# changelog

author: Tom Lane <tgl@redhat.com> 5.1.66-1
changelog:
  - Update to 5.1.66, for assorted upstream bugfixes including
    CVEs announced in July and October 2012
  Resolves: #871814


author: Tom Lane <tgl@redhat.com> 5.1.67-1
changelog:
  - Update to 5.1.67, for assorted upstream bugfixes including
    CVEs announced in January 2013
  Resolves: #901381


author: Tom Lane <tgl@redhat.com> 5.1.69-1
changelog:
  - Update to 5.1.69, for assorted upstream bugfixes including
    CVEs announced in April 2013
  Resolves: #953085


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #990796, #842052
  - Fix mysqldump failure against MySQL 5.0.x server due missing tables
    Resolves: #877557
  - Add logrotate script
    Resolves: #904061
  - Fix init script to not show failed on start even when server started
    Resolves: #884651


author: Honza Horak <hhorak@redhat.com> 5.1.71-1
changelog:
  - Update to MySQL 5.1.71, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-71.html
    Resolves: #990796


author: Jakub Dorňák <jdornak@redhat.com> - 5.1.73-1
changelog:
  - Update to MySQL 5.1.73, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-73.html
    (CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2014-0393,
    CVE-2014-0386, CVE-2014-0401, CVE-2014-0402)
    Resolves: #1055880


author: Honza Horak <hhorak@redhat.com> 5.1.73-2
changelog:
  - Make mysqld init script more robust and ignore existing but
    non-being-used unix socket file
    Resolves: #1058719


author: David Howells <dhowells@redhat.com> - 1.3-1
changelog:
  - Fix compiler warnings in request-key.
  - Expose the kernel function to get a key's security context.
  - Expose the kernel function to set a processes keyring onto its parent.
  - Move libkeyutils library version to 1.3.


author: David Howells <dhowells@redhat.com> - 1.4-5
changelog:
  - Make keyctl show handle deeply nested keyrings [BZ 1075652].
  - The key serial ID field displayed by keyctl show may be up to 10 digits [BZ 1075652].
  - Make keyctl padd & co. handle binary data containing NUL chars [BZ 1075652].
  - The input buffer for keyctl padd & co. should be 1MB-1 in size [BZ 1075652].


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-9
changelog:
  - make alternatives names arch dependant for multilib (rhbz#860148)
  - added virtual provides for base libraries to be able to resolve library file requires


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-10
changelog:
  - New reload action for ip*tables services (rhbz#928812)
    It tries to reload the firewall rules from /etc/sysconfig/ip*tables. If this
    failes, it does not load the fallbacks and the old firewall rules are still
    there.
  - Use /lib*/xtables without version and not linked by alternatives again for 
    compatibility to older versions (rhbz#924362)
    The symlink for /lib*/xtables with the previous version will be cleaned up
    in a pre script.
  - Backport of --queue-bypass (rhbz#845435)
    Thanks to Florian Westphal and kay
  - Make ip*tables-save consistent to man page (rhbz#983198)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-11
changelog:
  - fixed shutdown hang if root filesystem is network based (rhbz#1007632)
    Thanks to Rodrigo A B Freire for the patch


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-12
changelog:
  - added ip6t_set (rhbz#1033270)
  - do not block uninstall on a failing alternatives --remove call in preun
    (rhbz#1059214) (rhbz#1070123)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-15
changelog:
  - Add message for init script error returns (rhbz#1081191)
  - Fix rule deletion of ipset matches (rhbz#1081422)
  - Add space after dccp types (rhbz#1084974)
  - Add -C option to check for existing rules (rhbz#1088361)
  - Copy custom plugins for updates from iptables < 1.4.7-10 (rhbz#1088400)
  - Enable the IPv6 set target (rhbz#1161330)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-16
changelog:
  - Fixed ressource leak in libiptc found by coverity (rhbz#1088361)
  - Copy custom plugins also for releases up to 14 (rhbz#1088400)


author: ClearFoundation <developer@clearfoundation.com> 1.4.7-16.clear
changelog:
  - added IMQ patches
  - removed init scripts and sysconfig configuration
  - removed chkconfig reference


