# changelog

author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-82
changelog:
  - Release 1.2.11.15-82
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 48983)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-83
changelog:
  - Release 1.2.11.15-83
  - Resolves: #1327065 - After updating server, component nss-3.21.0-0.3.el6_7.x86_64, some client applications cannot connect to server (DS 48798)
  - Resolves: #1266920 - invalid message about write_changelog_and_ruv on consumers (DS 47801)
  - Resolves: #1330758 - add a nsTLS1.0 on or off new configuration parameter to cn=encryption,cn=config in RHEL 6 389-ds-base (DS 48816)
  - Resolves: #1369572 - cleanallruv changelog cleaning incorrectly impacts all backends (DS 48964)
  - Resolves: #1371706 - Server Side Sorting crashes the server. (DS 48970)
  - Resolves: #1371678 - Disabling CLEAR password storage scheme will crash server when setting a password (DS 48975)
  - Resolves: #1370145 - cannot reindex retrochangelog (DS 47619)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-84
changelog:
  - Release 1.2.11.15-84
  - Resolves: #1352109 - Replication stops working only when fips mode is set to true  (DS 48909)
  - Resolves: #1372420 - DES to AES backport issues (DS 47462)
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 48983)
  - Resolves: #1382386 - Directory Server accepts a wrong userdn macro ACI (DS 449)
  - Resolves: #1382519 - 1.2.11 only -- coverity fixes (DS 49004)
  - Resolves: #1387022 - specific search with sizelimit=1 sometimes returns no entry (DS 47703)
  - Resolves: #1387772 - trace args debug logging must be more restrictive (DS 49009)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-85
changelog:
  - Release 1.2.11.15-85
  - Resolves: #1372420 - DES to AES backport issues (DS 47462)
  - Resolves: #1391324 - ds9 backport 47411 - Replace substring search with plain search in referint plugin (DS 47411)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-86
changelog:
  - Release 1.2.11.15-86
  - Resolves: #1380435 - Backport request of ticket 48983 to RHEL6.9 (DS 49049)
  - Resolves: #1400997 - ldif2db.pl script shows wrong usage for -n as instance, instead of database (DS 49070)
  - Resolves: #1403754 - ns-slapd crashes during tickets/ticket48665_test.py (DS 48665)
  - Resolves: #1410645 - The "repl-monitor" web page does not display "year" in date. (DS 48220)
  - Resolves: #1399600 - ns-slapd segfaults during execution of tickets/ticket47966_test.py (DS 47966, DS 48987)
  - Resolves: #1402012 - Importing big ldif file with duplicate DNs throwing "unable to flush" error
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-87
changelog:
  - Release 1.2.11.15-87
  - Resolves: #1391701 - do not treat missing csn as fatal (DS 49020)
  - Resolves: #1406835 - memberOf fixup task does not validate args (DS 49072)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-88
changelog:
  - Release 1.2.11.15-88
  - Resolves: #1413692 - custom schema is registered in small caps after schema reload (DS 47973)
  - Resolves: #1408976 - dbscan-bin crashing due to a segmentation fault. (DS 49104)


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-89
changelog:
  - Release 1.2.11.15-89
  - Resolves: #1421512 - ns-slapd crashes in ldif_sput due to the output buf size is less than the real size.


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-90
changelog:
  - Release 1.2.11.15-90
  - Resovles: #1435365 - Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.1.11.15-91
changelog:
  - Release 1.2.11.15-91
  - Resolves: bug 1437777 - EMBARGOED CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11-15-92
changelog:
  - Release 1.2.11.15-92
  - Resolves: Bug 1543798 - EMBARGOED CVE-2018-1054 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11-15-93
changelog:
  - Release 1.2.11.15-93
  - Resolves: Bug 1544415 - CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c
  - Resolves: Bug 1543798 - EMBARGOED CVE-2018-1054 389-ds-base: remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 in collate.c


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11-15-94
changelog:
  - Release 1.2.11.15-94
  - Resolves: Bug 1544415 - CVE-2017-15135 389-ds-base: Authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (fix cherry-pick error)


author: Mark Reynolds <mreynolds@redhat.com> - 1.2.11.15-95
changelog:
  - Bump version to 1.2.11-15-95
  - Resolves: Bug 1562152 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-3
changelog:
  - prevent setfacl --restore from SIGSEGV on malformed restore file (#576512)
  - run the test-suite if possible


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-5
changelog:
  - clarify that removing a non-existent acl entry is not an error (#674883)
  - update project URL in package specification (#702638)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-6
changelog:
  - add function acl_extended_file_nofollow() (#720318)
  - build with partial RELRO support as a security enhancement (#723998)


author: Kamil Dudka <kdudka@redhat.com> 2.2.49-7
changelog:
  - fix SIGSEGV of getfacl -e on overly long group name (#1025246)
  - fix test-suite failure on a repeated run (#743847)


author: Joe Orton <jorton@redhat.com> - 1.3.9-4
changelog:
  - add fix for apr_fnmatch() regression (CVE-2011-1928, #706352)
  - add fix for CVE-2011-0419 (#703520)


author: David Tardon <dtardon@redhat.com> - 1:4.2.8.2-11
changelog:
  - Resolves: rhbz#1223696 some labels in print dialog are not translated, even
    though the translations exist


author: Ian Kent <ikent@redhat.com> - 5.0.5-124
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - wait for master map available at start.
    - add master read wait option.
  - Resolves: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-125
changelog:
  - bz703846 - Incorrect autofs.schema
    - update and add README for old autofs schema
  - Resolves: rhbz#703846


author: Ian Kent <ikent@redhat.com> - 5.0.5-126
changelog:
  - bz1384404 - Automounter does not fetch maps from AD
    - work around sss startup delay.
    - add sss master map wait config option.
  - Resolves: rhbz#1384404


author: Ian Kent <ikent@redhat.com> - 5.0.5-127
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - fix included master map not found return.
    - dont exit on master map read fail timeout.
    - set sane default master read wait timeout.
  - Related: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-128
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - don't return until after master map retry read.
  - Related: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-129
changelog:
  - bz1350786 - On every system boot automount needs a restart to access
    NIS map
    - make lookup_nss_read_master() return nss status.
  - Related: rhbz#1350786


author: Ian Kent <ikent@redhat.com> - 5.0.5-130
changelog:
  - bz703846 - Incorrect autofs.schema
    - fix autofs.schema.new not copied to package.
  - Resolves: rhbz#703846


author: Ian Kent <ikent@redhat.com> - 5.0.5-131
changelog:
  - bz1396403 - Trying to access a non-existent directory using automount
                results in 4 minute hang with nfs-utils-1.2.3-73.el6
    - fix inconsistent signed usage for __rpc_ping().
    - check NFS server availability on local mount fallback
  - Resolves: rhbz#1396403


author: Ian Kent <ikent@redhat.com> - 5.0.5-132
changelog:
  - bz1277033 - RHEL6.7: shutdown / reboot hangs with findmnt in a readlink
    system call, doing path_walk and stuck in autofs4_wait
    - make set_direct_mount_catatonic() more general.
    - set autofs mounts catatonic at exit
  - Related: rhbz#1277033


author: Ian Kent <ikent@redhat.com> - 5.0.5-133.el6_9
changelog:
  - bz1501922 - Autofs processes hung while waiting for the release of an
    entry master_lock that is held by another thread waiting on a bind mount
    - only take master map mutex for master map update.
  -Resolves: rhbz#1501922


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.59.rc1
changelog:
  - Use /lib or /lib64 only if directory in chroot already exists
  - Tighten NSS library pattern, escape chroot mount path


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.61.rc1
changelog:
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.67.rc1
changelog:
  - Change EDNS flags only after successful query (#1416035)
  - Fix crash in ldap driver at bind-sdb stop (#1426626)


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.68.rc1.4
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Fix invalid tsig request (CVE-2020-8617)


author: Jeff Law <law@redhat.com> - 2.20.51.0.2-5.38
changelog:
  - Use thread-safe PLT stubs for Power. (#906079)
  - Avoid segfault when arch member uses long names, but no longname
    table exists.  (#909056)
  - Correct patch for 773526. (#922393)


author: Bastien Nocera <bnocera@redhat.com> 4.66-1
changelog:
  - Update to 4.66
  - Update cable pairing patch
  - Remove out-dated patches, including wacom pairing
  - Move hidd, pand and dund man pages to the -compat
    sub-package
  Resolves: rhbz#565586


author: Kai Engert <kaie@redhat.com> - 2014.1.98-65.2
changelog:
  - Add an alternative version of the "Thawte Premium Server CA" root,
    which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
    which contain that version of the root certificate (rhbz#1138230).
    This change doesn't add trust for another key, because both versions
    of the certificate use the same public key.


author: Kai Engert <kaie@redhat.com> - 2015.2.3-65.1
changelog:
  - Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
  - Add a patch to the source RPM that documents the changes from the
    upstream version.
  - Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
    configuration file.
  - The new scriptlets require the coreutils package.
  - Remove the obsolete blacklist.txt file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-7
changelog:
  - Workaround for raid leg allocation failure after not-in-sync raid leg failure.
  - Fix flushing of outstanding IO for mirror target (2.02.133).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-8
changelog:
  - Prevent non-synced raid1 repair unless --force
  - Fix automatic updates of PV extension headers to newest version.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-9
changelog:
  - Fix lvchange --discard|--zero for active thin-pool.
  - Fix lock-holder device for thin pool with inactive thin volumes.
  - Use any inherited tags when wiping metadata sub LVs to ensure activation.
  - Do not issue "Failed to create directory" message for dm_create_dir failure.
  - Add Conflicts: lvm2-libs < 2.02.111 to device-mapper-event to prevent
    incorrect package setup if old and new device-mapper/lvm2 packages combined.
  - Move blkdeactivate/blk-availability script from lvm2 to device-mapper package.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-10
changelog:
  - Disable queueing on mpath devs in blk-availability initscript.
  - Add new -m|--mpathoption disablequeueing to blkdeactivate.
  - Prevent only repair for non-synced raid1 unless --force, not other raid types.


author: Jiri Vanek <jvanek@redhat.com> - 1.1-2
changelog:
  - package now "installs" also during pretrans, so pretrasn scripts can use it
  - pretrasn "install" is removed in postrans


author: Jiri Vanek <jvanek@redhat.com> - 1.2-1
changelog:
  - initial import to rhel6
  - commented out lua-posix
  - the work horse file changed to 644 (as it do not work without lua-posix)
  - Resolves: rhbz#1391735


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-12
changelog:
  - only use PCH in toplevel inclusions (#1177458, PR pch/38987, PR pch/52518)
  - don't vectorize bitfield and boolean types (#1150606,
    PR tree-optimization/43390)
  - fix up a Cray pointer handling bug (#1134560, PR fortran/62174)
  - fix up stdarg optimization when address of a va_list variable escapes
    in a phi node (#1190640, PR target/64979)


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-17
changelog:
  - change libgomp default spincount if OMP_WAIT_POLICY is not specified
    (#1229852, PR libgomp/43706)
  - remove -Wl,-z,nodlopen from Ada libraries, which no longer contain
    trampolines (#1241495)
  - guard __gcov_flush body in libgcov.a with a mutex (#1251488,
    PR gcov/49484, PR gcov-profile/52627)
  - add missing s390.exp hunk from -mhotpatch= support (#1233260)


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-18
changelog:
  - fix up std::rethrow_exception (PR libstdc++/62258, #1380760)
  - fix fortran ICE in resolve_ordinary_assign (PR fortran/43362, #1356346)


author: James Antill <james.antill@redhat.com> - 0.9.9-18
changelog:
  - Option -C does nothing on empty repo.
  - Resolves: rhbz#877301
  - Fix the options documentation.
  - Resolves: rhbz#892657


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-19
changelog:
  - Options --checksum, --unique-md-filenames, --simple-md-filenames for modifyrepo.
  - Resolves: rhbz#952602


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-20
changelog:
  - Catch IOErrors when loading pkglist.
  - Resolves: rhbz#1083185
  - Fix OSError when running createrepo on CIFS shares.
  - Resolves: rhbz#1035588


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-24
changelog:
  - Make sure filename doesn't already contain a checksum.
  - Resolves: bug#1104840
  - Remove nonexistent --no-compress option from the manpage.
  - Resolves: bug#1106454


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-69
changelog:
  - Document ErrorPolicy in cupsd.conf manpage (bug #1120587, STR #4457).
  - Prevent cups-polld busy loop when access is restricted (bug #1164854).
  - Apply upstream patch to prevent crash in cupsdContinueJob() (bug #1187840).
  - Added failover backend to support priority-based failover (bug #1115219).
  - Apply patch to fix sanitize_title documentation (bug #988062, STR #4569).


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-70
changelog:
  - Fixed SetEnv patch (bug #1198394).
  - Validate ErrorPolicy directory when reading configuration (bug #1196217,
    STR #4591).


author: Jiri Popelka <jpopelka@redhat.com> - 1:1.4.2-73
changelog:
  - Fix failover backend options parsing (bug #1231322).
  - The socket backend could go into an infinite loop with certain printers
    (bug #1276772, STR #3622)
  - dnssd backend: don't crash if avahi gives a callback with no TXT record
    (bug #1269305)
  - Don't unload jobs that couldn't be saved (bug #1283003, STR #4742).


