2692
  Resolves: #721305


author: Andreas Thienemann <andreas@bawue.net> - 1.0.17-6
changelog:
  - Removed spurious #endif in the libsndfile.h wrapper. Thx to Edward
    Sheldrake for finding it. Fixes #468508.
  - Fix build for autoconf-2.63


author: Ville Skyttä <ville.skytta@iki.fi> - 1.6.6-5
changelog:
  - Include svn2cl and its man page only in the -svn2cl subpackage (#558598).
  - Do not include bash completion in docs, it's installed.


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.19-4
changelog:
  - use PATH_MAX for buffers passed to realpath (#492861)
  - unconditionally inode-sort Maildir and MH folders
  - restore connection polling callback when closing SASL connection


author: Miroslav Lichvar <mlichvar@redhat.com> 5:1.5.19-5
changelog:
  - fix certificate verification (CVE-2009-1390)
  - add support for gnutls INSECURE_ALGORITHM error code (#499390)


author: Miroslav Lichvar <mlichvar@redhat.com> 2:2.6.6-1
changelog:
  - update to 2.6.6 (#588781)
  - move sasl config to /etc/sasl2 (#574439)
  - drop sasl v1 support
  - require Date::Calc for pflogsumm (#588726)


author: Luiz Capitulino <lcapitulino@redhat.com> - qemu-kvm-0.12.1.2-2.153.el6
changelog:
  - kvm-Revert-spice-qxl-locking-fix-for-qemu-kvm.patch [bz#678208]
  - kvm-qxl-spice-display-move-pipe-to-ssd.patch [bz#678208]
  - kvm-qxl-implement-get_command-in-vga-mode-without-locks.patch [bz#678208]
  - kvm-qxl-spice-remove-qemu_mutex_-un-lock_iothread-around.patch [bz#678208]
  - kvm-hw-qxl-render-drop-cursor-locks-replace-with-pipe.patch [bz#678208]
  - kvm-spice-qemu-char.c-add-throttling.patch [bz#672191]
  - kvm-spice-qemu-char.c-remove-intermediate-buffer.patch [bz#672191]
  - kvm-spice-qemu-char-Fix-flow-control-in-client-guest-dir.patch [bz#672191]
  - kvm-chardev-Allow-frontends-to-notify-backends-of-guest-.patch [bz#688572]
  - kvm-virtio-console-notify-backend-of-guest-open-close.patch [bz#688572]
  - kvm-spice-chardev-listen-to-frontend-guest-open-close.patch [bz#688572]
  - kvm-Fix-performance-regression-in-qemu_get_ram_ptr.patch [bz#690267]
  - kvm-virtio-pci-fix-bus-master-work-around-on-load.patch [bz#682243]
  - kvm-Use-getaddrinfo-for-migration.patch [bz#680356]
  - kvm-net-socket-allow-ipv6-for-net_socket_listen_init-and.patch [bz#680356]
  - kvm-block-Fix-serial-number-assignment.patch [bz#688058]
  - Resolves: bz#672191
    (spicevmc: flow control on the spice agent channel is missing in both directions)
  - Resolves: bz#678208
    (qemu-kvm hangs when installing guest with -spice option)
  - Resolves: bz#680356
    (Live migration failed in ipv6 environment)
  - Resolves: bz#682243
    ([KVM] pci hotplug after migration breaks virtio_net.)
  - Resolves: bz#688058
    (Drive serial number gets truncated)
  - Resolves: bz#688572
    (spice-server does not switch back to server mouse mode if guest spice-agent dies.)
  - Resolves: bz#690267
    (Backport qemu_get_ram_ptr() performance improvement)
  - Related: bz#672191
    (spicevmc: flow control on the spice agent channel is missing in both directions)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.154.el6
changelog:
  - kvm-add-a-service-to-reap-zombies-use-it-in-SLIRP.patch [bz#678524]
  - kvm-Don-t-allow-multiwrites-against-a-block-device-witho.patch [bz#654682]
  - kvm-Do-not-delete-BlockDriverState-when-deleting-the-dri.patch [bz#654682]
  - kvm-virtio-serial-don-t-crash-on-invalid-input.patch [bz#690174]
  - Resolves: bz#678524
    (Exec based migration randomly fails, particularly under high load)
  - Resolves: bz#690174
    (virtio-serial qemu-kvm crash on invalid input in migration)
  - Resolves: bz#654682
    (drive_del command to let libvirt safely remove block device from guest)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.155.el6
changelog:
  - kvm-configure-fix-out-of-tree-build-with-enable-spice.patch [bz#641833]
  - kvm-ccid-card-emulated-replace-DEFINE_PROP_ENUM-with-DEF.patch [bz#641833]
  - kvm-Revert-qdev-properties-add-PROP_TYPE_ENUM.patch [bz#641833]
  - kvm-Revert-qdev-add-data-pointer-to-Property.patch [bz#641833]
  - kvm-Revert-qdev-add-print_options-callback.patch [bz#641833]
  - kvm-ccid-v18_upstream-v25-cleanup.patch [bz#641833]
  - kvm-libcacard-vscard_common.h-upstream-v18-v25-diff.patch [bz#641833]
  - kvm-ccid-card-passthru-upstream-v18-upstream-v25-diff.patch [bz#641833]
  - kvm-qemu-thread-add-qemu_mutex-cond_destroy-and-qemu_mut.patch [bz#641833]
  - kvm-adding-qemu-thread.o-to-obj-y.patch [bz#641833]
  - kvm-ccid-card-emulated-v18-v25.patch [bz#641833]
  - kvm-libcacard-v18-upstream-v25.patch [bz#641833]
  - Resolves: bz#641833
    (Spice CAC support - qemu)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.156.el6
changelog:
  - kvm-Revert-net-socket-allow-ipv6-for-net_socket_listen_i.patch [bz#680356]
  - kvm-Revert-Use-getaddrinfo-for-migration.patch [bz#680356]
  - Related: bz#680356
    (Live migration failed in ipv6 environment)
  - Fixes bz#694196
    (RHEL 6.1 qemu-kvm: Specifying ipv6 addresses breaks migration)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.157.el6
changelog:
  - kvm-qemu-img-rebase-Fix-read-only-new-backing-file.patch [bz#693741]
  - kvm-floppy-save-and-restore-DIR-register.patch [bz#681777]
  - kvm-block-Do-not-cache-device-size-for-removable-media.patch [bz#687900]
  - kvm-cdrom-Allow-the-TEST_UNIT_READY-command-after-a-cdro.patch [bz#683877]
  - kvm-cdrom-Make-disc-change-event-visible-to-guests.patch [bz#683877]
  - Resolves: bz#681777
    (floppy I/O error after live migration while floppy in use)
  - Resolves: bz#683877
    (RHEL6 guests fail to update cdrom block size on media change)
  - Resolves: bz#687900
    (qemu host cdrom support not properly updating guests on media changes at physical CD/DVD drives)
  - Resolves: bz#693741
    (qemu-img re-base  fail with read-only new backing file)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.158.el6
changelog:
  - kvm-bz-691704-vhost-skip-VGA-memory-regions.patch [bz#691704]
  - kvm-ide-atapi-add-support-for-GET-EVENT-STATUS-NOTIFICAT.patch [bz#558256]
  - kvm-atapi-Allow-GET_EVENT_STATUS_NOTIFICATION-after-medi.patch [bz#558256]
  - kvm-atapi-Move-GET_EVENT_STATUS_NOTIFICATION-command-han.patch [bz#558256]
  - kvm-atapi-GESN-Use-structs-for-commonly-used-field-types.patch [bz#558256]
  - kvm-atapi-GESN-Standardise-event-response-handling-for-f.patch [bz#558256]
  - kvm-atapi-GESN-implement-media-subcommand.patch [bz#558256]
  - Resolves: bz#558256
    (rhel6 disk not detected first time in install)
  - Resolves: bz#691704
    (Failed to boot up windows guest with huge memory and cpu and vhost=on within 30 mins)


