# changelog

author: gaoxingwang<gaoxingwang1@huawei.com> - 1:1.32.12-16
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add macro firewalld_zone to fix firewalld error about nm-shared.xml


author: gaoxingwang<gaoxingwang1@huawei.com> - 1:1.32.12-20
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:revert support for Aliyun in nm-cloud-setup for hard-coded ip


author: wangyue <wangyue92@huawei.com> - 2.2.0-19
changelog:
  - fix CVE-2021-3474 CVE-2021-3477 CVE-2021-3476 CVE-2021-3475 CVE-2021-20296 CVE-2021-3479 CVE-2021-20296


author: yaoxin <yaoxin30@huawei.com> - 2.2.0-22
changelog:
  - fix CVE-2020-11758 CVE-2020-11759 CVE-2020-11760 CVE-2020-11761 CVE-2020-11762 CVE-2020-11763 CVE-2020-11764 CVE-2020-11765 CVE-2020-15305 CVE-2020-15306


author: shixuantong <shixuantong1@huawei.com> - 1.0.2-34
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix period task some bugs
         fix env_file and environ_conf


author: shixuantong <shixuantong1@huawei.com> - 1.0.2-35
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix cpu_sentry result when found_fault_cores_number != isolated_cores_number


author: shixuantong <shixuantong1@h-partners.com> - 1.0.2-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:add NONZERO_EXITED status for plugin exited with non-zero
         fix process exit status and service kill mode


author: majianhan <majianhan@kylinos.cn> - 5.2.4-13
changelog:
  - Type:CVE
  - CVE:CVE-2025-2752 CVE-2025-2754 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204
  - SUG:NA
  - DESC:fix CVE-2025-2752 CVE-2025-2754 CVE-2025-2755 CVE-2025-2756 CVE-2025-5200 CVE-2025-5201 CVE-2025-5202 CVE-2025-5203 CVE-2025-5204


author: shixuantong<shixuantong@huawei.com> - 0.3.6-25
changelog:
  - Type:cves
  - ID:CVE-2017-6828 CVE-2017-6829 CVE-2017-6831 CVE-2017-6838 CVE-2017-6839
  - SUG:NA
  - DESC:fix CVE-2017-6828 CVE-2017-6829 CVE-2017-6831 CVE-2017-6838 CVE-2017-6839


author: houhongxun <houhongxun@kylinos.cn> - 0.8-20.p01
changelog:
  - Type: cves
  - ID  : [Task#587809][Task#601951][Task#605355]
  - SUG : NA
  - DESC: fix CVE-2025-68471 CVE-2025-68468 CVE-2025-68276 CVE-2026-24401
          CVE-2024-52615 CVE-2024-52616 CVE-2026-34933 CNNVD-2026-79938149


author: yeqinglong <yeqinglong@kylinsec.com.cn> - 2.37-24
changelog:
  - DESC:Add sw_64 support
  - DESC:Add LoongArch support
  - DESC:Fix LoongArch PLT entry generate bug
  - DESC:Add .equ support for LoongArch and fix some bugs


author: Funda Wang <fundawang@yeah.net> - 2.37-31
changelog:
  - Fix CVE-2024-57360: nm: Avoid potential segmentation fault when displaying
    symbols without version info.
  - Fix CVE-2025-0840: stack-buffer-overflow at objdump disassemble_bytes