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.4.2-76
changelog:
  - 1344782 - Banner pages do not show time-at-creation or time-at-processing
  - 1219571 - Invalid memory accesses lead to crash when configured class has implicit class as first member


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.4.2-77
changelog:
  - 1099617 - Using "lp -o orientation-requested=6" with a PDF file has no effect.
  - 1268131 - Printing PDF with fit-to-page doesn't take printer HW margins into account


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-44
changelog:
  - use only full matches for hosts used as IP address in cookies (CVE-2014-3613)
  - fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-46
changelog:
  - require credentials to match for NTLM re-use (CVE-2015-3143)
  - close Negotiate connections when done (CVE-2015-3148)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-49
changelog:
  - prevent NSS from incorrectly re-using a session (#1269660)
  - prevent test46 from failing due to expired cookie (#1277551)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.50-1
changelog:
  - functions: improve killing loops
  - netfs: tweak nfs umount
  - sysctl.conf: mention sysctl -a
  - sysconfig.txt: document PPPOE_EXTRA and PPPD_EXTRA
  - spec: require plymouth
  - fix mangled sysconfig/init.s390
  - rc.sysinit: don't perform fsck twice with /.autorelabel
  - ifdown-eth: fix comparison
  - ifup-eth: if arping fails, output responding MAC
  - network-functions: fix change_resolv_conf after grep update
  - spec: add sysctl.d dir
  - rc.sysinit: fix typo in fs
  - rename_devices: comments need to have a blank before them
  - rename_device: remove comments and trailing whitespaces
  - bonding: warn if the ifup for slave device failed
  - clarify daemon() usage message
  - ifdown: clean ipv4 localhost addresses
  - ifup-post: check resolve.conf also with DNS2
  - ifup: add missing quotes
  - ifup-eth: some bridge options are applied later
  - init.d/halt: give init some time to reexecute
  - network-scripts: DEVICE and HWADRR could be quoted by apostrophe
  - ifup-wireless: fix calling of phy_wireless_device
  - rc.sysinit: apply quotas after system is relabeled


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.54-1
changelog:
  - specfile: require newer lvm
  - ifdown-eth: add timeout for when flushing global scope
  - functions: support boolean values in is_true() & is_false()
  - ifup-aliases: do not return with error when arping fails
  - netconsole: resolve domain name via 'getent' instead of 'hosts'


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.55-1
changelog:
  - ipcalc: detect invalid mask
  - ifup-aliases: send gratuitous ARPs when adding addresses
  - network: treat other tunnel interfaces (fixes ifdown stage)
  - kexec-disable.conf: release kexec memory properly
  - network-functions: do not send hostname via dhclient everytime
  - sysconfig/network: NO_DHCP_HOSTNAME option introduced
  - ipv6_add_addr_on_device: replace the existing address on NIC


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.92
changelog:
  - Modify 0246-RHBZ-1145442-raw-output-and-wildcards.patch
    * fix PAD and PRINT macros
  - Resolves: bz #1145442


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.93
changelog:
  - Add 0250-RHBZ-1316165-fix-i686-size-bug.patch
    * make multipathd use uint64_t for tracking the interactive command
      fingerprint.
  - Resolves: bz #1316165


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.94
changelog:
  - Add 0251-RHBZ-1349376-fix-makefile.patch
    * make multipath use correct version of libdevmapper
  - Add 0252-RHBZ-1333334-huawei-config.patch
  - Add 0253-RHBZ-1305589-check-multipathd.patch
    * warn if multipath devices exist and mutipathd is not running
  - Add 0254-RHBZ-1310320-no-kpartx.patch
    * add skip_kpartx option to skip kpartx device creation
  - Add 0255-UPBZ-1322532-disable-reinstate.patch
    * do not reinstate unusable Implicit ALUA ghost paths
  - Add 0256-RHBZ-1324764-man-page-typo.patch
  - Add 0257-UPBZ-1328077-resize-map.patch
    * reset size if resizer operation fails
  - Add 0259-UPBZ-1343747-dont-fail-discovery.patch
    * keep multipath from failing if it fails to get information on any device
  - Add 0260-RHBZ-1364879-check-mpath-prefix.patch
    * ignore all devices that don't have a uuid starting with "mpath-"
  - Add 0261-RHBZ-1377532-disable-changed-paths.patch
    * do not use path devices that change their wwid
  - Resolves: bz #1299644, #1305589, #1310320, #1322532, #1324764, #1328077
  - Resovles: bz #1333334, #1343747, #1349376, #1364879, #1377532


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.95
changelog:
  - Modify 0254-RHBZ-1310320-no-kpartx.patch
    * fix small bug with unitialized data
  - Refresh 0261-RHBZ-1377532-disable-changed-paths.patch
  - Add 0262-RH-free-vector.patch
    * Fix coverity discovered bug in error path
  - Resolves: bz #1310320


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.96
changelog:
  - Add 0258-UPBZ-1300414-PURE_config.patch
  - Add 0264-RHBZ-1365710-no-use-after-free.patch
    * Fix two segfaults, and NULL out some structures after free
  - Add 0265-RHBZ-1390472-dont-exit.patch
    * don't exit if multipath hits recoverable errors during startup
  - Resolves: bz #1300414, #1365710, #1390472


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.97
changelog:
  - Add 0265-RHBZ-1355669-max-sectors-kb.patch
    * add "max_sectors_kb" config option to set this value on all paths
  - Change devicemapper Requires to >= 1.02.117-9.el6 (bz #1344381)
    * forces multipath to use latest version of blk-availability
  - Resolves: bz #1344381, #1355669


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.98
changelog:
  - Add 0266-RHBZ-1401391-fix-prio-put.patch
    * don't try to drop a nonexistant prio handler
  - Add 0267-RHBZ-1401769-orphan-status.patch
    * don't print out checker and device status for orphan paths
  - Resolves: bz #1401391, #1401769


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.100
changelog:
  - Modify 0261-RHBZ-1377532-disable-changed-paths.patch
    * add man page information
  - Refresh 0265-RHBZ-1355669-max-sectors-kb.patch
  - Related: #1377532


author: Benjamin Marzinski <bmarzins@redhat.com> -0.4.9.100.1
changelog:
  - Add 0268-RHBZ-1497059-fix-reserve.patch
    * stop waiting for threads that weren't successfully created
  - Resolves: bz #1497059


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-50.P1
changelog:
  - Lease table overflow crash. (#1133917)
  - Add ignore-client-uids option. (#1196768)
  - dhclient-script: it's OK if the arping reply comes from our system. (#1204095)
  - VLAN ID is only bottom 12-bits of TCI. (#1259552)
  - dhclient: Make sure link-local address is ready in stateless mode. (#1263466)
  - dhclient-script: make_resolv_conf(): Keep old nameservers
    if server sends domain-name/search, but no nameservers. (#1269595)


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-53.P1.3
changelog:
  - Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow

  <* Wed Feb 28 2018 Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-53.P1.2
  - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-55.P1
changelog:
  - Resolves: #1527995 - allow static route with a 0.0.0.0 next-hop address
  - Related: #1527995 -  install link-local static routes with correct scope


author: Tomas Hozza <thozza@redhat.com> - 2.48-10
changelog:
  - Fixed dnsmasq-2.48-add-bind-dynamic-option.patch
   - the option --bind-dynamic was not set correctly when used


author: Tomas Hozza <thozza@redhat.com> - 2.48-11
changelog:
  - Revert previous changes because of many problems with --bind-dynamic option backport.
  - Dropping dnsmasq-2.48-add-bind-dynamic-option.patch
  - Set SO_BINDTODEVICE socket option when using --bind-interfaces (rhbz#884957)


author: Jiri Popelka <jpopelka@redhat.com> - 0.7.0-2
changelog:
  - enable to specify disks with path to device file or
    with symbolic link to the device file (#766443)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 0.7.0-3
changelog:
  - fix the error message for '--gpfs-ops --gpfs' options (#989779)
  - fix the invalid syntax when '--mysql5-conn' is used (#766806)


author: Peter Robinson <pbrobinson@gmail.com> - 3.2.1-1
changelog:
  - Ekiga 3.2.1 stable - Changelog
    http://mail.gnome.org/archives/ekiga-devel-list/2009-May/msg00054.html


author: Peter Robinson <pbrobinson@gmail.com> - 3.2.4-1
changelog:
  - Ekiga 3.2.4 stable - Changelog
    http://mail.gnome.org/archives/ekiga-devel-list/2009-May/msg00062.html
    http://mail.gnome.org/archives/ekiga-devel-list/2009-May/msg00064.html


author: Milan Crha <mcrha@redhat.com> - 3.2.6-4
changelog:
  - Rebuild against newer evolution-data-server.
  - Add patch to build break (include <bits/wordsize.h> where needed)
  Resolves: #973281


author: Adam Tkac <atkac redhat com> - 1.7.1-1
changelog:
  - update to 1.7.1 (#585990)
  - Use %{gitcoredir}/git-daemon as xinetd server (#529682) [Todd Zullinger]
  - Remove long fixed xinetd IPv6 workaround (#557528) [Todd Zullinger]
  - Make %{_var}/lib/git the default gitweb root (#556299) [Todd Zullinger]
  - Include gitweb/INSTALL file as documentation [Todd Zullinger]
  - Ship example gitweb config (%{_sysconfdir}/gitweb.conf) [Todd Zullinger]
  - Install missing gitweb.js (#558740) [Todd Zullinger]
  - Only BR perl(Error) [Todd Zullinger]
  - Use config.mak to set build options [Todd Zullinger]
  - Disable building of unused python remote helper libs [Todd Zullinger]
  - Comply with Emacs add-on packaging guidelines (#573423) [Jonathan Underwood]
    - Place elisp source files in separate emacs-git-el package
    - Place git support files in own directory under site-lisp
    - Use Emacs packaging macros
  - Replace $RPM_BUILD_ROOT with %{buildroot} [Todd Zullinger]


author: Petr Stodulka <pstodulk@redhat.com> - 1.7.1-7
changelog:
  - fixes memory corruption on git shortlog
  - add -f option for "git submodule add" to add files even when
    these are included in .gitignore
  - improve performance of extremly slow http(s)
  - fix cloning using http(s) protocol when redirection is requested
    Resolves: #874659 #1207253 #1237395 #1289984


author: Petr Stodulka <pstodulk@redhat.com> - 1.7.1-8
changelog:
  - fixes previous patch which add -f option for "git submodule add"
    which incorectly used unsupported option --ignore-missing for
    "git add --dry-run"
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1207253 #1368384


author: Jan Zeleny <jzeleny@redhat.com> - 1.4-2
changelog:
  - cleanup of spec file (mixed tabs-and-spaces, specific version
    for explicit obsoletes, file attributes)


author: Petr Stodulka <pstodulk@redhat.com> - 1.4-4
changelog:
  - Fixed troubles with SSl connection
  - Fixed adding of broken symlink when 'copy -A'
  - Fixed permissions for */hgk - Thanks to Dave Johanse <davejohansen@gmail.com>
    Resolves: #784079 #928301 #1006457


author: Milan Crha <mcrha@redhat.com> - 2.32.3-28.el6
changelog:
  - Add patch for RH bug #1012399 (Fails to display task mail attachment)
  - Bump evolution-data-server version requirement (for RH bug #1009426)


author: Milan Crha <mcrha@redhat.com> - 2.32.3-30.el6
changelog:
  - Update patch for RH bug #975409 (Custom message in alarm notification)
  - Add patch for RH bug #1014743 (Use system timezone has no effect)
  - Add patch for RH bug #1014677 (Search filter persists when changing folders)


author: Milan Crha <mcrha@redhat.com> - 2.32.3-32.el6
changelog:
  - Add patch for RH bug #1054865 (Incorrect unref under e_attachment_load_finish())
  - Add patch for RH bug #1054772 (Local addressbooks created without relative_uri set)


author: Milan Crha <mcrha@redhat.com> - 2.32.3-33.el6
changelog:
  - Add patch for RH bug #1080467 (mark-all-read plugin can cause UI freeze)
  - Add patch for RH bug #1052955 (Time format in combo controls is always 24 hrs)


author: Milan Crha <mcrha@redhat.com> - 2.32.3-37.el6
changelog:
  - Add patch for RH bug #1066063 (Use-after-free on a reminder snooze)
  - Add patch for RH bug #1133507 (Calendar event times not drawn with correct font)


author: Milan Crha <mcrha@redhat.com> - 0.32.2-10
changelog:
  - Add patch for RH bug #621941 (Created events not shown in OWA)
  - Add patch for RH bug #906341 (Cannot create book/calendar)


author: Milan Crha <mcrha@redhat.com> - 0.32.2-11
changelog:
  - Update patch for RH bug #621941 (Created events not shown in OWA)
  - Add patch for RH bug #1017108 (Shorten delay of calendar open)


author: Milan Crha <mcrha@redhat.com> - 0.32.2-13
changelog:
  - Add patch for RH bug #1026797 (Coverity scan issue - uninitialized variable)
  - Add patch for RH bug #1141662 (Crash when receiving message without body)


author: Orion Poplawski <orion@cora.nwra.com> - 1.6.0-1
changelog:
  - Update to 1.6.0
  - Use python-paramiko instead of python-ssh
  - Remove shipped egg-info
  - Misc cleanup


author: Marek Grac <mgrac@redhat.com> - 4.0.15-5
changelog:
  - fence_ilo_ssh: New fence agent
    Resolves: rhbz#1111482
  - fence_kdump: Update metadata for 'monitor'
    Resolves: rhbz#1094515


author: Marek Grac <mgrac@redhat.com> - 4.0.15-7
changelog:
  - fence_scsi: remove new pythonic version
  - fence_ipmilan: unset default cipher
  - fence_ilo2: add options --tls1.0
  - fence_bladecenter: fix login process
    Resolves: rhbz#1049805


author: Marek Grac <mgrac@redhat.com> - 4.0.15-9
changelog:
  - fence_ipmilan no longer understands -i
    Resolves: rhbz#1254046
  - fence_ipmilan no longer understands 'timeout'
    Resolves: rhbz#1254700
  - fence_ilo: Improve negotiation of TLS protocol
    Resolves: rhbz#1256902
  - fence_rsa: Login process over telnet is not working
    Resolves: rhbz#1247062
  - fence_mpath: lose scsi keys after restart
    Resolves: rhbz#1254183


author: Marek Grac <mgrac@redhat.com> - 4.0.15-11
changelog:
  - fence_ipmilan: Revert power_wait values
    Resolves: rhbz#1273632
  - fence_apc: Support for firmware 6.x
    Resolves: rhbz#1259254
  - fence_ipmilan: Add 'diag' action
    Resolves: rhbz#1266600
  - fencing: Add '-list-status' action
    Resolves: rhbz#1183829


author: Marek Grac <mgrac@redhat.com> - 4.0.15-13
changelog:
  - fence_ipmilan: Do not print password to debug output
    Resolves: rhbz#1358064
  - fencing: Handle None as status properly
    Resolves: rhbz#1361623