author: Luiz Capitulino <lcapitulino@redhat.com> - qemu-kvm-0.12.1.2-2.159.el6
changelog:
  - kvm-acpi_piix4-Maintain-RHEL6.0-migration.patch [bz#694095]
  - Resolves: bz#694095
    (Migration fails when migrate guest from RHEL6.1 host to RHEL6 host with the same libvirt version)


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.160.el6
changelog:
  - kvm-virtio-blk-fail-unaligned-requests.patch [bz#698910]
  - kvm-Ignore-pci-unplug-requests-for-unpluggable-devices.patch [bz#699789]
  - Resolves: bz#698910
    (CVE-2011-1750 virtio-blk: heap buffer overflow caused by unaligned requests [rhel-6.1])
  - Resolves: bz#699789
    (CVE-2011-1751 acpi_piix4: missing hotplug check during device removal [rhel-6.1])


author: Luiz Capitulino <lcapitulino@redhat.com> - qemu-kvm-0.12.1.2-2.160.el6_1
changelog:
  - kvm-Fix-phys-memory-client-pass-guest-physical-address-n.patch [bz#701771]
  - kvm-virtio-prevent-indirect-descriptor-buffer-overflow.patch [bz#713592]
  - Resolves: bz#701771
    (Fix phys memory client for vhost)
  - Resolves: bz#713592
    (EMBARGOED CVE-2011-2212 virtqueue: too-large indirect descriptor buffer overflow [rhel-6.1.z])


author: Eduardo Habkost <ehabkost@redhat.com> - qemu-kvm-0.12.1.2-2.160.el6_1.2
changelog:
  - kvm-virtio-guard-against-negative-vq-notifies.patch [bz#717403]
  - Resolves: bz#717403
    (qemu-kvm: OOB memory access caused by negative vq notifies [rhel-6.1.z])