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Remi Collet <rcollet@redhat.com> - 5.3.3-47
changelog:
  - fix wrong warning in openssl_encrypt() for missing IV
    when IV is not required #1260315
  - fix segfault's when you try and allocate an SplFixedArray
    with size >= 9999 #1071344
  - segfault in php_pgsql_meta_data CVE-2015-4644  #1234434
  - add options to enable TLS in curl #1255920
  - fix segfault in gc_collect_cycles #1122681


author: Remi Collet <rcollet@redhat.com> - 5.3.3-49
changelog:
  - fix php-soap fails to connect to HTTPS web service sporadically
    as stream_socket_enable_crypto() uses NONBLOCK #1283153


author: Dan Walsh <dwalsh@redhat.com> 2.0.38-1
changelog:
  - Upgrade to latest from NSA
    * Check last offset in the module package against the file size.
    Reported by Manoj Srivastava for bug filed by Max Kellermann.


author: Karsten Hopp <karsten@redhat.com> 1.11.1-1.1
changelog:
  - remove vala from buildrequires and from self checks
  - fix variable usage in spec file
  - use pregenerated manpages from automake-1.11


author: Pavel Raiskup <praiskup@redhat.com> - 1.11.1-3
changelog:
  - fix for CVE-2012-3386 -- 'make distcheck' was making the directory distdir
    world-readable (#848469)


author: Stepan Kasal <skasal@redhat.com> 2.62-4
changelog:
  - add a quick fix for #449944
  - remove Requires: mktemp, imake, grep; these are required by the generated
    configure, but not by Autoconf.
  - switch on make check


author: Paul P. Komkoff Jr <i@stingr.net> - 0.0.33-0.1.svn7211
changelog:
  - grab latest upstream changes and fixes, along with new version number
  - do not mess with bundled nfnetlink.h, use <linux/netfilter/nfnetlink.h>


author: Dag Wieers <dag@wieers.com> - 0.4.0-1
changelog:
  - Updated to release 0.4.0.
  - ...
  - Changelog trimmed, see http://svn.rpmforge.net/svn/trunk/rpms/zsync/zsync.spec


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-6
changelog:
  - don't require logrotate (#922769)
  - move pppd database to /var/run/ppp to prevent SELinux AVCs (#968398)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-7
changelog:
  - ignore unrecognised radiusclient configuration directives (#906912)
  - add missing l2tp support (#815128)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-8
changelog:
  - prevent running into issues caused by undefined behavior (pointers of incompatible types aliasing the same object)


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.7.3-17
changelog:
  - Remove vendor prefix from desktop file for f19+ https://fedorahosted.org/fesco/ticket/1077
  - Fix build by explicitly linking to libpthread


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-1
changelog:
  - Rebase to 0.9.16 to provide the version Samba4 needs
  - Resolves: rhbz#766336
  - Drop ABI compatibility patch (no longer needed)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-2
changelog:
  - Add BuildRequires on libxslt and docbook-style-xsl to enable
    building manual pages

  - Related: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.17-1
changelog:
  - Rebase to 0.9.17 to provide the version Samba4 needs
  - Drop EXCLUDE_PATTERNS workaround in specfile
  - Resolves: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-2
changelog:
  - Resolves: rhbz#975489 - Additional flags might have no effect
                            on 32bit architectures


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-1
changelog:
  - Rebase libtevent to 0.9.26
  - Remove upstreamed or no longer applicable patches
  - Related: rhbz#1322688


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-2
changelog:
  - temporarily disable make check, which keeps failing in mock despite
    working correctly on a full system
  - Related: rhbz#1322688


author: Tom Lane <tgl@redhat.com> 2:1.2.46-1
changelog:
  - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,
    CVE-2011-2691, CVE-2011-2692
  Resolves: #721306


author: Nalin Dahyabhai <nalin@redhat.com> 2002e-17
changelog:
  - account for the /usr/share/ssl -> /etc/pki/tls move in the patch which
    sets the locations at compile-time (more of #165967)


author: Jonathan Kamens <jik@kamens.brookline.ma.us> 2004g-1
changelog:
  - Upstream version 2004g (#176974)
  - Remove obsolete doc file "WARNING"
  - Remove security patch included in new upstream version
  - Custom flock code no longer necessary; included in upstream


author: Marek Kasik <mkasik@redhat.com> 2.3.11-8
changelog:
  - Add freetype-2.3.11-CVE-2011-0226.patch
      (Add better argument check for `callothersubr'.)
      - based on patches by Werner Lemberg,
        Alexei Podtelezhnikov and Matthias Drochner
  - Resolves: #723468


author: Marek Kasik <mkasik@redhat.com> 2.3.11-13
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Properly initialize array "result" in
    FT_Outline_Get_Orientation()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806269


author: Marek Kasik <mkasik@redhat.com> - 2.3.11-16
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197738


author: Dan Walsh <dwalsh@redhat.com> - 2.0.94-5.1
changelog:
  - Cleanup selinux_mnt on disabled machines
  Resolves: #706049
  - Make restorecon python binding use realpath
  Resolves: #698583


author: Dan Walsh <dwalsh@redhat.com> - 2.0.94-5.6
changelog:
  - Back port handling of is_selinux_enabled form rhel7. We need is_selinux_enabled() to report disabled in a docker container so that SELinux aware applications do not attempt to do SELinux activities.
  Resolves: #1096816