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.15-13.2
changelog:
  - fence_rhevm: add "--api-path" and "--disable-http-filter" to be
    able to explicitly use oVirt API version 3
    Resolves: rhbz#1506694


author: David Teigland <teigland@redhat.com> - 2.5-1
changelog:
  - Resolves: rhbz#826022 rhbz#830736 rhbz#830848 rhbz#831906 rhbz#832935 rhbz#840063 rhbz#841305 rhbz#843073


author: John Dennis <jdennis@redhat.com> - 2.1.12-4
changelog:
  - resolves: bug#855317
    CVE-2012-3547 freeradius: Stack-based buffer overflow by processing
    certain expiration date fields of a certificate during x509 certificate
    validation


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.1.12-5
changelog:
  - Add support for microsecond precision of home server's response_window
    option, client's response_window option with the same precision and home
    server's response_timeouts option, backported from v3.0.x.
  - Resolves: bug#1107843


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.1.12-6
changelog:
  - Fix missing braces around a condition branch in client response_window
    patch.
  - Resolves: bug#1107843


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-1
changelog:
  - Upgrade to the latest upstream release v2.2.6
    Resolves: Bug#921563  raddebug not working correctly
    Resolves: Bug#921567  raddebug -t 0 exists immediately
    Resolves: Bug#1060319 MSCHAP Authentication is not working using automatic
                          windows user credentials
    Resolves: Bug#1078736 Rebase FreeRADIUS to 2.2.4
    Resolves: Bug#1135439 Default message digest defaults to sha1
    Resolves: Bug#1142669 EAP-TLS and OCSP validation causing segmentation
                          fault
    Resolves: Bug#1173388 dictionary.mikrotik missing Attributes
  - Remove radutmp rotation
    Resolves: Bug#904578  radutmp should not rotate
  - Check for start_servers not exceeding max_servers
    Resolves: Bug#1146828 radiusd silently fails when start_servers is higher
                          than max_servers


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-4
changelog:
  - Move OpenSSL init out of version check
    Resolves: Bug#1189394 radiusd segfaults after update
  - Comment-out ippool-dhcp.conf inclusion
    Resolves: Bug#1189386 radiusd fails to start after 'clean' installation


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-5
changelog:
  - Fix EAP client authentication with TLS 1.2
    Resolves: Bug#1248484 FreeRADIUS 2.2.6 miscalculates MPPE keys with TLS 1.2


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-6
changelog:
  - Fix EAP-TTLS/CHAP/MSCHAP/MSCHAPv2 authentication with WPA supplicant v2.4
    Related: Bug#1248484 FreeRADIUS 2.2.6 miscalculates MPPE keys with TLS 1.2


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-7
changelog:
  - Resolves: Bug#1469115 CVE-2017-10979 freeradius: Out-of-bounds write in
                          rad_coalesce()
  - Resolves: Bug#1469118 CVE-2017-10978 freeradius: Out-of-bounds read/write
                          due to improper output buffer size check in make_secret()
  - Resolves: Bug#1469120 CVE-2017-10980 freeradius: Memory leak in decode_tlv() 
  - Resolves: Bug#1469122 CVE-2017-10981 freeradius: Memory leak in
                          fr_dhcp_decode()
  - Resolves: Bug#1469124 CVE-2017-10982 freeradius: Out-of-bounds read in
                          fr_dhcp_decode_options()
  - Resolves: Bug#1469126 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63


author: Tim Waugh <twaugh@redhat.com> - 8.70-20
changelog:
  - Applied patch from upstream to fix memory handling issue that could
    lead to crashes (bug #1105520).
  - Improved support for PDF/A from upstream (bug #1060026).
  - Back-ported patch to process embedded files as a portable collection
    only if there is a /Collection attribute (bug #1027534).
  - Back-ported patch to preserve invisible PDF text in pdfwrite (bug #994452).


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 8.70-22
changelog:
  - Added security fixes for:
    - CVE-2013-5653 (bug #1380327)
    - CVE-2016-7977 (bug #1380415)
    - CVE-2016-7979 (bug #1382305)
    - CVE-2016-8602 (bug #1383940)


author: Martin Osvald <mosvald@redhat.com> - 8.70-24.el6_10.2
changelog:
  - It was found that the fix for CVE-2018-16509 was not complete, the missing
    pieces added into ghostscript-CVE-2018-16509.patch


author: Tomas Mraz <tmraz@redhat.com> - 2.0.13-3
changelog:
  - drop s390 specific ifnarchs as all the previously missing dependencies
    are now there
  - split out gpgsm into a smime subpackage to reduce main package dependencies


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.13-4
changelog:
  - Explicitly BR libassuan-static in accordance with the Packaging
    Guidelines (libassuan-devel is still static-only).


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-3
changelog:
  - initialize small amount of secmem for list of algorithms in help (#598847)
    (necessary in the FIPS mode of libgcrypt)


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-5
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.14-8
changelog:
  - fix aborts and default algorithms when running in FIPS mode (#1078957, #966493)
  - add missing initialization of libgcrypt in gpgv
  - properly encode s2k iteration count in gpg-agent (#638635)


author: Milan Crha <mcrha@redhat.com> - 3.32.2-1.el6
changelog:
  - Rebase to 3.32.2
  - Remove patch for RH bug #588457 (part of rebase)
  - Remove patch for RH bug #590877 (part of rebase)


author: Milan Crha <mcrha@redhat.com> - 3.32.2-2.el6
changelog:
  - Add patch for some issues found by Coverity scan
  - Add patch for RH bug #577797 (Cursor misplaced after paste)
  - Add patch for RH bug #615969 (Whitespaces drop on paste)
  - Add patch for RH bug #627199 (Underline/strikeout misplaced in printout)
  - Add patch for RH bug #626690 (Paragraph style not drawn after font style change)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-55
changelog:
  - Resolves: #1372315 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-56
changelog:
  - Resolves: #1310582 - when ProxyErrorOverride is On, modcluster return
    503 status code on subsequent requests


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-58
changelog:
  - Resolves: #1349546 - comments no longer allowed at the end of Allow
    from statements and maybe other statements from mod_authz*


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-60.5
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-2
changelog:
  - Revert the version not to be rebased.
  - Fix bug 608988 - Cannot de-select Hanja lock in applet menu
    Resolves: #608988


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-4
changelog:
  - Resolves: #651915 Wrong window position with ibus-x11
    Added ibus-651915-x11-position.patch
  - Resolves: #633330 Fixed kn.po
  - Resolves: #635541 Fixed gu.po
    Added ibus-1.3.4-po-2010-11-17.tar.bz2


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-6
changelog:
  - Fixed Bug 667031 - ibus requires dbus-x11
  - Fixed Bug 670137 - QT_IM_MODULE=xim in ibus.conf without ibus-qt


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.3.4-10
changelog:
  - Resolves: Bug 1403077 - Support second monitor in ZaphodHeads
    Added ibus-1403077-zaphodheads-x11.patch to get x11 screen number
    Added ibus-1403077-zaphodheads.patch


author: Caolan McNamara <caolanm@redhat.com> - 4.2.1-9
changelog:
  - Resolves: rhbz#596171 drop icu.icu6284.strictalias.patch and use
    -fno-strict-aliasig as upstream has added a pile more and doesn't look
    interested in proposed patchs


author: Peng Wu <pwu@redhat.com> - 4.2.1-15
changelog:
  - Apply icu.13634.integer.overflow.patch
  - Apply icu.20958.segv.mapper.patch
  - Resolves: rhbz#1809876


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.4-10
changelog:
  - Minor source hardening (bz 878001)
  - Migrating algorithm fix (bz 1031230)
  - Introducing deepestcache option (bz 1052166)
  - Debug option behavior fix (bz 1096392)


author: Petr Holasek <pholasek@redhat.com> - 2:1.0.7-2
changelog:
  - Unused variable removed (bz 1119404)
  - Warning when started as non-root (bz 749651)
  - More robust signal handling (bz 1158932)
  - Fixed manpage hostname (bz 1162247)
  - Fixed memleak (bz 1178247)
  - Fixed help message typo (bz 1178903)


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-21
changelog:
  - 1294965 iscsiuio match based on driver to support new hardware without
    adding PCI IDs (still need IDs added to kernel)
  - bnx2i pass through ping support


author: Chris Leech <cleech@redhat.com> - 6.2.0.873-27
changelog:
  - 1170750 apply "Set non negotiated params early" from upstream
    to fix SendTargets discovery over iSER with some targets


author: Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-13
changelog:
  - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)
  - CVE-2008-3522 jasper: possible buffer overflow in 
    jas_stream_printf() (#461478)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-17
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171209)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173567)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173567)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-19
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183672)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183680)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-20
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938 (ttable_match_7) and PR2939 (fontpath)) applied upstream.
  - Resolves: rhbz#1350040


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.2
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350040


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.1
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Require at least the build-time version of NSS at run-time due to static linking.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.2
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Remove unneeded AArch64 environment variable setting.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.1
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Add blacklisted.certs to installation file list.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.0
changelog:
  - Bump to 2.6.10 and u141b00.
  - Adjust RH1022017 following application of 8173783
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Bump to u141b01 to include S8043723 fix for s390.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.0
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Apply fix for 8185716 so ppc uses correct ins_encode format
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Bump to 2.6.12 and u161b00.
  - Update SystemTap tapsets to version in IcedTea 2.6.12pre01 to fix RH1492139.
  - Drop 8185716 patch, now applied upstream.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Fix name of SystemTap tarball, following update.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Bump to 2.6.13 and u171b01.
  - Update java-1.7.0-openjdk-java-access-bridge-security.patch to apply after 8186080
  - Update RC4 patch (8076221/PR2809) to apply after 8148108 (DH lower limit increase)
  - Fix file path in rh1022017.patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-1.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-2.b13
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-0.b11
changelog:
  - Update to aarch64-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup tarball creation documentation to avoid duplication.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-0.b15
changelog:
  - Update to aarch64-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking"
  - Resolves: rhbz#1468473