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.2
changelog:
  - Integrate addition of patch101 by Mohammed Morsi.  This fixes
    the segv-inducing marshaling bug affecting rails-3.0.0.
  - Integrate Mamoru Tasaka's path-fixing feedback, including
    updates to ruby-1.8.7-lib-paths.patch


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-0.3
changelog:
  - split some long lines; as in Mamoru Tasaka's 1.8.7.x spec file
  - don't require emacs; remove vestiges of emacs


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-1
changelog:
  - Resolves: rhbz#602435
  - (sitelib2): remove unused definition
  - correct search path, using changes from Mohammed Morsi's
    http://mo.morsi.org/files/ruby-1.8.7.249-5.fc13.src.rpm


author: Jim Meyering <meyering@redhat.com> - 1.8.7.249-2
changelog:
  - Rebase to ruby-1.8.7.299
    * remove patch30, aka ruby-1.8.7-openssl-1.0.patch; subsumed
    * remove patch101, aka ruby-1.8.7-rb_gc_guard_ptr-optimization.patch; subsumed


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-4
changelog:
  - Address CVE-2010-0541 "Ruby WEBrick javascript injection flaw"
    by applying the patch from Apple as included in
    http://bugzilla.redhat.com/587731.
    * ruby-1.8.7-webrick-CVE.patch: New file.
  - Resolves: rhbz#605418


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-5
changelog:
  - avoid a false-positive readline-related test failure
    * ruby-readline-TERM-dumb.patch: New file.
    * Run "make test-all" in addition to "make test", in spite of its known
    failures (e.g., when using out of date gdbm).  Suggested by Ondrej Moris.
  - skip minor gdbm test to avoid failure
    * ruby-skip-gdbm-test.patch: New file.
  - avoid segfault on powerpc64
    * ruby-ppc64-segv-fix.patch: New file.
  - Resolves: rhbz#628715


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-6
changelog:
  - Now that ruby uses the two-clause BSDL, it may once again use the
  latest readline, which is covered by the LGPLv3.  2-clause BSDL is
  GPLv3-compatible, per http://www.gnu.org/philosophy/license-list.html
  Before, ruby used the GPLv2, which precluded use of readline6, so it
  had to resort to using the old readline5 library.
  Remove references to the old readline5 library.
  - Resolves: rhbz#631701


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.299-7.1
changelog:
  - Address CVE-2011-1004 "Symlink race condition by removing directory trees in
    fileutils module"
    * ruby-1.8.7-CVE-2011-1004.patch
  - Address CVE-2011-1005 "Untrusted codes able to modify arbitrary strings"
    * ruby-1.8.7-CVE-2011-1005.patch
  - Address CVE-2011-0188 "memory corruption in BigDecimal on 64bit platforms"
    * ruby-1.8.7-CVE-2011-0188.patch
  - Resolves: rhbz#709963


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-87
changelog:
  - Allow $1_sudo_t to read default SELinux context
  - Allow tgtd to create a sock file
  - Allow initrc_t to manage faillock


author: Thomas Woerner <twoerner@redhat.com> 1.2.24-1
changelog:
  - DBUS-mechanism: report errors to syslog and print traceback (rhbz#563354)
  - fixed minor misspellings (rhbz#566468)
  - msgmerged po files
  - added missing default values for ip*tables-config content (rhbz#566869)
  - autofoo utils update
  - fixed max length of user defined interface name in interfaceDialog
  - added missing range check to port_entry_changed_cb
  - fixed sensitiveness of protocol label in portDialog
  - fixed misuse of MARK extension in nat table, now in mangle table
  - port forwarding dialog usability fixes (rhbz#507638)
  - use new fw_functions.checkInterface function in tui and gui
  - new function to check interface names in fw_functions
  - use new checkInterface function in parser for trust, masq and forward-port
  - add wlan standard device
  - fixed build (fw_nm.py not packaged)
  - updated translations: bn_IN, cs, da, de, el, en_GB, es, fi, fr, hu, is, it,
                          ja, nb, nl, or, pl, pt, pt_BR, ru, sr, sr@latin, sv,
                          te, uk