author: pengxu <pengxu@kylinos.cn> - 2.37-32.p01
changelog:
  - Type:cves
  - ID:CVE-2025-11082 CVE:2025-11083 CVE:2025-11412 CVE:2025-11494 CVE:2025-11840 CVE-2025-5244 CVE-2025-5245 CVE-2025-7545 CVE-2025-8225 CVE-2026-6846
  - SUG:NA
  - DESC:Fix CVE-2025-11082:Fixed an out-of-bounds read during .eh_frame parsing in elf-eh-frame.c
         CVE:2025-11083:Fixed a linker crash due to malformed section headers in elfcode.h
         CVE:2025-11412:Fixed a segmentation fault in bfd_elf_gc_record_vtentry in elflink.c
         CVE:2025-11494:Fixed incorrect discarding of the _GLOBAL_OFFSET_TABLE_ symbol in x86 linkers
         CVE:2025-11840:Fixed a segmentation fault in coffcode.h
         CVE-2025-5244:Fixed a segmentation fault in elf_gc_sweep in elflink.c
         CVE-2025-5245:Debug nullpointer protection
         CVE-2025-7545:Fixed incorrect output section size expansion in copy_section in objcopy.c
         CVE-2025-8225:Fixed a memory leak in debug_information in dwarf.c
         CVE-2026-6846:Fixed a buffer overflow in xcoff_link_add_symbols in xcofflink.c


author: lingsheng <lingsheng1@h-partners.com> - 3.5.2-9
changelog:
  - Type:CVE
  - ID:CVE-2025-5914,CVE-2025-5916,CVE-2025-5917,CVE-2025-5918
  - SUG:NA
  - DESC:fix CVE-2025-5914 CVE-2025-5916 CVE-2025-5917 CVE-2025-5918


author: liuxu <liuxu156@huawei.com> - 1:1.34.1-21
changelog:
  - Type:CVE
  - Id:NA
  - SUG:NA
  - DESC:revert fix CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2023-42363


author: wangjiang <wangjiang37@h-partners.com> - 2023.2.60-3
changelog:
  - remove expired and sync new certificates
    Removing:
      Security Communication Root CA
    Adding:
      Atos TrustedRoot Root CA ECC G2 2020
      Atos TrustedRoot Root CA ECC TLS 2021
      Atos TrustedRoot Root CA RSA G2 2020
      Atos TrustedRoot Root CA RSA TLS 2021
      CommScope Public Trust ECC Root-01
      CommScope Public Trust ECC Root-02
      CommScope Public Trust RSA Root-01
      CommScope Public Trust RSA Root-02
      D-Trust SBR Root CA 1 2022
      D-Trust SBR Root CA 2 2022
      LAWtrust Root CA2 (4096)
      Sectigo Public Email Protection Root E46
      Sectigo Public Email Protection Root R46
      Sectigo Public Server Authentication Root E46
      Sectigo Public Server Authentication Root R46
      SSL.com Client ECC Root CA 2022
      SSL.com Client RSA Root CA 2022
      SSL.com TLS ECC Root CA 2022
      SSL.com TLS RSA Root CA 2022
      Telekom Security SMIME ECC Root 2021
      Telekom Security SMIME RSA Root 2023
      Telekom Security TLS ECC Root 2020
      Telekom Security TLS RSA Root 2023
      TrustAsia Global Root CA G3
      TrustAsia Global Root CA G4


author: wangjiang <app@cameyan.com> - 2023.2.60-5
changelog:
  - remove expired and sync new certificates
    Removing:
      Certificate "Explicitly Distrust DigiNotar Root CA"
      Certificate "Baltimore CyberTrust Root"
    Adding:
      Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
      Certificate "TWCA CYBER Root CA"
      Certificate "TWCA Global Root CA G2"
      Certificate "SecureSign Root CA12"
      Certificate "SecureSign Root CA14"
      Certificate "SecureSign Root CA15"
      Certificate "D-TRUST BR Root CA 2 2023"
      Certificate "D-TRUST EV Root CA 2 2023"


author: chenjianhu <chenjianhu@kylinos.cn> - 2023.2.60-5.p01
changelog:
  - Type:update
  - ID: [任务#501841]
  - SUG: NA
  - DESC: update to veriso 2023.2.60-5 and remove certificates that use SHA1 as signature algorithm


author: fuanan <fuanan3@h-partners.com> - 3.22.0-10
changelog:
  - remove the architecture judgment in the patches section;
  - include all patches in the source package.


author: Funda Wang <fundawang@yeah.net> - 1:2.4.0-15
changelog:
  - fix CVE-2025-58060, CVE-2025-58364
  - move www files into main package due to requirement by web interface


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix freeing of resources in disconnect
         openssl: fix crash on missing cert password