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.161-0.b12
changelog:
  - Update to aarch64-jdk8u161-b12 and aarch64-shenandoah-jdk8u161-b12 (mbalao)
  - Drop upstreamed patches of:
     patch561 8075484-pr3473-rh1490713.patch
     patch532 8162384-pr3122-rh1358661.patch
     patch547 8173941-pr3326.patch
     patch554 8175887-pr3415.patch
     patch550 8180048-pr3411-rh1449870.patch
  - adapted pr3286-no_fp_contract.patch, CFLAGS_linux_ppc64 no longer have -ffp-contract=off so was dropped from hunk
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-1.b12
changelog:
  - Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-2.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-2.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Phillip Lougher <plougher@redhat.com> [2.6.32-690.el6]
changelog:
  - [drm] core: Do not preserve framebuffer on rmfb, v4 (Rob Clark) [1405267]
  - [scsi] mpt3sas: Fix for block device of raid exists even after deleting raid disk (Tomas Henzl) [1416552]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-691.el6]
changelog:
  - [net] tcp: correct memory barrier usage in tcp_check_space() (Oleg Nesterov) [1386136]
  - [fs] epoll: prevent missed events on EPOLL_CTL_MOD (Oleg Nesterov) [1386136]
  - [acpi] acpica: Fix regression in FADT revision checks (Lenny Szubowicz) [1418339]
  - [net] ipv6: stop sending PTB packets for MTU < 1280 (Hannes Frederic Sowa) [1415931] {CVE-2016-10142}
  - [net] fix dst_ops_extend leaks (Sabrina Dubroca) [1399633]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-692.el6]
changelog:
  - [fs] gfs2: Limit number of transaction blocks requested for truncates (Robert S Peterson) [1401058]
  - [fs] revert "sunrpc: make AF_LOCAL connect synchronous" (Benjamin Coddington) [1420044]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-693.el6]
changelog:
  - [netdrv] sfc: Add efx_nic member with fixed netdev features (Jarod Wilson) [1419396]
  - [netdrv] sfc: Take mac_lock before calling efx_ef10_filter_table_probe (Jarod Wilson) [1419396]
  - [netdrv] sfc: Fix VLAN filtering feature if vPort has VLAN_RESTRICT flag (Jarod Wilson) [1419396]
  - [netdrv] sfc: clean fallbacks between promisc/normal in efx_ef10_filter_sync_rx_mode (Jarod Wilson) [1419396]
  - [netdrv] sfc: support cascaded multicast filters (Jarod Wilson) [1419396]
  - [netdrv] sfc: Make failed filter removal less noisy (Jarod Wilson) [1410750]
  - [netdrv] sfc: re-factor efx_ef10_filter_sync_rx_mode() (Jarod Wilson) [1410750]
  - [netdrv] sfc: refactor debug-or-warnings printks (Jarod Wilson) [1410750]
  - [net] implement netif_cond_dbg macro (Jarod Wilson) [1410750]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-694.el6]
changelog:
  - [fs] posix_acl: Clear SGID bit when setting file permissions (Andreas Grunbacher) [1371252] {CVE-2016-7097}
  - [fs] switch posix_acl_equiv_mode() to umode_t * (Andreas Grunbacher) [1371252] {CVE-2016-7097}
  - [perf] sched latency: Fix thread pid reuse issue (Jiri Olsa) [1400743]
  - [fs] ext4: fix races of writeback with punch hole and zero range (Lukas Czerner) [1394786]
  - [fs] ext4: validate s_reserved_gdt_blocks on mount (Lukas Czerner) [1394786]
  - [fs] ext4: release bh in make_indexed_dir (Lukas Czerner) [1394786]
  - [fs] ext4: reinforce check of i_dtime when clearing high fields of uid and gid (Lukas Czerner) [1394786]
  - [fs] ext4: validate that metadata blocks do not overlap superblock (Lukas Czerner) [1394786]
  - [fs] ext4: short-cut orphan cleanup on error (Lukas Czerner) [1394786]
  - [fs] ext4: fix reference counting bug on block allocation error (Lukas Czerner) [1394786]
  - [fs] ext4: check for extents that wrap around (Lukas Czerner) [1394786]
  - [fs] ext4: silence UBSAN in ext4_mb_init() (Lukas Czerner) [1394786]
  - [fs] ext4: address UBSAN warning in mb_find_order_for_block() (Lukas Czerner) [1394786]
  - [fs] ext4: clean up error handling when orphan list is corrupted (Lukas Czerner) [1394786]
  - [fs] ext4: fix hang when processing corrupted orphaned inode list (Lukas Czerner) [1394786]
  - [fs] jbd2: Fix unreclaimed pages after truncate in data=journal mode (Lukas Czerner) [1394786]
  - [fs] ext4: Fix handling of extended tv_sec (Lukas Czerner) [1394786]
  - [fs] create and use seq_show_option for escaping (Lukas Czerner) [1394786]
  - [fs] ext4: replace open coded nofail allocation in ext4_free_blocks() (Lukas Czerner) [1394786]
  - [fs] ext4: Introduce EFSBADCRC and EFSCORRUPTED error codes (Lukas Czerner) [1394786]
  - [block] ensure request->part is valid (Jeff Moyer) [1416341]
  - [sound] alsa: hda - fix Lewisburg audio issue (Jaroslav Kysela) [1413134]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-696.el6]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424628] {CVE-2017-6074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.1.1.el6]
changelog:
  - [block] fix use-after-free in seq file (Denys Vlasenko) [1418548 1418549] {CVE-2016-7910}
  - [firmware] Replacing the chelsio firmware (t4,t5)fw-1.15.37.0 (Sai Vemuri) [1433865 1425749]
  - [kernel] genirq: Avoid taking sparse_irq_lock for non-existent irqs (Dave Wysochanski) [1428106 1360930]
  - [tty] n_hdlc: get rid of racy n_hdlc.tbuf (Herton R. Krzesinski) [1429917 1429918] {CVE-2017-2636}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.2.1.el6]
changelog:
  - [sched] fair: Rework throttle_count sync (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Reorder cgroup creation code (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Initialize throttle_count for new task-groups lazily (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Do not announce throttled next buddy in dequeue_task_fair() (Jiri Olsa) [1436241 1250762]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.3.1.el6]
changelog:
  - [netdrv] be2net: Fix endian issue in logical link config command (Ivan Vecera) [1442979 1436527]
  - [scsi] lpfc: update for rhel6 11.0.0.6 (Maurizio Lombardi) [1439636 1429881]
  - [scsi] lpfc: The lpfc driver does not issue RFF_ID and RFT_ID in the correct sequence (Maurizio Lombardi) [1439636 1429881]
  - [x86] vmalloc_sync: avoid syncing vmalloc area on crashing cpu (Pingfan Liu) [1443499 1146727]
  - [kernel] audit: plug cred memory leak in audit_filter_rules (Richard Guy Briggs) [1443234 1434560]
  - [net] tcp: avoid infinite loop in tcp_splice_read() (Davide Caratti) [1430577 1430578] {CVE-2017-6214}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.4.1.el6]
changelog:
  - [fs] xfs: handle array index overrun in xfs_dir2_leaf_readbuf() (Carlos Maiolino) [1445179 1440361]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.5.1.el6]
changelog:
  - [fs] sunrpc: Ensure that we wait for connections to complete before retrying (Dave Wysochanski) [1450850 1448170]
  - [net] ipv6: check raw payload size correctly in ioctl (Jamie Bainbridge) [1450870 1441909]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.6.1.el6]
changelog:
  - [netdrv] ixgbe: fix setup_fc for x550em (Ken Cox) [1457347 1442030]
  - [fs] nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields) [1449274 1446755] {CVE-2017-7895}
  - [fs] nfsd4: minor NFSv2/v3 write decoding cleanup (J. Bruce Fields) [1449274 1446755] {CVE-2017-7895}
  - [scsi] libfc: quarantine timed out xids (Chris Leech) [1455550 1431440]
  - [fs] nfsv4: fix getacl ERANGE for some ACL buffer sizes (J. Bruce Fields) [1449096 869942]
  - [fs] nfsv4: fix getacl head length estimation (J. Bruce Fields) [1449096 869942]
  - [mm] hugetlb: check for pte NULL pointer in page_check_address() (Herton R. Krzesinski) [1444351 1431508]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.7.1.el6]
changelog:
  - [kernel] audit: acquire creds selectively to reduce atomic op overhead (Paul Moore) [1460164 1454847]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.8.1.el6]
changelog:
  - [fs] sunrpc: Enable the keepalive option for TCP sockets (Dave Wysochanski) [1462094 1458421]
  - [mm] enlarge stack guard gap (Larry Woodman) [1452729 1452730] {CVE-2017-1000364}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.9.1.el6]
changelog:
  - [mm] allow JVM to implement its own stack guard pages (Larry Woodman) [1466667 1464237]
  - [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]
  - Revert: [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.10.1.el6]
changelog:
  - [mm] backport upstream large stack guard patch to RHEL6 (Larry Woodman) [1466667 1464237]
  - Revert: [mm] allow JVM to implement its own stack guard pages (Larry Woodman) [1466667 1464237]
  - Revert: [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]
  - [fs] sunrpc: Handle EADDRNOTAVAIL on connection failures [1472128 1459978]
  - [scsi] scsi_transport_srp: Fix a race condition (Don Dutile) [1462097 1417305]
  - [scsi] scsi_transport_srp: Introduce srp_wait_for_queuecommand() (Don Dutile) [1462097 1417305]
  - [block] make blk_cleanup_queue() wait until request_fn finished (Don Dutile) [1462097 1417305]
  - [s390] kernel: initial cr0 bits (Hendrik Brueckner) [1460194 1445326]
  - [s390] zfcp: do not trace pure benign residual HBA responses at default level (Hendrik Brueckner) [1460193 1421760]
  - [s390] zfcp: fix rport unblock race with LUN recovery (Hendrik Brueckner) [1460190 1421761]
  - [scsi] bnx2fc: fix race condition in bnx2fc_get_host_stats() (Maurizio Lombardi) [1467323 1393672]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-696.10.2.el6]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.12.1.el6]
changelog:
  - [fs] gfs2: clear gl_object when deleting an inode in gfs2_delete_inode (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: clear gl_object if gfs2_create_inode fails (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: set gl_object in inode lookup only after block type check (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: introduce helpers for setting and clearing gl_object (Robert S Peterson) [1479397 1464541]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.13.1.el6]
changelog:
  - [netdv] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() (Stanislaw Gruszka) [1474783 1474782] {CVE-2017-7541}
  - [x86] fix /proc/mtrr with base/size more than 44bits (Jerome Marchand) [1482855 1466530]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.13.2.el6]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}
  - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}
  - [fs] binfmt_elf.c: fix bug in loading of PIE binaries (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.14.1.el6]
changelog:
  - [fs] nfs: don't disconnect open-owner on NFS4ERR_BAD_SEQID (Dave Wysochanski) [1491123 1459636]
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.15.1.el6]
changelog:
  - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}
  - [fs] binfmt_elf.c: fix bug in loading of PIE binaries (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.16.1.el6]
changelog:
  - [net] packet: fix tp_reserve race in packet_set_ring (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [net] packet: fix overflow in check for tp_frame_nr (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [net] packet: fix overflow in check for tp_reserve (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [netdrv] sfc: tx ring can only have 2048 entries for all EF10 NICs (Jarod Wilson) [1498019 1441773]
  - [fs] sunrpc: always treat the invalid cache as unexpired (Thiago Becker) [1497976 1477288]
  - [fs] sunrpc: xpt_auth_cache should be ignored when expired (Thiago Becker) [1497976 1477288]
  - [net] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Davide Caratti) [1488344 1488340] {CVE-2017-14106}
  - [net] tcp: fix 0 divide in __tcp_select_window() (Davide Caratti) [1488344 1488340] {CVE-2017-14106}
  - [scsi] lpfc: fix "integer constant too large" error on 32bit archs (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: version 11.0.1.6 is 11.0.0.6 with no_hba_reset patches (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Vport creation is failing with "Link Down" error (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Fix panic on BFS configuration (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Fix eh_deadline setting for sli3 adapters (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Correct panics with eh_timeout and eh_deadline (Maurizio Lombardi) [1487220 1441169]
  - [net] udp: consistently apply ufo or fragmentation (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}
  - [net] ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}
  - [net] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.17.1.el6]
changelog:
  - [fs] nfsd: reorder nfsd_cache_match to check more powerful discriminators first (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: split DRC global spinlock into per-bucket locks (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: convert num_drc_entries to an atomic_t (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: remove the cache_hash list (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: convert the lru list into a per-bucket thing (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: clean up drc cache in preparation for global spinlock elimination (Thiago Becker) [1509876 1435787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.1.el6]
changelog:
  - [s390] s390/qdio: clear DSCI prior to scanning multiple input queues (Hendrik Brueckner) [1513314 1467962]
  - [net] sctp: do not loose window information if in rwnd_over (Marcelo Leitner) [1514443 1492220]
  - [net] sctp: fix recovering from 0 win with small data chunks (Marcelo Leitner) [1514443 1492220]
  - [s390] zfcp: fix erp_action use-before-initialize in REC action trace (Hendrik Brueckner) [1512425 1497000]
  - [hv] vmbus: Fix error code returned by vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Increase the time between retries in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Raise retry/wait limits in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Reduce the delay between retries in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [scsi] be2iscsi: fix bad extern declaration (Maurizio Lombardi) [1507512 1497152]
  - [kernel] mqueue: fix a use-after-free in sys_mq_notify() (Davide Caratti) [1476122 1476124] {CVE-2017-11176}
  - [net] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (Matteo Croce) [1477008 1477006] {CVE-2017-7542}
  - [net] ipv6: avoid overflow of offset in ip6_find_1stfragopt (Matteo Croce) [1477008 1477006] {CVE-2017-7542}
  - [net] ipv6: Fix leak in ipv6_gso_segment() (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] gre: fix a possible skb leak (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: Check ip6_find_1stfragopt() return value properly (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: Prevent overrun when parsing v6 header options (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.5.el6]
changelog:
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Add back STUFF_RSB to interrupt and error paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: make is_kaiser_pgd reliable (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] revert: mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix pgd freeing in error path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix 32-bit program crash with 64-bit kernel on AMD boxes (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] Remove __cpuinitdata from some data & function (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Remove STUFF_RSB in error and interrupt code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] [kvm] Pad RSB on VM transition (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [security] Add SPEC_CTRL Kconfig option (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] microcode: Share native MSR accessing variants (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] nop: Make the ASM_NOP* macros work from assembly (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu: Clean up and unify the NOP selection infrastructure (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Further simplify the paranoid_exit code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Don't switch to trampoline stack in paranoid_exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Fix typo preventing msr_set/clear_bit from having an effect (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Add another set of MSR accessor functions (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix RESTORE_CR3 crash in kaiser_stop_machine (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: use atomic ops to poison/unpoison user pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: trampoline stack comments (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Check if PUD is large when validating a kernel address (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] Separate out entry text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/const.h: Add _BITUL() and _BITULL() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/mmdebug.h: add VM_WARN_ON() and VM_WARN_ON_ONCE() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] stddef.h: Move offsetofend() from vfio.h to a generic kernel header (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.6.el6]
changelog:
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: __load_cr3 in resume from RAM after kernel %gs has been restored (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: Revert the __GFP_COMP flag change (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.7.el6]
changelog:
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundnat FEATURE Not Present messages (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: enable IBRS and stuff_RSB before calling NMI C code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip CAP_SYS_PTRACE check to skip audit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: disable ibrs while in intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip IBRS/CR3 restore when paranoid exception returns to userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/dump_pagetables: Allow dumping current pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add a pgd argument to walk_pgd_level() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add page table directory (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove unneeded nmi_userspace code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix nmi exit code with CONFIG_TRACE_IRQFLAGS (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Clear kdump pgd page to prevent incorrect behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: consider the init_mm.pgd a kaiser pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: convert userland visible "kpti" name to "pti" (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.19.1.el6]
changelog:
  - [scsi] bnx2fc: Fix hung task messages when a cleanup response is not received during abort (Chad Dupuis) [1523783 1504260]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.20.1.el6]
changelog:
  - [x86] kaiser/efi: unbreak tboot (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] pti/mm: Fix trampoline stack problem with XEN PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] pti/mm: Fix XEN PV boot failure (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundnat FEATURE Not Present messages (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: enable IBRS and stuff_RSB before calling NMI C code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip CAP_SYS_PTRACE check to skip audit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: disable ibrs while in intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip IBRS/CR3 restore when paranoid exception returns to userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/dump_pagetables: Allow dumping current pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add a pgd argument to walk_pgd_level() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add page table directory (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove unneeded nmi_userspace code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix nmi exit code with CONFIG_TRACE_IRQFLAGS (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Clear kdump pgd page to prevent incorrect behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: consider the init_mm.pgd a kaiser pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: convert userland visible "kpti" name to "pti" (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: __load_cr3 in resume from RAM after kernel %gs has been restored (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: Revert the __GFP_COMP flag change (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Add back STUFF_RSB to interrupt and error paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: make is_kaiser_pgd reliable (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] revert: mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix pgd freeing in error path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix 32-bit program crash with 64-bit kernel on AMD boxes (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] Remove __cpuinitdata from some data & function (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Remove STUFF_RSB in error and interrupt code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] [kvm] Pad RSB on VM transition (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [security] Add SPEC_CTRL Kconfig option (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] microcode: Share native MSR accessing variants (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] nop: Make the ASM_NOP* macros work from assembly (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu: Clean up and unify the NOP selection infrastructure (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Further simplify the paranoid_exit code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Don't switch to trampoline stack in paranoid_exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Fix typo preventing msr_set/clear_bit from having an effect (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Add another set of MSR accessor functions (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix RESTORE_CR3 crash in kaiser_stop_machine (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: use atomic ops to poison/unpoison user pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: trampoline stack comments (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Check if PUD is large when validating a kernel address (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] Separate out entry text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/const.h: Add _BITUL() and _BITULL() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/mmdebug.h: add VM_WARN_ON() and VM_WARN_ON_ONCE() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] stddef.h: Move offsetofend() from vfio.h to a generic kernel header (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.21.1.el6]
changelog:
  - [fs] sunrpc: Revert "sunrpc: always treat the invalid cache as unexpired" (Thiago Becker) [1535938 1532786]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.22.1.el6]
changelog:
  - [mm] add cpu_relax() to "dont return 0 too early" patch (Ian Kent) [1527811 988988]
  - [mm] don't return 0 too early from find_get_pages() (Ian Kent) [1527811 988988]
  - [crypto] cryptd: Add cryptd_max_cpu_qlen module parameter (Jon Maxwell) [1527802 1503322]
  - [powerpc] spinlock: add gmb memory barrier (Mauricio Oliveira) [1531720 1538543]
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Mauricio Oliveira) [1531720 1538543]
  - [s390] vtime: turn BP on when going idle (Hendrik Brueckner) [1532733 1538542]
  - [s390] cpuinfo: show facilities as reported by stfle (Hendrik Brueckner) [1532733 1538542]
  - [s390] kconfigs: turn off SHARED_KERNEL support for s390 (Hendrik Brueckner) [1532733 1538542]
  - [s390] add ppa to system call and program check path (Hendrik Brueckner) [1532733 1538542]
  - [s390] spinlock: add gmb memory barrier (Hendrik Brueckner) [1532733 1538542]
  - [s390] introduce CPU alternatives (Hendrik Brueckner) [1532733 1538542]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.23.1.el6]
changelog:
  - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: detect unretpolined modules (Waiman Long) [1543022 1535645]
  - [x86] retpoline/ACPI: Convert indirect jump in wakeup code (Waiman Long) [1543022 1535645]
  - [x86] retpoline/efi: Convert stub indirect calls & jumps (Waiman Long) [1543022 1535645]
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: cleanup __ptrace_may_access (Waiman Long) [1543022 1535645]
  - [x86] bugs: Drop one "mitigation" from dmesg (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Waiman Long) [1543022 1535645]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Update spec_ctrl.txt and kernel-parameters.txt (Waiman Long) [1543022 1535645]
  - [x86] Use IBRS for firmware update path (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Integrate IBRS with retpoline (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: print features changed by microcode loading (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibp_disabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove performance measurements from documentation (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Enable spec_ctrl functions for x86-32 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Waiman Long) [1543022 1535645]
  - [x86] spectre_v1: Mark it as mitigated (Waiman Long) [1543022 1535645]
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1543022 1535645]
  - [x86] mce: Make machine check speculation protected (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Fill return stack buffer on vmexit (Waiman Long) [1543022 1535645]
  - [x86] retpoline/irq32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/checksum32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/entry: Convert entry assembler indirect (Waiman Long) [1543022 1535645]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add initial retpoline support (Waiman Long) [1543022 1535645]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Waiman Long) [1543022 1535645]
  - [base] sysfs/cpu: Add vulnerability folder (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_SPECTRE_V[12] (Waiman Long) [1543022 1535645]
  - [x86] pti: Add the pti= cmdline option and documentation (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_CPU_MELTDOWN (Waiman Long) [1543022 1535645]
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1543022 1535645]
  - [x86] cpu: Expand cpufeature facility to include cpu bugs (Waiman Long) [1543022 1535645]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Waiman Long) [1543022 1535645]
  - [x86] cpu/intel: Introduce macros for Intel family numbers (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add missing '\n' at end of ALTERNATIVE inline asm (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix alt_max_short macro to really be a max() (Waiman Long) [1543022 1535645]
  - [x86] asm: Make asm/alternative.h safe from assembly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Document macros (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix ALTERNATIVE_2 padding generation properly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add instruction padding (Waiman Long) [1543022 1535645]
  - [x86] alternative: Add header guards to <asm/alternative-asm.h> (Waiman Long) [1543022 1535645]
  - [x86] alternative: Use .pushsection/.popsection (Waiman Long) [1543022 1535645]
  - [x86] copy_user_generic: Optimize copy_user_generic with CPU erms feature (Waiman Long) [1543022 1535645]
  - [x86] Make .altinstructions bit size neutral (Waiman Long) [1543022 1535645]
  - [x86] pti: Rework the trampoline stack switching code (Waiman Long) [1543022 1535645]
  - [x86] pti: Disable interrupt before trampoline stack switching (Waiman Long) [1543022 1535645]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.3.2.el6]
changelog:
  - [mm] enlarge stack guard gap (Larry Woodman) [1452729 1452730] {CVE-2017-1000364 CVE-2017-1000366}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.24.1.el6]
changelog:
  - [kernel] sched/core: Rework rq->clock update skips (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Remove useless code in yield_to() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Set skip_clock_update in yield_task_fair() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched, rt: Update rq clock when unthrottling of an otherwise idle CPU (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] lockdep: Fix lock_is_held() on recursion (Lauro Ramos Venancio) [1551475 1212959]
  - [net] bonding: discard lowest hash bit for 802.3ad layer3+4 (Hangbin Liu) [1550103 1532167]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.25.1.el6]
changelog:
  - [net] packet: Allow packets with only a header (but no payload) (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet too small warning match condition (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: bail out of packet_snd() if L2 header creation fails (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet_snd fail on len smaller than l2 header (Lorenzo Bianconi) [1557896 1535024]
  - [net] dccp: use-after-free in DCCP code (Stefano Brivio) [1520818 1520817] {CVE-2017-8824}
  - [fs] nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [1447640 1447641] {CVE-2017-7645}
  - [netdrv] be2net: Fix UE detection logic for BE3 (Ivan Vecera) [1552706 1437991]
  - [x86] skip check for spurious faults for non-present faults (Daniel Vacek) [1551471 1495167]
  - [x86] mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() (Daniel Vacek) [1551471 1495167]
  - [scsi] lpfc: Null pointer dereference when log_verbose is set to 0xffffffff (Dick Kennedy) [1540481 1538340]
  - [mm] prevent concurrent unmap_mapping_range() on the same inode (Miklos Szeredi) [1538654 1408108]
  - [s390] fix transactional execution control register handling (Hendrik Brueckner) [1538591 1520862]
  - [netdrv] bnx2x: prevent crash when accessing PTP with interface down (Michal Schmidt) [1538586 1518669]
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: SYN packets are allowed to contain data (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] bluetooth: Prevent uninitialized data (Gopal Tiwari) [1519627 1519626] {CVE-2017-1000410}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.26.1.el6]
changelog:
  - [s390] qeth: check not more than 16 SBALEs on the completion queue (Hendrik Brueckner) [1557477 1520860]
  - [x86] pti: Disable kaiser_add_mapping if X86_FEATURE_NOPTI (Waiman Long) [1561441 1557562] {CVE-2017-5754}
  - [x86] irq/ioapic: Check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] efi/64: Fix potential PTI data corruption problem (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Fix machine check with PTI on old AMD CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Enable PAGE_GLOBAL if not affected by Meltdown (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] retpoline: Avoid retpolines for built-in __init functions (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/32: Allocate 8k PGD for PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl: Patch out lfence on old 32-bit CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Enable IBRS processing on kernel entries & exits (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Stuff RSB on kernel entry (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/32: Add a PAE specific version of __pti_set_user_pgd (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Support PAE page table dumping (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Use separate kernel PMDs for user page-table (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/pae: Populate valid user PGD entries (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Enable x86-32 for kaiser.c (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Disable PCID handling in x86-32 TLB flushing code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Disable user PGD poisoning for PAE (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move more PTI functions out of pgtable_64.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move pgdp kernel/user conversion functions to pgtable.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/32: Allocate 8k page-tables when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Unshare kernel PMDs when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle debug exception similar to NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switch to non-NMI entry/exit points (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switches to NMI handler code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enable the use of trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Change INT80 to be an interrupt gate (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle Entry from Kernel-Mode on Entry-Stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Leave the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enter the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Restore segments before int registers (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Split off return-to-kernel path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Unshare NMI return path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Put ESPFIX code into a macro (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Rename TSS_sysenter_sp0 to TSS_entry_stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Add X86_FEATURE_NOPTI to permanently disable PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Simplify and fix up the SYSENTER stack #DB/NMI fixup (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] doublefault: Set the right gs register for doublefault (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: int80 must not clobber r12-15 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cve: Make all Meltdown/Spectre percpu variables available to x86-32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.27.1.el6]
changelog:
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1565989 1559386]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1568327 1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1568327 1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1568327 1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1568327 1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1568327 1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1568332 1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1568332 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1568535 1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1568535 1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1568535 1558845]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.28.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1567078 1567079] {CVE-2018-8897}
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1569141 1568241]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.29.1.el6]
changelog:
  - [x86] x86/spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Rename _RDS to _SSBD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/kvm: Expose the RDS bit to the guest (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573176 1572487]