author: Thomas Woerner <twoerner@redhat.com> 1.2.25-1
changelog:
  - fixed lokkit: do not create or alter firewall in selinux only mode
    (rhbz#583986)
  - use new icons (rhbz#583715)
  - fixed treeviewtooltips to not show the tooltip if an overlapping window has
    the focus
  - updated translations: bn_IN, de, es, gu, it, kn, ml, mr, nl, or, pa, pl, pt,
                          pt_BR, ru, sk, sr, sr@latin, te


author: Thomas Woerner <twoerner@redhat.com> 1.2.26-1
changelog:
  - added libvirt services (rhbz#565625)
  - added Bakula service (rhbz#588377)
  - fixed DBUS mechanism to report complete syslog message (rhbz#604623)
  - fixed crash because of missing /etc/services file (rhbz#604726)
  - updated translations: ar, as, bn_IN, da, de, es, fi, fr, gu, he, hi, is, it,
                          ja, kn, ko, ml, mr, nl, or, pa, pl, pt, ru, ta, te, 
                          zh_CN


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-1
changelog:
  - updated translations: bn_IN, de, fi, fr, gu, hi, it, ja, kn, ko, ml, mr, or,
                          pt_BR, ru, ta, te, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-3.3
changelog:
  - fixed possible privilege escalation flaw via use of python pickle
    (CVE-2011-2520), replaced pickle by json (rhbz#717985)
  - stop D-BUS firewall mechanism on update


author: Jiri Popelka <jpopelka@redhat.com> 1.1.16-9
changelog:
  - Fixed pycups to be more cautious when removing
    the Connection object from the list (bug #571451).
  - No longer requires usermode (bug #572138).
  - Fixed jobviewer traceback when closing
    not yes shown notification (bug #572142).
  - Treat hpcups-requiring-plugin as 3rd party proprietary (bug #572143).


author: Jiri Popelka <jpopelka@redhat.com> 1.1.16-10
changelog:
  - Import modules we catch exceptions from (bug #574131).
  - Fixed reconnection error handling in IPPAuthOperation class (bug #575798).
  - Initialize downloadable_drivers when OpenPrinting query fails (bug #575916).
  - Fixed race condition in asyncipp (bug #576934).
  - Fixed possible traceback in the SMB handling part of probe_printer.py (bug #579864).


author: Jiri Popelka <jpopelka@redhat.com> 1.1.16-12
changelog:
  - Fixed localized state reasons (bug #587719).
  - Always use close_fds=True in subprocess.Popen calls (bug #590065).
  - cups-pk-helper support: FileGet requires a file it can write to (bug #592343).
  - Initialise auto_make to the empty string (bug #592346).


author: Adam Tkac <atkac redhat com> 1.0.90-0.7.20100115svn3945
changelog:
  - make libvnc.so module working again (r4005, r4024, r4025)
  - vncviewer could crash on slow links (r4003, r4004)


author: Adam Tkac <atkac redhat com> 1.0.90-0.8.20100115svn3945
changelog:
  - fix memory leak in Xvnc (#603731)
  - update URL about SSH tunneling in the sysconfig file (#601996)
  - add pam-devel to BuildRequires, X server needs it


author: Adam Tkac <atkac redhat com> 1.0.90-0.11.20110117svn4237
changelog:
  - rebase to r4237
  - patches merged
    - tigervnc11-noexecstack.patch
    - tigervnc11-r3963.patch
    - tigervnc11-r4002.patch
    - tigervnc11-r4014.patch
    - tigervnc11-r4003.patch
    - tigervnc11-r4004.patch
    - tigervnc11-r4005.patch
    - tigervnc11-r4024.patch
    - tigervnc11-r4025.patch
    - tigervnc11-rh603731.patch
    - tigervnc11-options.patch
  - build with TLS support


author: Adam Tkac <atkac redhat com> 1.0.90-0.12.20110117svn4237
changelog:
  - tigervnc-server now requires perl (#634161)
  - use locales specified in sysconfig/i18n (#632530)
  - read password file correctly when fread is interrupted (#645755)


author: Adam Tkac <atkac redhat com> 1.0.90-0.15.20110314svn4359
changelog:
  - flush internal Xvnc event queue early to avoid overflowing
  - improve compatibility with viewers with wrong VeNCrypt implementation
    (vinagre)
  - link libvnc.so with "-z now" to catch all undefined symbols
  - fix undefined symbol "getvnchomedir" in libvnc.so


author: Petr Machata <pmachata@redhat.com> - 2010i-1
changelog:
  - Upstream 2010i:
    - Morocco will have DST from 2010-05-02 to 2010-08-08
    - San Luis, Argentina will keep permanent DST after April 11, 2010
    - Updates of historical stamps for Taiwan
  - Resolves: #585134 (Morocco starts DST on May 2, 2010)