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-45
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:libssh: fix readdir issues
         krb5_gssapi: fix memory leak on error path
         pop3: fix CAPA response termination detection
         libssh: properly free sftp_attributes


author: zhouyihang <zhouyihang3@h-partners.com> - 7.79.1-46
changelog:
  - Type:CVE
  - CVE:CVE-2025-14017 CVE-2025-14524 CVE-2025-15079 CVE-2025-15224
  - SUG:NA
  - DESC:fix CVE-2025-14017 CVE-2025-14524 CVE-2025-15079 CVE-2025-15224


author: zhouyihang <zhouyihang_z@163.com> - 7.79.1-47
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:formdata: validate callback is non-NULL before use
         tftp: correct the filename length check


author: zhouyihang <zhouyihang_z@163.com> - 7.79.1-48
changelog:
  - Type:CVE
  - CVE:CVE-2026-1965 CVE-2026-3783 CVE-2026-3784
  - SUG:NA
  - DESC:fix CVE-2026-1965 CVE-2026-3783 CVE-2026-3784


author: zhouyihang <zhouyihang_z@163.com> - 7.79.1-49
changelog:
  - Type:CVE
  - CVE:CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168
  - SUG:NA
  - DESC:fix CVE-2026-4873 CVE-2026-5545 CVE-2026-5773 CVE-2026-6253 CVE-2026-6276 CVE-2026-6429 CVE-2026-7168


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-4
changelog:
  - Type:bugfix
  - ID:
  - SUG:restart
  - DESC:delete report url added by other upstream patch to keep pace with DHCP


author: renmingshuai <renmingshuai@huawei.com> - 12:4.4.3-5
changelog:
  - Type:CVE
  - ID:CVE-2022-2795,CVE-2022-38177,CVE-2022-38178
  - SUG:restart
  - DESC:fix CVE-2022-2795,CVE-2022-38177 and CVE-2022-38178


author: wangkerong <wangkerong@huawei.com> - 0.26-26
changelog:
  - Type:cves
  - ID:CVE-2021-29464 CVE-2021-29463 CVE-2021-29473
  - SUG:NA
  - DESC:fix CVE-2021-29464,CVE-2021-29463,CVE-2021-29473


author: baizhonggui <baizhonggui@huawei.com> - 1.6.2-5
changelog:
  - Fix building error: configure: error: no acceptable C compiler found in $PATH
  - Add gcc in BuildRequires


author: liyuxiang <liyuxiang@ncti-gba.cn> - 2:2.8.1-2
changelog:
  - Fix CVE-2022-39316
  - Fix CVE-2022-39318
  - Fix CVE-2022-39319
  - Fix CVE-2022-39347
  - Fix CVE-2022-41877


author: Funda Wang <fundawang@yeah.net> - 2:2.11.1-1
changelog:
  - 2.11.1
  - Fix CVE-2023-40567
  - Fix CVE-2023-40569
  - Fix CVE-2023-40188
  - Fix CVE-2023-40186
  - Fix CVE-2023-40181
  - Fix CVE-2023-39353
  - Fix CVE-2023-39352
  - Fix CVE-2023-39356
  - Fix CVE-2023-39350
  - Fix CVE-2023-39351
  - Fix CVE-2023-39354
  - Fix CVE-2023-40589


author: wangkai <13474090681@163.com> - 2:2.11.7-1
changelog:
  - Update to 2.11.7 for fix CVE-2024-32039,CVE-2024-32040,
    CVE-2024-32041,CVE-2024-32458,CVE-2024-32459,CVE-2024-32460,
    CVE-2024-32658,CVE-2024-32659 and CVE-2024-32660