author: Guo Jianxing <jianxing.guo@cs2c.com.cn> [2.6.32-696.30.2.el6]
changelog:
  - add Patch999991-999995, fix CVE-2019-11477 CVE-2019-11478 CVE-2019-11479
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}


author: Baoquan He <bhe@redhat.com> - 2.0.0-301
changelog:
  - mkdumprd: Allow findmodule() to add dependency for lsmod output, resolves bug 1343282
  - mkdumprd: Kill useless code in moduledep(), resolves bug 1343282
  - mkdumprd: skip logical interfaces for bridge, resolves bug 1356615


author: Baoquan He <bhe@redhat.com> - 2.0.0-303
changelog:
  - mkdumprd: Remove load_selinux_policy script, resolves bug 1323086
  - mkdumprd: pass the value of DEV_ID to kdump, resolves bug 1322802


author: Baoquan He <bhe@redhat.com> - 2.0.0-306
changelog:
  - mkdumprd: fix env for mdadm, resolves bug 1404263
  - mkdumprd: create node for partition within RAID device, resolves bug 1404263
  - mkdumprd: refactor block_mknod(), resolves bug 1404263
  - uefi: Pass efi_smbios_addr to 2nd kernel, resolves bug 1404552


author: liuliang1 <liuliang1@kylinos.cnn> - 2.0.0-307.1.ns6.01
changelog:
  - modify SOURCE/firstboot_kdump.py, replace redhat with neokylin of pathes
  - Modify SOURCE/firstboot_kdump.py: fix bug#30510
  - Modify SOURCE/firstboot_kdump.py: modify shown error message for chinesization


author: Baoquan He <bhe@redhat.com> - 2.0.0-299
changelog:
  - mkdumprd: Use a flexible way to create rtc device, resolves bug 1315148
  - hyper-v: do not exclude hv_utils module, resolves bug 1228774


author: Weiping Pan <wpan@redhat.com> 2.0.8 4
changelog:
  - add  .clear_inode callback, fix bug 1157408.
  - rebuild oracleasm for RHEL6.6 in brew, update the version to 2.0.8-4


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-26
changelog:
  - fix segfault when handling a trap (#1117404)
  - closing a file descriptor in a command substitution caused loss of the output (#1116072)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-32
changelog:
  - fix: in a login shell "( cmd & )" does nothing (#1217236)
  - multibyte character string after $1-9 was not expanded correctly (#1256495)
  - case in a for loop inside a subshell caused syntax error (#1241013)


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-36
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1454804


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-6
changelog:
  - Resolves: rhbz#668586 - ding-libs subpackages should have explicit version
  -                         requirements


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-7
changelog:
  - Resolves: rhbz#736074 - dhash can corrupt memory if initial table size is
                            large


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-8
changelog:
  - Fix bad patch
  - Related:  rhbz#736074 - dhash can corrupt memory if initial table size is
                            large


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.0-11
changelog:
  - Do not package built objects in dhash-devel
  - Fix NVR in the previous changelog entry
  - Related: rhbz#1069287 - Rebase ding-libs to latest version in 6.6


author: Michal Zidek <mzidek@redhat.com> - 0.4.0-13
changelog:
  - Resolves: rhbz#1538061 - sssd/libini_config" cannot parse configuration file
                             with line longer than 5102


author: Karel Zak <kzak@redhat.com> 2.17.2-12.26
changelog:
  - fix #1320360 - lscpu shows wrong "Virtualization type" on Xen paravirtualization guest (PV)
  - fix #1319642 - [util-linux-ng] lscpu: Fix model and model name on Power Systems
  - fix #1319642 - [util-linux-ng] lscpu: Fix model and model name on Power Systems
  - fix #1310035 - Hostname not being displayed besides the telnet login prompt
  - fix #1310317 - fdisk -l fdisk double open fd
  - fix #1337478 - wrong error handler and/or error message on fdisk call as not root user


author: Karel Zak <kzak@redhat.com> 2.17.2-12.27
changelog:
  - fix #1349192 - RHEL6.8 util-linux-ng requires 642 kernel, but does not specify it as a dependency
  - fix #1023655 - 'pppd' hangs (uninterruptable) when run on tty


author: jchaloup <jchaloup@redhat.com> - 0.40.rc1-16
changelog:
  - extending cgroup names with default
    resolves: #1139205
  - fixing libcgroup-0.40.rc1-reading-config-files-from-etc-cgconfig.d.patch not to modify patch backup file
    resolves: #1162220


author: Nikola Forró <nforro@redhat.com> - 0.40.rc1-19
changelog:
  - fix loading config files from /etc/cgconfig.d to make it work with libcgroup-pam
    resolves: #1345762


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-49
changelog:
  - Require the matching version of ding-libs
  - Related: rhbz#1374813 - SSSD fails to process GPO from Active Directory.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-50
changelog:
  - Related: rhbz#1369921 - Members of nested netgroups configured in IdM
                            cannot be seen by getent on clients


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-51
changelog:
  - Revert the ding-libs requirement
  - Related: rhbz#1374813 - SSSD fails to process GPO from Active Directory.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-54
changelog:
  - Apply several more smartcard-related patches.
  - Related: rhbz#1300421 - Screen locks and smart card is removed - must
                            show a message to insert the correct smartcard


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-55
changelog:
  - Resolves: rhbz#1415785 - ldap_child does not remove temporary files
                             when it's killed with  SIGTERM


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-56
changelog:
  - Resolves: rhbz#1404697 - SSSD does not skip GPO if no gpcFunctionalityVersion present
  - Resolves: rhbz#1374813 - SSSD fails to process GPO from Active Directory