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.94-5.7
changelog:
  - Fix selinuxdefcon to print end of line at the end of output.
  Resolves:#913115
  - Fix security_get_initial_context desc in security_compute_av.3
  Resolves:#1011109
  - Apply fix for selinux.8 man page from pschiffe@redhat.com.
  Resolves:#1011145


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.94-5.8
changelog:
  - avc_has_perm will now return yes if the machine is in permissive mode
  Resolves:#753675
  - nscd permission support for netgroup
  - Fix matchpathcon verify handling to fail on non-existing objects


author: Allisson Azevedo <allisson@gmail.com> 1.4.1-2
changelog:
  - Changed license for Ruby License/GPL
  - Add ruby-devel for devel requires
  - Changed main group for System Environment/Libraries
  - Changed install for keep timestamps


author: Stepan Kasal <skasal@redhat.com> - 1.2.3-21
changelog:
  - consolidate the autoconfiscation patches into one and clean it up
  - consequently, clean up the %build and %install sections
  - zconf.h includes unistd.h again (#479133)


author: Peter Schiffer <pschiffe@redhat.com> - 1.2.3-28
changelog:
  - resolves: #823007
    optimized deflate function on s390(x)
  - resolves: #754694
    added zlib.map file to provide better version information


author: Nalin Dahyabhai <nalin@redhat.com> - 1.6-1
changelog:
  - update to 1.6
  - add suggested summary, buildrequires, and modify install call as suggested
    by package review (#226021)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-2
changelog:
  - fix use of macro in changelog (rpmlint)
  - build with --disable-rpath (rpmlint)
  - build with %{?_smp_mflags}


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-3
changelog:
  - turn off common lisp bindings the right way
  - drop finger output
  - recode the changelog into UTF-8 if it isn't UTF-8 (rpmlint)


author: Jakub Dorňák <jdornak@redhat.com> - 5.1.73-1
changelog:
  - Update to MySQL 5.1.73, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-73.html
    (CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2014-0393,
    CVE-2014-0386, CVE-2014-0401, CVE-2014-0402)
    Resolves: #1055882


author: Honza Horak <hhorak@redhat.com> 5.1.73-2
changelog:
  - Make mysqld init script more robust and ignore existing but
    non-being-used unix socket file
    Resolves: #1037650


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-3
changelog:
  - drop the S390 build workaround as it is no longer needed
  - additional spec file cleanups for merge review (#226008)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-5
changelog:
  - use /dev/urandom for seeding in the FIPS mode
  - make the tests to pass in the FIPS mode also fixing
    the FIPS-186-3 DSA keygen


author: Adam Jackson <ajax@redhat.com> 1.0.4-4
changelog:
  - xau-1.0.4-local.patch: When looking for an auth cookie on local transport,
    don't bother checking hostname, it can't possibly help.


author: Pavel Šimerda <psimerda@redhat.com> - 1.0.1-3
changelog:
  - Resolves: #738244 - provide libnetfilter_queue package for RHEL 6.6
  - use a modified EPEL6 spec file


author: Adam Jackson <ajax@redhat.com> 1.8.6-3
changelog:
  - cairo-1.8.6-repeat-modes.patch: Enable the repeat and pad blend modes in
    the xlib backend to make firefox performance slightly less dire.


author: Vojtech Vitek (V-Teq) <vvitek@redhat.com> - 2:2.3.14-34
changelog:
  - Avoid possible hang while logging an unexpected signal (#694820)
  - Fix Rpmdiff build warning about "dereferencing type-punned pointer" (#697783)
  - Let RPC services bind to a specific port (#697788)
  - Prevent memory corruption error while using large number of services (#711787)
  - Fix coverity defects in poll patch (#715303)


author: Jan Synáček <jsynacek@redhat.com> - 2:2.3.14-40
changelog:
  - Fix: xinetd attempts to bind to IPv6 sockets even on systems with IPv6 disabled (#1285091)
  - Fix: modify the xinetd man page to make it more clear on what happens to services on xinetd reload (#1119317)


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-9
changelog:
  - fix CVE-2011-3481: NULL pointer dereference via crafted 
    References header in email (#738391)
  - fix CVE-2011-3372: nntpd authentication bypass (#740822)