author: wangkai <13474090681@163.com> - 2:2.11.8-1
changelog:
  - Update to 2.11.8
  - Fix CVE-2026-22852, CVE-2026-22856, CVE-2026-22859, CVE-2026-23530, CVE-2026-23531,
    CVE-2026-23532, CVE-2026-23534, CVE-2026-24491, CVE-2026-24675, CVE-2026-24676,
    CVE-2026-24679, CVE-2026-24681, CVE-2026-24682, CVE-2026-24683, CVE-2026-24684,
    CVE-2026-25997, CVE-2026-26271, CVE-2026-26986, CVE-2026-27015, CVE-2026-25941,
    CVE-2026-22855, CVE-2026-22857, CVE-2026-23533, CVE-2026-23732, CVE-2026-23883,
    CVE-2026-23884


author: Funda Wang <fundawang@yeah.net> - 9.55.0-18
changelog:
  - Type:CVE
  - ID:NA
  - SUG:NA
  - DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836


author: hdliu <dev03108@linx-info.com> - 9.55.0-19
changelog:
  - Add font mappings so that the PS interpreter can rasterize Chinese content using the two fonts STKaiti-Regular and STheiti-Regular.


author: yaoxin <yao_xin001@hoperun.com> - 5.2.2-1
changelog:
  - Update to 5.2.2
    * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)
    * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45
    * Address SF issue #166: a read zero page leads segment fault in
      getarg.c and memory leaks in gif2rgb.c and gifmalloc.c


author: huyubiao <huyubiao@huawei.com> - 2.33.0-13
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:Specifying Obsoletes and Provides version numbers, prevent upgrade conflicts.
         Delete git-core-doc from git, git-core-doc is provided by git-help.


author: fuanan <fuanan3@h-partners.com> - 2.33.0-14
changelog:
  - Type:CVE
  - ID:CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465
  - SUG:NA
  - DESC:Fix CVE-2024-32021 CVE-2024-32004 CVE-2024-32020 CVE-2024-32465


author: fuanan <fuanan3@h-partners.com> - 2.33.0-19
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-46334 CVE-2025-46835
  - SUG:NA 
  - DESC:Fix CVE-2025-27613 CVE-2025-46334 CVE-2025-46835


author: fuanan <fuanan3@h-partners.com> - 2.33.0-20
changelog:
  - Type:CVE
  - ID:CVE-2025-27613 CVE-2025-46334 CVE-2025-46835
  - SUG:NA
  - DESC:refix CVE-2025-27613 CVE-2025-46334 CVE-2025-46835


author: chengyechun <chengyechun1@huawei.com> - 2.34-160
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:resolv: Track single-request fallback via _res._flags
         resolv: Allow short error responses to match any query


author: shixuantong <shixuantong1@huawei.com> - 2.34-162
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: avoid jumping over a needed declaration
         elf: Move __rtld_malloc_init_stubs call into _dl_start_final


author: shixuantong <shixuantong1@huawei.com> - 2.34-163
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:elf: Handle static PIE with non-zero load address
         elf: Introduce _dl_relocate_object_no_relro
         elf: Switch to main malloc after final ld.so self-relocation


author: panzhe <panzhe@kylinos.cn> - 2.34-167.p01
changelog:
  - Type:update
  - ID:[Task#588463]
  - SUG:NA
  - DESC:
    - memalign: reinstate alignment overflow check (CVE-2026-0861)
    - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)


author: litenglong <litenglong@kylinos.cn> - 2.34-167.p02
changelog:
  - Type:update
  - ID:[Task#595081]
  - SUG:NA
  - DESC: posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281)


author: litenglong <litenglong@kylinos.cn> - 2.34-167.p03
changelog:
  - Type:cves
  - ID:[BUG#573021]
  - SUG:NA
  - DESC: Use pending character state in IBM1390, IBM1399 character
   sets (CVE-2026-4046)


author: jiaocong <jiaocong@kylinos.cn> - 3.7.2-22.p01
changelog:
  - Type: cves
  - ID: [BUG#581589]
  - SUG: NA
  - DESC: fix CVE-2026-3832, CVE-2026-3833,CVE-2026-42009,CVE-2026-42010,CVE-2026-42013,CVE-2026-42014,CVE-2026-42015,CVE-2026-5260