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-57
changelog:
  - Resolves: rhbz#1473005 - The originalMemberOf attribute disappears from
                             the cache, causing intermittent HBAC issues


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-58
changelog:
  - Resolves: rhbz#1534618 - ABRT crash - /usr/libexec/sssd/sssd_nss
                             [rhel-6.9.z]


author: Paul Wouters <pwouters@redhat.com> - 3.15-5.1
changelog:
  - Resolves: rhbz#1284966 add libreswan to RHEL6 (core)
  - Resolves: rhbz#1288086 /var/run/pluto should have 755 and should have 700


author: Paul Wouters <pwouters@redhat.com> - 3.15-5.2
changelog:
  - Resolves: rhbz#1289498 keyingtries=0 is broken
  - Resolves: rhbz#1166151 Pluto crashes on during 'service ipsec stop'
  - Resolves: rhbz#1216946 IPv6 in RHEL6 fails after reboot
  - Resolves: rhbz#1144462 ikev2 status shows "no tunnels up" while tunnel is up


author: Paul Wouters <pwouters@redhat.com> - 3.15-6
changelog:
  - Resolves: rhbz#1345959 openswan - libreswan migration issues
  - Resolves: rhbz#1360134 libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails
  - Resolves: rhbz#1313709 ipsec pluto returns zero even if it fails [doc change only]
  - Resolves: rhbz#1315415 ipsec.conf manpage does not contain any mention about crl-strict option


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.1
changelog:
  - Resolves: rhbz#1375741 Pluto (libreswan) intermittent abort when ' auto --up --asynchronous' is used
  - Resolves: rhbz#1335896 ipsec initnss/checknss custom directory not recognized


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.2
changelog:
  - Resolves: rhbz#1313843 Prescript warning: Missing control file /var/run/pluto/pluto.ctl
  - Resolves: rhbz#1375741 Pluto (libreswan) intermittent abort [extended patch]
  - Resolves: rhbz#1369990 Libreswan connection sometimes does not get re-established after one side restarts


author: Paul Wouters <pwouters@redhat.com> - 3.15-7.3
changelog:
  - Resolves: rhbz#1403201 pluto uses up available memory and fails with 'unable to popen'
  - Resolves: rhbz#1311360 When IKE rekeys [...] (updated for IKEv1 responder side)


author: Andreas Schneider <asn@redhat.com> - 3.6.23-34
changelog:
  - resolves: #1327697 - Fix netlogon credential checks
  - resolves: #1327746 - Fix dcerpc trailer verificaton


author: Andreas Schneider <asn@redhat.com> - 3.6.23-37
changelog:
  - resolves: #1380151 - Fix memory leak in idmap_ad module
  - resolves: #1333561 - Fix smbclient connection issues to DFS shares
  - resolves: #1372611 - Allow ntlmsssp session key setup without signing
                         (Workaround for broken NetApp and EMC NAS)


author: Andreas Schneider <asn@redhat.com> - 3.6.23-38
changelog:
  - resolves: #1347843 - Fix RPC queryUserList returning NO_MEMORY for
                         empty list


author: Andreas Schneider <asn@redhat.com> - 3.6.23-42
changelog:
  - resolves: #1428835 - Performance issues with vfs_dirsort and extended
                         attributes


author: Andreas Schneider <asn@redhat.com> - 3.6.24-44
changelog:
  - resolves: #1451105 - Fix trusted domain handling in winbind
  - resolves: #1431000 - Fix crash while trying to authenticate with a disabled
                         account
  - resolves: #1467395 - Add 'winbind request timeout' option


author: Kamil Dudka <kdudka@redhat.com> - 1.4.2-3.el6_10.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Steve Dickson <steved@redhat.com> 0.2.1-7
changelog:
  - Fixed some races in getnetconfig code (bz 1031498)
  - Remove the installation of libtirpc.a and libtirpc.la (bz 869397)


author: Steve Dickson <steved@redhat.com> 0.2.1-11
changelog:
  - Backported upstream debugging (bz 1273158)
  - Fixed memory leak in svc_vc_create (bz 1276687)
  - Fixed memory leak in svc_tli_create (bz 1276855)
  - Fixed memory leak in __svc_vc_dodestroy (bz 1276856)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-54
changelog:
  - util: set MAC address for VF via netlink message to PF+VF# when possible (rhbz#1113474)
  - util: set macvtap physdev online when macvtap is set online (rhbz#1113474)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-55
changelog:
  - daemon: Suppress logging of VIR_ERR_NO_DOMAIN_METADATA (rhbz#1260864)
  - Allow <source> for type=block to have no dev (rhbz#1220197)
  - qemu: event: Properly handle spice events (rhbz#1236581)
  - qemu: event: Clean up VNC monitor handling (rhbz#1236581)
  - qemu: split out cpuset.mems setting (rhbz#1263263)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1263263)
  - virNetDev{Replace, Restore}MacAddress: Fix memory leak (rhbz#1251532)
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1251532)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1251532)
  - qemu: fix hotplugging cpus with strict memory pinning (rhbz#1263263)
  - storage: Track successful creation of LV for removal (rhbz#1232170)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-56
changelog:
  - qemu: snapshot: Fix return value of external checkpoint with no disks (rhbz#1292312)
  - qemu: snapshot: Fix modification of vm object without job (rhbz#1290647)
  - virsh-domain: Add --live, --config, --current logic to cmdAttachInterface (rhbz#1229128)
  - RHEL: virsh: remove duplicate --config for 'virsh update-device' (rhbz#1224037)
  - Update ESX driver to always use privateData (rhbz#1213348)
  - esx: Simplify VI (vSphere) API and VMware product version handling (rhbz#1213348)
  - conf: net: Correctly switch how to format address fields (rhbz#1299700)
  - qemu: Refuse to create snapshot of a disk without source (rhbz#1299411)
  - Build all binaries with PIE (rhbz#1242156)
  - Enable full RELRO mode (rhbz#1242156)
  - Don't duplicate compiler warning flags when linking (rhbz#1242156)
  - Simplify RELRO_LDFLAGS (rhbz#1242156)
  - Fix AM_LDFLAGS typo (rhbz#1242156)
  - Pass AM_LDFLAGS to driver modules too (rhbz#1242156)
  - RHEL: Enable RELRO for python modules (rhbz#1242156)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-57
changelog:
  - vmx: Relax virtualHW.version check (rhbz#1300574)
  - qemu: snapshot: Don't leak XML definition and forget to unlock job (rhbz#1305793)
  - qemu: Fix formatting flags in qemuDomainSaveImageOpen (rhbz#1307094)
  - network: Resolve some issues around vlan copying (rhbz#1300843)
  - network: fix connections count in case of allocate failure (rhbz#1300843)
  - network: consolidate connection count updates for device pool (rhbz#1300843)
  - network: consolidated info log for all network allocate/free operations (rhbz#1300843)
  - util: increase libnl buffer size (rhbz#1276478)
  - util: reduce debug log in virPCIGetVirtualFunctions() (rhbz#1276478)
  - util: improve error reporting in virNetDevVPortProfileGetStatus (rhbz#1276478)
  - util: add missing newline (rhbz#1276478)
  - util: eliminate bogus error log in virNetDevVPortProfileGetStatus (rhbz#1276478)
  - util: clean up and expand 802.1QbX negotiation logging (rhbz#1276478)
  - util: report the MAC address that couldn't be set (rhbz#1276478)
  - util: reset MAC address of macvtap passthrough physdev after disassociate (rhbz#1276478)
  - bitmap: add way to find next clear bit (rhbz#1276478)
  - Introduce virBitmapIsBitSet (rhbz#1276478)
  - util: Introduce flags field for macvtap creation (rhbz#1276478)
  - virnetdevmacvlan.c: Introduce mutex for macvlan creation (rhbz#1276478)
  - util: keep/use a bitmap of in-use macvtap devices (rhbz#1276478)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-61
changelog:
  - virsh: Properly display block job type (rhbz#1326653)
  - spec: proper soft static allocation of qemu uid (rhbz#1351792)
  - Revert "qemu: snapshot: Fix modification of vm object without job" (rhbz#1326652)
  - qemu: snapshot: Fix job handling when creating snapshots (rhbz#1326652)
  - tls: remove support for gnutls 1.x.x, require 2.2.0 (rhbz#1333415)
  - configure: allow setting default TLS priority string (rhbz#1333415)
  - rpc: allow priority string to be passed to TLS context (rhbz#1333415)
  - libvirtd: add config option for TLS priority (rhbz#1333415)
  - remote: allow TLS protocol/cipher priority override in URI (rhbz#1333415)
  - Pass config file object through to driver open methods (rhbz#1333415)
  - remote: allow TLS priority to be customized (rhbz#1333415)
  - qemu: -numa doesn't (yet) support disjoint range (rhbz#1310122)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62
changelog:
  - qemu: fix return value of qemuDomainBlockPivot on errors (rhbz#1300159)
  - qemu: Fix virsh freeze when blockcopy storage file is removed (rhbz#1300159)
  - migration: add support for migrateURI configuration (rhbz#1347389)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62.el6_9.1
changelog:
  - util: Implement virFileReadHeaderFD (CVE-2017-5715)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Adam Jackson <ajax@redhat.com> 1.2.2-2
changelog:
  - libvorbis-1.2.2-svn16228.patch: Backport a fix from pre-1.2.3 to hopefully
    fix small sound file playback. (#505610)


author: Ondrej Vasik <ovasik@redhat.com> 0.9.21-14
changelog:
  - texconfig-sys rehash in postun, removal of texhash in post
    and postun(discussed with Jindrich Novy)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-4
changelog:
  - The devel subpackage now properly requires the base package to avoid
    multilib conflicts (#869633)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-6
changelog:
  - Willing SUT retains PFC operational state from peer after peer
    stops transmitting TLV (#870578)
  - Unable to query configured PFC priorities under IEEE DCBX (#870576)


author: Jan Kaluza <jkaluza@redhat.com> 3:2.1.12-20
changelog:
  - fix #745409 - do not set Indexes in httpd configuration for public archive
  - fix #1008139 - fix traceback when list_data_dir is not a child of var_prefix


author: Jan Kaluza <jkaluza@redhat.com> 3:2.1.12-23
changelog:
  - fix #1095359 - handle update when some mailing lists have been created
    by newer Mailman than this one


author: Petr Oros <poros@redhat.com> - 1:1.17-21
changelog:
  - Update microcode data file to 20151106 revision.
  - Resolves: #1244968
  - Remove bad file permissions on /lib/udev/rules.d/89-microcode.rules
  - Resolves: #1201276


author: Petr Oros <poros@redhat.com> - 1:1.17-24
changelog:
  - Update microcode data file to 20161104 revision.
  - Add workaround for E5-26xxv4
  - Resolves: #1346045


author: Petr Oros <poros@redhat.com> - 1:1.17-25.2
changelog:
  - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04
  - Add amd microcode_amd_fam17h.bin data file
  - Resolves: #1527357


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.22
changelog:
  - Update Intel CPU microcode to microcode-20191115 release:
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4
      up to 0xd6;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision
      0xc6 up to 0xca;
    - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6
      up to 0xca;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0b/0x02 (CFL-S B0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0c/0x22 (CFL-S/Xeon E P0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0d/0x22 (CFL-H/S R0) from revision 0xc6 up to 0xca;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) from revision 0xc6 up to 0xca.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.25
changelog:
  - Update Intel CPU microcode to microcode-20200520 release (#1839193):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.26
changelog:
  - Update Intel CPU microcode to microcode-20200602 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795353, #1795357, #1827186):
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.27
changelog:
  - Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision
    0xdc, use 0xd6 by default (#1846134).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.28
changelog:
  - Enable 06-55-04 (SKL-X/W) caveat by default.
  - Enable 06-2d-07 (SNB-E/EN/EP) caveat by default (#1846024).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.29
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826590):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.30
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.31
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893243, #1893238):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode (in microcode.dat)
      at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      microcode.dat) at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode (in
      microcode.dat) at revision 0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      microcode-06-4e-03.dat) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      microcode-06-55-04.dat) from revision 0x2006906 up to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      microcode-06-5e-03.dat) from revision 0xdc up to 0xe2;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      (in microcode.dat) from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode (in microcode.dat)
      from revision 0x1000157 up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode (in microcode.dat)
      from revision 0x4002f01 up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode (in
      microcode.dat) from revision 0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode (in microcode.dat) from
      revision 0x38 up to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode (in microcode.dat)
      from revision 0x16 up to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode (in microcode.dat)
      from revision 0x16 up to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode (in microcode.dat)
      from revision 0x78 up to 0xa0;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode (in microcode.dat)
      from revision 0xca up to 0xe0.


author: Steve Dickson <steved@redhat.com> 1.2.3-67
changelog:
  - mount.nfs: Fix fallback from tcp to udp (bz 1287894)
  - exportfs: escape path for function test_export (bz 735696)
  - nfs-utils.spec: No verification on runtime configuration files (bz 1118176)
  - idmapd: added usage statement (bz 1001439)
  - mountd: fix netgroup lookup for short hostnames (bz 1231998)
  - mountd: fix bug affecting exports of dirs with 64bit inode number (bz 994564)


author: Steve Dickson <steved@redhat.com> 1.2.3-71
changelog:
  - rpc.mountd: set libtirpc nonblocking mode to avoid DO (bz 1301581)
  - nfsidmap: Clean up other exit status cases (bz 1313603)
  - gssd: Fix inner-loop variable reuse (bz 1313090)
  - mount.nfs manpage: Add nfsmount.conf (bz 1302981)
  - nfs.init: Set exit code on restarts (bz 1205055)


author: Steve Dickson <steved@redhat.com> 1.2.3-73
changelog:
  - mountd: fix is_subdirectory to understand '/' (bz 1331207)
  - mount.nfs: Fix for the bug in v1.2.4 that breaks mount.nfs (bz 1208385)
  - mount.nfs: Removed supported flag from usage string (bz 1000990)
  - mountd.man: Update to change -P option as an alias for -p (bz 1037926)
  - exportfs: Deal with path's trailing "/" in unexportfs_parsed() (bz 1276538)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1352856)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200920 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269361 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297891 - Rebase RHEL 6.8 to NSPR 4.11 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-9
changelog:
  - Update fix_multiple_open patch to fix regression in openldap client
  - Remove pk11_genobj_leak patch, which caused crash with Firefox
  - Add comment in the policy file to preserve the last empty line
  - Disable SHA384 ciphersuites when CKM_TLS12_KEY_AND_MAC_DERIVE is not
    provided by softoken; this superseds check_hash_impl patch


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-10
changelog:
  - Add patch to fix SSL CA name leaks, taken from NSS 3.27.2 release
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Add patch to remove duplicate ciphersuites entries in sslinfo.c
  - Add patch to abort selfserv/strsclnt/tstclnt on non-parsable version range
  - Build with support for SSLKEYLOGFILE


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-11
changelog:
  - Adjust the sslstress.txt filename so that it matches with the
    disableSSL2tests patch ported from RHEL 7
  - Exclude SHA384 and CHACHA20_POLY1305 ciphersuites from stress tests
  - Don't add gtests and ssl_gtests to nss_tests, unless gtests are enabled


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-1
changelog:
  - Rebase to 3.28.3
  - Remove upstreamed moz-1282627-rh-1294606.patch,
    moz-1312141-rh-1387811.patch, moz-1315936.patch, and
    moz-1318561.patch
  - Remove no longer necessary nss-duplicate-ciphers.patch
  - Disable X25519 and exclude tests using it
  - Catch failed ASN1 decoding of RSA keys, by Kamil Dudka (#1427481)


author: Jinshuaiyu <jinshuaiyu@kylinos.cn> - 3.28.4-4.ns6.01
changelog:
  - Add modify at check ,fix failed:SSL_ERROR_BAD_CERT_ALERT: SSL peer cannot verify your certificate.


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.26.0
  - Remove upstreamed patch for CVE-2016-1950
  - Remove p-disable-md5-590364-reversed.patch for bug 1335915


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - add option to set Differentiated Services Code Point (DSCP) (#1228314)
  - extend rawstats log (#1242895)
  - fix resetting of leap status (#1243034)
  - report clock state changes related to leap seconds (#1242937)
  - allow -4/-6 on restrict lines with mask (#1232146)
  - retry joining multicast groups (#1288534)
  - explain synchronised state in ntpstat man page (#1286969)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10
changelog:
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-11
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12.el6_9.1
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-114
changelog:
  - pam_ssh_agent_auth: Provide authorized_keys_command= feature (#1299555)
  - CVE-2016-1908: Prevent possible fallback from untrusted X11 forwarding (#1299048)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-116
changelog:
  - Restore functionallity of pam_ssh_agent_auth in FIPS mode (#1278315)
  - Initialize devices_done variable for challenge response (#1281468)
  - Update behaviour of X11 forwarding to match upstream (#1299048)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-119
changelog:
  - Resolve sftp force permission colision with umask (#1341747)
  - Relax bits needed check to allow hmac-sha2-512 with gss-group1-sha1- (#1353359)
  - close ControlPersist background process stderr when not in debug mode (#1335539)
  - Do not add a message "The agent has no identities." in ~/.ssh/authorized_keys (#1353410)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-120
changelog:
  - Prevent infinite loop when Ctrl+Z pressed at password prompt (#1218424)
  - Remove RC4 cipher and MD5 based MAC from the default client proposal (#1373836)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-122
changelog:
  - Allow to use ibmca crypto hardware (#1397547)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (1405374)


author: Tim Waugh <twaugh@redhat.com> 2.6-1
changelog:
  - 2.6.  No longer need stderr, suffix, stripcr, parse, allow-spaces,
    ifdef, program_name, or posix-backup patches.


author: Tim Waugh <twaugh@redhat.com> 2.6-2
changelog:
  - Applied upstream patch to prevent incorrect filename being chosen
    when adding a new file (bug #550319).


author: Petr Pisar <ppisar@redhat.com> - 10.21-12
changelog:
  - Fix compiling a class with UCP and without UTF
  - Fix an out-of-bound read in pcre2test tool within POSIX mode
    (upstream bug #2008)


author: Petr Pisar <ppisar@redhat.com> - 10.21-14
changelog:
  - Handle memmory allocation failures in pcre2test tool
  - Fix CVE-2017-7186 (a crash when finding a Unicode property for a character
    with a code point greater than 0x10ffff in UTF-32 library while UTF mode is
    disabled) (upstream bug #2052)


author: Petr Pisar <ppisar@redhat.com> - 10.21-16
changelog:
  - Close serialization file in pcre2test after any error (upstream bug #2074)
  - Fix a potential NULL dereference in pcre2_callout_enumerate() if called with
    a NULL pattern pointer when Unicode support is available (upstream bug #2076)


author: Petr Pisar <ppisar@redhat.com> - 10.21-17
changelog:
  - Fix DFA match for a possessively repeated character class (upstream bug #2086)
  - Use a memory allocator from the pattern if no context is supplied to
    pcre2_match()


author: Petr Pisar <ppisar@redhat.com> - 10.21-18
changelog:
  - Fix CVE-2017-7186 in JIT mode (a crash when finding a Unicode property for
    a character with a code point greater than 0x10ffff in UTF-32 library while
    UTF mode is disabled) (bug #1434504)
  - Fix an incorrect cast in UTF validation (upstream bug #2090)


author: Petr Pisar <ppisar@redhat.com> - 10.21-19
changelog:
  - Fix DFA matching a lookbehind assertion that has a zero-length branch
    (PCRE2 oss-fuzz issue 1859)
  - Fix returned offsets from regexec() when REG_STARTEND is used with starting offset
    greater than zero (upstream bug #2128)


author: Ralf Corsépius <corsepiu@fedoraproject.org> - 1.23-3
changelog:
  - Unconditionally BR: perl(Test::CPAN::Meta).
  - Adjust minimum perl version in META.yml (Add Class-Inspector-1.23.diff).


author: Paul Howarth <paul@city-fan.org> 1.119-3
changelog:
  - use full paths for all commands used in build
  - use search.cpan.org download URL
  - assume rpm knows about %check and %{perl_vendorlib}
  - cosmetic spec file changes


author: Paul Howarth <paul@city-fan.org> 2.110-3
changelog:
  - use search.cpan.org download URL
  - use full paths for all commands used in build
  - assume rpm knows about %check and %{perl_vendorlib}
  - cosmetic spec file changes


author: Lubomir Rintel <lkundrak@v3.sk> - 0.710.08-1
changelog:
  - New upstream release
  - Enable tests
  - Include examples in documentation
  - Don't grab in dependencies of exotic transports (for the sake
    of consistency with existing practice of Jabber transport)


author: Michael Schwendt <mschwendt@fedoraproject.org> - 0.710.08-3
changelog:
  - Filter out perl(LWP::Protocol) Provides, which comes from a file
    not stored in Perl's search path for modules (#472359).


author: Marcela Mašláňová <mmaslano@redhat.com> - 0.710.10-3
changelog:
  - if ENV(MOD_PERL) is defined, then standard read insted of sysread must
    be used.
  - Resolves: rhbz#748376


author: Miloslav Trmač <mitr@redhat.com> - 0.96-6
changelog:
  - Use real --help text and error messages instead of showing a man page in
    pkaction and pkcheck.  Fix description of (pkaction --action-id) in the man 
    page.
    Resolves: #628862
  - Add support for Identity=default in .pkla files
    Resolves: #812684
  - Use a consistent order for .pkla files within a directory.  Based on a patch
    by Jared Jennings <jared.jennings.ctr@eglin.af.mil>.
    Resolves: #864613
  - Build using PIE and relro
    Resolves: #927406


author: Marek Kasik <mkasik@redhat.com> - 0.12.4-4
changelog:
  - Add poppler-0.12.4-CVE-2010-3702.patch
      (Properly initialize parser)
  - Add poppler-0.12.4-CVE-2010-3703.patch
      (Properly initialize stack)
  - Add poppler-0.12.4-CVE-2010-3704.patch
      (Fix crash in broken pdf (code < 0))
  - Resolves: #639860


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852021


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017837)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065843) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-7
changelog:
  - backport PGSTARTTIMEOUT variable from latest RHSCL while reasonably
    changing wait timeout to 2 seconds by default


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-6
changelog:
  - don't require logrotate (#922769)
  - move pppd database to /var/run/ppp to prevent SELinux AVCs (#968398)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-7
changelog:
  - ignore unrecognised radiusclient configuration directives (#906912)
  - add missing l2tp support (#815128)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-8
changelog:
  - prevent running into issues caused by undefined behavior (pointers of incompatible types aliasing the same object)


author: Jan Rybar <jrybar@redhat.com> - 3.2.8-43
changelog:
  - Rework of patch 91 from 3.2.8-37, stripping removed permanently, no new option
  - Resolves: rhbz#1322111


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.2
changelog:
  - fix integer overflows leading to heap overflow in file2strvec()
  - Resolves: CVE-2018-1124 CVE-2018-1126


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.3
changelog:
  - drop leftover assignment in fix for CVE-2018-1124 causing a severe regression
  - Resolves: CVE-2018-1124


author: Robert Kuska <rkuska@redhat.com> - 2.6.6-59
changelog:
  - Let ConfigParse handle options without values
  - Add check phase to specfile, fix and skip relevant failing tests
  Resolves: rhbz#1031709


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-63
changelog:
  - Since -libs now provide python-ordered dict, added ordereddict
    dist-info to site-packages
  Resolves: rhbz#1199997


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346355


author: Cleber Rosa <cleber@redhat.com> - 2.1.0-2
changelog:
  - Patched setup.py to use Crypto21 module name from the start
  - This removed the need for the rename after the build and installation
  - Enabled the check target


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.1-1
changelog:
  - Update to 2.1, which fixes a number of bugs.
    See http://jinja.pocoo.org/2/documentation/changelog#version-2-1.


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.2.1-1
changelog:
  - Update to 2.2.1, mainly a bugfix release.
  - Remove patch no longer needed.
  - Remove conditional for FC-8.
  - Compilation of speedup module has to be explicitly requested now.


author: Miro Hrončok <mhroncok@redhat.com> - 2.2.1-3
changelog:
  - Require python-setuptools, otherwise jinja2.__version__ evaluates to "unknown"
  Resolves: rhbz#1121241


author: Konstantin Ryabitsev <icon@fedoraproject.org> - 0.9.4-2
changelog:
  - Add hotfix for broken py-def (#220843)
  - Simplify kid and kidc to not require setuptools to run (#220844)


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.5-1
changelog:
  - v1.7.5 (Ernest) 19jul09
  - -----------------------
  -  * added support for ARC4 cipher and CTR block chaining (Denis Bernard)
  -  * made transport threads daemonize, to fix python 2.6 atexit behavior
  -  * support unicode hostnames, and IP6 addresses (Maxime Ripard, Shikhar
  -    Bhushan)
  -  * various small bug fixes


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server mode
    (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 1.10: https://gist.github.com/stevebeattie/0eb190004e10ba0926ad8782f89676ad
    Resolves #1557140


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-4
changelog:
  - Fix and enable tests (%check).
  - Backport a change which makes tests exit with nonzero status when they fail.
  - Add a fix for upstream tests for CVE-2018-7750 (broken in previous).


author: Cleber Rosa <cleber@redhat.com> - 1.10.1-2
changelog:
  - Added patch to update FSF address change
  - Updated patch that renames the module to paramiko110, including
    setup.py and tests
  - Enabled check target
  - Added patch that disables the Key Exchange tests as these are
    incompatible with the backported and required python-crypto 2.1
  - Removed unnecessary cleanup of the buildroot
  - Removed buildroot definition
  - Removed clean section


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-1
changelog:
  - Switch over to using the "distribute" project; rebase to 0.6.10 (rhbz:570350)
  - Remove svn patch as upstream has chosen to go with an easier change for now.
  - Move easy_install back into the main package as the needed files have been
    moved from python-devel to the main python package.


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-2
changelog:
  - delete stray ".orig" file
  - change %define to %global ; use %{buildroot} rather than env var
  - move %check lower down
  - explicitly list executables


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-3
changelog:
  - cherrypick upstream patch for easy_install (ignore locally installed
  packages: patch0)
  - provide "python-distribute"
  - add README.txt and other .txt documentation files to the payload
  Resolves: rhbz#613138