author: huzhangying <huzhangying@huawei.com> - 1.17.3-43
changelog:
  - Type:CVE
  - CVE:CVE-2025-58183,CVE-2025-58185,CVE-2025-58189,CVE-2025-61724
  - SUG:NA
  - DESC:fix CVE-2025-58183,CVE-2025-58185,CVE-2025-58189,CVE-2025-61724


author: huzhangying <huzhangying@huawei.com> - 1.17.3-47
changelog:
  - Type:CVE
  - CVE:CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-61726,CVE-2025-68121
  - SUG:NA
  - DESC:fix CVE-2025-61732,CVE-2025-68119,CVE-2025-61731,CVE-2025-61728,CVE-2025-61726,CVE-2025-68121


author: songliyang <songliyang@kylinos.cn> - 1.17.3-48.p01
changelog:
  - Type: updates
  - ID:   [TASK#573427] [TASK#610533]
  - SUG:  NA
  - DESC: 1.Upgrade to fix CVE-2025-47912 CVE-2025-58186 CVE-2025-61727 CVE-2025-61729
            CVE-2025-61732 CVE-2025-68119 CVE-2025-61731 CVE-2025-61728 CVE-2025-61726 CVE-2025-68121
          2.Fix check errors due to environment


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-44
changelog:
  - Type:CVE
  - CVE:CVE-2024-1048
  - SUG:NA
  - DESC:grub-set-bootflag: Fix for CVE-2024-1048
         commands/acpi: Fix calculation of ACPI tables addresses when processing RSDT and XSDT
         kern/acpi: Skip NULL entries in RSDT and XSDT
         util/grub-mount: Check file path sanity


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-46
changelog:
  - Type:CVE
  - CVE:CVE-2021-46848
  - SUG:NA
  - DESC:lib/libtasn1: Fix ETYPE_OK off by one array size check


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-47
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix log printing in tpcm_kunpeng moddule
         osdep/linux/hostdisk: Use stat() instead of udevadm for partition lookup
         osdep: Introduce include/grub/osdep/major.h and use it
         disk/mdraid1x_linux: Prevent infinite recursion
         disk: Generalize MD_MAX_DISKS to GRUB_MDRAID_MAX_DISKS


author: Qin Fandong <qinfandong@kylinos.cn> - 1:2.06-48.p02
changelog:
  - Type:CVE
  - CVE:CVE-2025-61661,CVE-2025-61662,CVE-2025-61663,CVE-2025-61664
  - ID:TASK#571799
  - SUG:NA
  - DESC:commands/usbtest: Ensure string length is sufficient in usb string processing
         commands/usbtest: Use correct string length field
         tests/lib/functional_test: Unregister commands on module unload
         normal/main: Unregister commands on module unload
         gettext/gettext: Unregister gettext command on module unload


author: baizhonggui <baizhonggui@huawei.com> - 1.16.2-3
changelog:
  - Fix building error: File not found: /home/abuild/rpmbuild/BUILDROOT/gstreamer1-plugins-bad-free-1.16.2-2.oe1.aarch64/usr/lib64/gstreamer-1.0/libgstwebrtcdsp.so
  - Add gcc-g++ in BuildRequires


author: yaoxin <yao_xin001@hoperun.com> - 1.16.2-7
changelog:
  - Fix cves:
    CVE-2024-47606,CVE-2024-47613,CVE-2024-47775,CVE-2024-47776
    CVE-2024-47777,CVE-2024-47778,CVE-2024-47774,CVE-2024-47540
    CVE-2024-47602,CVE-2024-47601,CVE-2024-47834,CVE-2024-47537
    CVE-2024-47597,CVE-2024-47543,CVE-2024-47596,CVE-2024-47539
    CVE-2024-47546


author: Funda Wang <fundawang@yeah.net> - 1.16.2-12
changelog:
  - fix CVE-2026-1940, CVE-2026-3083, CVE-2026-3085
  - fix GStreamer-SA-2026-0002: Out-of-bounds read in MP4 demuxer


author: yangchenguang <yangchenguang@kylinsec.com.cn> - 3.24.30-8
changelog:
  - Fix the problem that the prompt information of network icon volume icon is not displayed
  - update xscreen size when x11 screen size change
  - always send the monitors changed signal when screen size change
  - Add function definition of gtk_image_set_from_pixbuf_with_scale


author: peijiankang <peijiankang@kylinos.cn> - 3.24.30-11.p01
changelog:
  - Type: cves
  - ID:   [TASK#356907]
  - SUG:  NA
  - DESC: Enable cups for kylin.
          sync from 3.24.30-7.p01


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-21
changelog:
  - Type:CVE
  - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316
  - SUG:NA
  - DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream


author: chengyechun <chengyechun1@huawei.com> - 2.4.51-22
changelog:
  - Type:CVE
  - ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573
  - SUG:NA
  - DSEC:fix some CVEs


author: xingwei <xingwei14@h-partners.com> - 2.4.51-24
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:mod_log_config: Fix LogFormat directive merging
         Fix X509 leak and Increase MAX_CONCURRENCY hard limit
         mod_proxy_balancer: Fix the handling of the stickysession
         mod_cache_socache: Fix possible crash on error path
         mod_ssl: Check SSL_CTX_new() return value
         core: Report invalid Options argument when parsing AllowOverride directives


author: yanglu <yanglu72@h-partners.com> - 2.4.51-25
changelog:
  - Type:CVE
  - CVE:CVE-2025-49812,CVE-2025-23048,CVE-2024-47252,CVE-2024-43204,CVE-2024-42516
  - SUG:NA
  - DESC:fix CVE-2025-49812 CVE-2025-23048 CVE-2024-47252 CVE-2024-43204 CVE-2024-42516
         mod_lua: Fix memory handling in output filters.
         Fix a regression that caused stickysession keys
         avoid ap_set_content_type when processing a _Request_Header
         set_cookie_name: ensure correct format


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.4.51-26
changelog:
  - Type:bugfix
  - CVE:
  - SUG:NA
  - DESC:mod_proxy: SetEnv proxy-nohalfclose to disable half-close tunneling


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.4.51-27
changelog:
  - Type:CVE
  - CVE:CVE-2025-58098,CVE-2025-65082,CVE-2025-55753,CVE-2025-66200
  - SUG:NA
  - DESC:SSI request judgment
         Request header similarity detection
         fix mod_mod error retry delay calculation to not already doubling the wait on the first error.
         stop accepting "note" in RequestHeader.


author: wanggang <wanggang1@kylinos.cn> - 2.4.51-27.p01
changelog:
  - Type:bugfix
  - ID:[Task#579609]
  - SUG:NA
  - DESC:update index.html for kylin. 
         Change httpd.conf to achive: Hide httpd version and Turn TraceEnable off.


author: tangce <tangce1@h-partners.com> - 2.4.51-29
changelog:
  - Type:CVE
  - CVE:CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059
  - SUG:NA
  - DESC:fix CVE-2026-24072,CVE-2026-29168,CVE-2026-29169,CVE-2026-33006,CVE-2026-34059


author: zhaoyonghao <zhaoyonghao10@h-partners.com> - 2.4.51-30
changelog:
  - Type:CVE
  - CVE:CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032
  - SUG:NA
  - DESC:fix CVE-2026-33007,CVE-2026-33523,CVE-2026-33857,CVE-2026-34032


author: yinsist <jianhui.oerv@isrc.iscas.ac.cn> - 1.6-4
changelog:
  - Valgrind does not support certain architectures like RISC-V, Before depending on Valgrind, first check if Valgrind supports the architecture


author: Wenhua Huang <huangwenhua@kylinos.cn> - 1.3.10-6.p09
changelog:
  - Type:update
  - ID:[TASK#398797]
  - SUG:NA
  - DESC: sync to kylin-activation-1.3.10-6.p11.ky11
          fix without ukui


author: Wenhua Huang <huangwenhua@kylinos.cn> - 1.3.10-6.p10
changelog:
  - Type:bugfix
  - ID:[BUG#342043]
  - SUG:NA
  - DESC: sync to kylin-activation-1.3.10-6.p15.ky11
          fix ukey err msg


author: houhongxun <houhongxun@kylinos.cn> - 3.0.13-5.p01
changelog:
  - Type: cves
  - ID  : [TASK#591413]
  - SUG : NA
  - DESC: fix KVE-2022-0206, remove toggleCameraDevice parameters