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.497.el6
changelog:
  - kvm-vmstate-fix-breakage-by-7e72abc382b700a72549e8147bde.patch [bz#1294941]
  - Resolves: bz#1294941
    (QEMU crash on snapshot revert when using Cirrus)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.498.el6
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1392520]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1392520]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1392520]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1392520]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1392520]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1392520]
  - kvm-PATCH-1-4-e1000-pre-initialize-RAH-RAL-registers.patch [bz#1300626]
  - kvm-net-update-nic-info-during-device-reset.patch [bz#1300626]
  - kvm-net-e1000-update-network-information-when-macaddr-is.patch [bz#1300626]
  - kvm-net-rtl8139-update-network-information-when-macaddr-.patch [bz#1300626]
  - Resolves: bz#1300626
    (e1000/rtl8139: qemu mac address can not be changed via set the hardware address in guest)
  - Resolves: bz#1392520
    ([RHEL6.9] KVM guest shuts itself down after 128th reboot)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.499.el6
changelog:
  - kvm-rename-qemu_aio_context-to-match-upstream.patch [bz#876993]
  - kvm-block-stop-relying-on-io_flush-in-bdrv_drain_all.patch [bz#876993]
  - kvm-block-add-bdrv_drain.patch [bz#876993]
  - kvm-block-avoid-very-long-pauses-at-the-end-of-mirroring.patch [bz#876993]
  - Resolves: bz#876993
    (qemu-kvm: vm's become non-responsive during migrate disk load from 2 domains to a 3ed)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.500.el6
changelog:
  - kvm-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Disable-086.patch [bz#1405882]
  - kvm-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-iotests-Use-_img_info.patch [bz#1405882]
  - Resolves: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.501.el6
changelog:
  - kvm-Revert-iotests-Use-_img_info.patch [bz#1405882]
  - kvm-Revert-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-Revert-iotests-Disable-086.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-Revert-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-Revert-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-net-check-packet-payload-length.patch [bz#1398214]
  - Resolves: bz#1398214
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-6.9])
  - Reverts: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.502.el6
changelog:
  - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop.patch [bz#1418231 bz#1419417]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418231 bz#1419417]
  - Resolves: bz#1418231
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])
  - Resolves: bz#1419417
    (CVE-2017-2615 qemu-kvm-rhev: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420487 bz#1420489]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420487 bz#1420489]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420487 bz#1420489]
  - Resolves: bz#1420487
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])
  - Resolves: bz#1420489
    (EMBARGOED CVE-2017-2620 qemu-kvm-rhev: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.1
changelog:
  - kvm-vns-tls-don-t-use-depricated-gnutls-functions.patch [bz#1428750]
  - kvm-vnc-apply-display-size-limits.patch [bz#1400438 bz#1425943]
  - Resolves: bz#1400438
    (qemu-kvm coredump in vnc_refresh_server_surface [rhel-6.9.z])
  - Resolves: bz#1425943
    (CVE-2017-2633 qemu-kvm-rhev: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.9.z])
  - Resolves: bz#1428750
    (Fails to build in brew)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.2
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1443447 bz#1443449]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1443447 bz#1443449]
  - Resolves: bz#1443447
    (CVE-2017-7718 qemu-kvm: Qemu: display: cirrus: OOB read access issue [rhel-6.9.z])
  - Resolves: bz#1443449
    (CVE-2017-7718 qemu-kvm-rhev: Qemu: display: cirrus: OOB read access issue [rhel-6.9.z])
  - Resolves: bz#1447544
    (CVE-2016-9603 qemu-kvm-rhev: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.9.z] )
  - Resolves: bz#1447540
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.9.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.3
changelog:
  - kvm-cirrus-avoid-write-only-variables.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-fix-PUTPIXEL-macro.patch [bz#1444377 bz#1444379]
  - Resolves: bz#1444377
    (CVE-2017-7980 qemu-kvm: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.9.z])
  - Resolves: bz#1444379
    (CVE-2017-7980 qemu-kvm-rhev: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.9.z])


author: Steve Dickson <steved@redhat.com> - 0.2.0-10
changelog:
  - Make is_loopback check more permissive (bz 731542)
  - Removed the rpcbind(3) reference in the man page (bz 813898)


author: Adam Tkac <atkac redhat com> - 0.17-60
changelog:
  - merge review related fixes (#226379)
  - remove unused patches
    - netkit-rsh-0.16-pamfix.patch
    - netkit-rsh-0.16-jbj2.patch
    - netkit-rsh-0.16-jbj3.patch


author: Michal Ruprich <mruprich@redhat.com> - 0.17-64.1
changelog:
  - Resolves: #1450821 - rlogin fails to connect rsh-server after updating util-linux-ng from version 2.17.2-12.18.el6 to 2.17.2-12.24.el6


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-8
changelog:
  - Synchronize patches for Samba 4.2.10 with RHEL 7.2.z
  - Resolves: #1383685 - Update samba4 to be on par with RHEL 7.2.z


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-20
changelog:
  - register and deregister: if there is an error registering or deregistering
    one or more collection, skip it but return non-zero return code
  - fix the problem with metapackage dependencies when BuildArch is specified


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-21
changelog:
  - fix an obscure segfault when listing collections on i386
  - fix registration to work with slash-ended paths
  - add the %scl_dependency_generators macro
  - drop recursive ownership of /usr/lib within SCL root


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-22
changelog:
  - Add execution of register and deregister scripts during registration
    and deregistration if they exist.
  - Add capability to make collection nfs mountable using macro nfsmountable.
  - removed the dependency generators and all related changes
    (maintainers' demands)


author: Lubos Kardos <lkardos@redhat.com - 20120927-23
changelog:
  - Modified paths of state and conf files
  - Add owning and creating of state and conf files if nfsmountable is defined
  - Add printing file names in error messages


author: Lubos Kardos <lkardos@redhat.com> - 20120927-25
changelog:
  - Creating filelist in build subdirectory instead of build directory.
  - Removing filelist before build.


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-301
changelog:
  - Allow hald_t to read nvme devices.
  Resolves: rhbz#1389982
  - Allow ftpdctl_t domain to manage own sockets
  Resolves: rhbz#1392525


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-302
changelog:
  - Label /var/lock/kdump as kdump_lock_t.
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-303
changelog:
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565
  - Allow guest-set-user-passwd to set users password
  Resolves: rhbz#1369699


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-304
changelog:
  - Allow _java_t domain to read systemd state.
  Resolves:rhbz#1393938
  - Allow kdumpgui to read/write to nvme filesystem.
  Resolves:rhbz#1323293


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-305
changelog:
  - Fix typo bug sepgsql_contexts file
  Resolves: rhbz#1397703
  - Allow sssd_t domain to manage samba files and dirs.
  Resolves: rhbz#1395403
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1397117
  - Allow consolekit_t domain to manage consolekit_log_t dirs
  Resolves: rhbz#1397802


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-306
changelog:
  - Allow hostname_t domain to manage cluster_tmp_t files
  Resolves: rhbz#1400234
  - Allow ipsec_mgmt_t domain use nsswitch
  Resolves:rhbz#1401611
  - Allow conman_t domain to list conman_uconfined_script_exec_t dirs.
  Resolves:rhbz#1397117


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-307
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1404152
  - Label /usr/bin/puppet* binaries as puppet_exec_t
  Resolves: rhbz#1386181


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-307.1
changelog:
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  Resolves: rhbz#1462824
  - Disable mysqld_safe_t secure mode environment cleansing.
  Resolves: rhbz#1464145


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-300
changelog:
  - Allow sblim_reposd_t domain to read cert_f files
  Resolves:rhbz#1392382
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1392406


author: Adrian Reber <adrian@lisas.de> - 3.1.6-1
changelog:
  - updated to 3.1.6
  - removed buildroot and clean section
  - fixed "missing c++ source language detection for .cxx extension" (#728311)
  - fixed "source-highlight : Conflicts with autoconf-archive" (#797794)


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - fixed ldap's and sssd's sudoOption value and remove quotes
    - fixed ldap's and sssd's sudoOption whitespaces parse problem
    Resolves: rhbz#1144422
    Resolves: rhbz#1279447


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - search also by user id when fetching rules from LDAP
    Resolves: rhbz#1135531


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-22
changelog:
  - RHEL-6.8 erratum
    - fixed potential getcwd failure, resulting in Null pointer exception 
    Resolves: rhbz#1284886


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-23
changelog:
  - RHEL-6.8 erratum
    - fixed handling of closefrom_override defaults option
    Resolves: rhbz#1309976


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-24
changelog:
  - RHEL-6.8 erratum
    - fixed a bug causing that non-root users can list privileges of
      other users
    Resolves: rhbz#1312481


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-25
changelog:
  - RHEL-6.9 erratum
    - Fix "sudo -l command" in the LDAP and SSS backends when the command
      is not allowed.
    Resolves: rhbz#1374410
    - Fix sudo log file wrong group ownership
    Resolves: rhbz#1330001
    - Fix sudo parsing sudoers with user's locale
    Resolves: rhbz#1318374


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-26
changelog:
  - RHEL-6.9 erratum
    - Fix race condition when creating /var/log/sudo-io direcotry
    Resolves: rhbz#1365156


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-25
changelog:
  - related: #921612
    reverted the boundary when the sa data files are stored in directories
    and default history value back to 28. Without the revert, backward
    compatibility could be broken in some cases.


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-26
changelog:
  - resolves: #1110851
    added sysstat(5) man page describing /etc/sysconfig/sysstat file
  - resolves: #1102603
    added possibility to set compress method in /etc/sysconfig/sysstat file


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-27
changelog:
  - resolves: #1124180
    added workaround for dyn-tick kernel feature which makes /proc/stat file
    unreliable under certain circumstances


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-28
changelog:
  - resolves: #1224878
    fixed bug when pidstat could run out of pre-allocated space for PIDs
  - resolves: #887231
    fixed segfaults on bogus localtime input
  - resolves: #1185057
    added two new columns to iostat: r_await and w_await
  - resolves: #1188612
    fixed description of %util field in sar(1) and iostat(1) man pages


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-31
changelog:
  - related: #1224878
    in some corner cases, pidstat could still output values for % CPU bigger
    than 100; this commit fixes the issue


author: Michal Sekletar <msekleta@redhat.com> - 9.0.4-32
changelog:
  - cifsiostat: report correct number of open/closed files (#1346844)
  - sar: output timestamps when running with ko_KR.UTF-8 locale (#1363947)


author: Radek Novacek <rnovacek@redhat.com> - 2.4.3-4
changelog:
  - Changed licence from GPL+ to GPLv2
  - Fixed mixed tabs and spaces in specfile
  - Add %post and %postun sections for libs subpackage


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-96
changelog:
  - Resolves: rhbz#1327238 rpm -V tomcat6 fails due on /var/log/tomcat6/catalina.out
  - Resolves: rhbz#1347778 The security manager doesn't work correctly


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-97
changelog:
  - Resolves: rhbz#1367052 CVE-2015-5174 tomcat6: tomcat: URL Normalization issue
  - Resolves: rhbz#1367057 CVE-2016-0706 tomcat6: tomcat: directory disclosure
  - Resolves: rhbz#1367059 CVE-2016-0714 Security Manager bypass via persistence mechanisms
  - Resolves: rhbz#1367055 CVE-2015-5345 Directory disclosure


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-98
changelog:
  - Resolves: rhbz#1362211 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368120 CVE-2016-6325 tomcat6: tomcat: tomcat writable config files allow privilege escalation


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-100
changelog:
  - Resolves: rhbz#1413588 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402665 CVE-2016-6816 tomcat6: tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
  - Resolves: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update


author: Tomas Hoger <thoger@redhat.com> 0:6.0.24-105
changelog:
  - Sync with 6.8 - add CVE-2016-6816 follow-up patches and revert unreleased fixes.
  - Related: rhbz#1397484 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-encoded characters
  - Related: rhbz#1397484 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816
  - Reverts: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update
  - Reverts: rhbz#1347778 The security manager doesn't work correctly


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-106
changelog:
  - Resolves: rhbz#1441478 CVE-2017-5647 tomcat6: tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-110
changelog:
  - Resolves: rhbz#1461292 CVE-2017-5664 tomcat6: tomcat: Security constrained bypass in error page mechanism


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST. (BZ #1425222)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1427694)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018.
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Tomas Hozza <thozza@redhat.com> - 1.4.20-20
changelog:
  - Install tmpfiles configuration into /usr/lib/tmpfiles.d (#1180995)
  - Fix root key management to comply to RFC5011 (#1180267)


author: Petr Menšík <pemensik@redhat.com> - 1.4.20-23.4
changelog:
  - Update trust anchors (#1458345)
  - Update managed keys from trigger
  - Fix periodic updates of root.key


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-5.2
changelog:
  - 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline
  - fix spec warnings about expanding macros


author: Dan Williams <dcbw@redhat.com> - 1:0.7.3-4
changelog:
  - Fix issues with Opportunistic/Proactive Key Caching (OKC) (rh #813579)
  - Be less aggressive when choosing to roam (rh #837402)
  - Don't install manpage for wpa_gui (rh #672976)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.7.3-5
changelog:
  - Add domain_match config option from upstream (rh #1186806) (rh #1178263)
  - Include peer certificate in EAP events for use by clients
  - Add dbus signal for information about server certification
  - eapol_test: Add option for writing server certificate chain to a file


author: Lubomir Rintel <lrintel@redhat.com> - 1:0.7.3-8
changelog:
  - Enable syslog logging support (rh #822128)
  - Support run-time rotation the debug log file (rh #908306)
  - Fix scriptlet dependencies (rh #712848)
  - Enable timestampes in logs (rh #1150004)


author: Davide Caratti <dcaratti@redhat.com> - 1:0.7.3-9.1
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082)


author: Ville Skyttä <ville.skytta at iki.fi> - 1.0-20020801.1
changelog:
  - Major spec file rewrite (#226559), most visible changes:
  - Various XML cataloguing improvements.
  - Register to SGML catalogs in addition to XML.
  - Install to %{_datadir}/xml per the FHS.
  - Sync with Fedora packaging guidelines.
  - Silence post-install scriptlet.


author: Lyude Paul <cpaul@redhat.com> 7.6.1-2
changelog:
  - Fix annoying trailing whitespace after %description
  - Update firmware license
  - Added missing firmware file TAHITI_vce.bin (#1310823)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.17.4-18
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872388), CVE-2020-14346 (#1872392),
    CVE-2020-14361 (#1872399), CVE-2020-14362 (#1872406)


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-33
changelog:
  - Fix yum-security manpage.
  - Resolves: bug#865694
  - Resolves: bug#1208155
  - Add libxml2-python to Requires for repo-rss.
  - Resolves: bug#1155093
  - yumdownloader: fix description of --archlist in the manpage.
  - Resolves: bug#1165661
  - Add missing options to reposync manpage.
  - Resolves: bug#1189033
  - Exclude dups from the list of security updates.
  - Resolves: bug#1209212
  - yum-config-manager: update config file specified using -c option.
  - Resolves: bug#1225753
  - yum-config-manager: require \* syntax to disable all repos.
  - Resolves: bug#1225754
  - Remove -v from repoquery man page.
  - Resolves: bug#1285748


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-34
changelog:
  - Fix 'updateinfo list available' logic and make 'updates' the default.
  - Resolves: bug#1144887
  - Fix updateinfo to exclude wrong arch updates.
  - Resolves: bug#1191313


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-36
changelog:
  - Fix performance issue when excluding dups from the list of security updates.
  - Related: bug#1209212


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-38
changelog:
  - Fix count of applicable security updates.
  - Resolves: bug#1347813
  - auto-update-debuginfo: fix check for repos in opts.
  - Resolves: bug#1293982
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1313574
  - repoquery: fix --pkgnarrow=installed.
  - Resolves: bug#1280453


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-39
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1272025
  - Update yum-verify man page.
  - Related: bug#1347813