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-34
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-Fix-ul_path_read_buffer.patch
         backport-fsck.minix-fix-possible-overrun.patch
         backport-wall-fix-possible-memory-leak.patch
         backport-wall-make-sure-unsigned-variable-not-underflow.patch


author: liyuzhe <liyuzhe@cqsoftware.com.cn> - 2.37.2-36
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         backport-login-su-pam_end-compliance.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-38
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add]backport-lsmem-make-lsmem-to-check-for-the-nodes-more-robust.patch
         backport-cfdisk-fix-possible-integer-overflow-coverity-scan.patch
         backport-more-make-sure-we-have-data-on-stderr.patch
         backport-libblkid-apfs-validate-checksums.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-39
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add] backport-sys-utils-setpriv-fix-potential-memory-leak.patch
         backport-sys-utils-save_adjtime-fix-memory-leak.patch


author: zhangyao <zhangyao108@huawei.com> - 2.37.2-40
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:sync community patches
         [add] backport-libblkid-ext-add-checksum-support.patch
         backport-libblkid-fix-spurious-ext-superblock-checksum-mismat.patch
         backport-libblkid-fix-potential-memory-leaks.patch
         backport-sys-utils-fix-add-NULL-check-for-mnt_fs_get_target-r.patch
         backport-sulogin-fix-POSIX-locale-use.patch
         backport-setpriv.c-fix-memory-leak-in-parse_groups-function.patch
         backport-whereis-avoid-accessing-uninitialized-memory.patch
         backport-dmesg-fix-notime-use.patch


author: yaoxin <yao_xin001@hoperun.com> - 1.27.4-1
changelog:
  - Update to 1.27.4 for fix CVE-2024-6381 and CVE-2024-6383
  - libbson Fixes:
    * Fix build with Visual Studio 2013.
    * Fix parsing of colon in timezone.
    * Error on failure to init subdocument in bson_iter_visit_all.
    * Fix string handling in bson_string_new and bson_string_append.
    * Fix iteration in bson_strfreev.
    * Use aligned alloc for bson_array_builder_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Fix conversion warning with GCC 12.
    * Fixes to some format strings in trace logs.
    * Allow mongoc_buffer_t to be larger than INT_MAX.
    * Add bson_array_builder_t.
  - libmongoc Fixes:
    * Fix possible crash reading malformed wire protocol message.
    * Upgraded bundled Zlib from 1.2.3 to 1.3.1
    * Close leftover connections to removed servers.
    * Fix possible crash when client is configured with empty password.
    * Fix possible hang if mongoc_gridfs_file_readv is called with a corrupt chunk with incomplete data.
    * Fix 32-bit compile with 64-bit time_t
    * Restore support for Sphinx 1.7.6 for man page build.
    * Disable shared libmongoc targets if ENABLE_SHARED=OFF
    * Fix documentation build with Python 3.9.
    * Fix data race in mongoc_cursor_get_host.
    * Add back support for BUILD_VERSION CMake option. BUILD_VERSION was unintentionally removed in 1.25.0.
    * Send recoveryToken in transactions when connected to a load balancer.


author: zhengxiaoxiao <zhengxiaoxiao@huawei.com> - 1.9.4-2
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:add backport-Fix-the-behavior-for-child-process.patch
             backport-Clear-AESWRAP-scratch-area-immediately-after-use.patch


author: xinghe <xinghe2@h-partners.com> - 2:1.6.38-3
changelog:
  - Type:cves
  - CVE:CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720
  - SUG:NA
  - DESC:fix CVE-2025-64505 CVE-2025-64506 CVE-2025-65018 CVE-2025-64720


author: ZhengZhenyu <zhengzhenyu@openeuler.sh> - 13.12-1
changelog:
  - aupgrade libpq to 13.12,fix CVE-2023-2455, CVE-2023-2454, CVE-2023-39417, CVE-2023-39418, CVE-2020-21469


author: xinghe <xinghe2@h-partners.com> - 2.74.2-5
changelog:
  - Type:cves
  - ID:CVE-2024-52530 CVE-2024-52531 CVE-2024-52532
  - SUG:NA
  - DESC:fix CVE-2024-52530 CVE-2024-52531 CVE-2024-52532


author: zhangpan <zhangpan103@h-partners.com> - 2.74.2-6
changelog:
  - Type:cves
  - ID:CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784
  - SUG:NA
  - DESC:fix CVE-2025-32050 CVE-2025-32052 CVE-2025-32053 CVE-2025-2784


author: zhangpan <zhangpan103@h-partners.com> - 2.74.2-7
changelog:
  - Type:cves
  - ID:CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913
  - SUG:NA
  - DESC:fix CVE-2025-32906 CVE-2025-32909 CVE-2025-32910 CVE-2025-32911 CVE-2025-32912 CVE-2025-32913


author: zhangpan <zhangpan103@h-partners.com> - 2.74.2-10
changelog:
  - Type:cves
  - ID:CVE-2025-4476 CVE-2025-4948 CVE-2025-4969
  - SUG:NA
  - DESC:fix CVE-2025-4476 CVE-2025-4948 CVE-2025-4969


author: houhongxun <houhongxun@kylinos.cn> - 2.74.2-10.p03
changelog:
  - Type:cves
  - ID:[TASK#593047][TASK#595441]
  - SUG:NA
  - DESC:fix CVE-2026-0719 CVE-2025-14523 CVE-2026-1761 CVE-2026-1539 CVE-2026-1467
         CVE-2026-0716 CVE-2026-2369 CVE-2026-1801 CVE-2026-1760


author: renmingshuai <renmingshuai@huawei.com> - 0.9.6-8
changelog:
  - Type:CVE
  - Id:CVE-2023-6004,CVE-2023-6918,CVE-2023-48795
  - SUG:NA
  - DESC:fix CVE-2023-6004, CVE-2023-6918 and CVE-2023-48795


author: gaihuiying <eaglegai@163.com> - 0.9.6-11
changelog:
  - Type:CVE
  - CVE:CVE-2025-4877 CVE-2025-4878 CVE-2025-5372
  - SUG:NA
  - DESC:fix CVE-2025-4877 CVE-2025-4878 CVE-2025-5372


author: zhangbinqin <zhangbinqin@h-partners.com> - 0.9.6-15
changelog:
  - Type:CVE
  - Id:CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821
  - SUG:NA
  - DESC:fix CVE-2026-0968 CVE-2026-0967 CVE-2026-0966 CVE-2026-0965 CVE-2026-0964 CVE-2025-14821


author: zhangbinqin <zhangbinqin@h-partners.com> - 1.10.0-8
changelog:
  - Type:CVE
  - CVE:CVE-2026-7598
  - SUG:NA
  - DESC:add username_len bounds checking to fix CVE-2026-7598


author: yezengruan <yezengruan@huawei.com> - 0.7.3-7
changelog:
  - tpm2: Reset TPM2B buffer sizes after test fails for valid buffer size
  - tpm2: Add maxSize parameter to TPM2B_Marshal for sanity checks
  - tpm2: Restore original value if unmarsalled value was illegal
  - fix CVE-2021-3623


author: huayadong <huayadong@kylinos.cn> - 3.1.2-27.p02
changelog:
  - Type:bugfix
  - ID:[Bug#204888]
  - SUG:NA
  - DESC:add Patch26:ukui-control-center-3.1.2-repair-freelogin-autologin-not-available.patch


author: huayadong <huayadong@kylinos.cn> - 3.1.2-27.p03
changelog:
  - Type:bugfix
  - ID:[Bug#208559][Bug#208556]
  - SUG:NA
  - DESC:add Patch27:ukui-control-center-3.1.2-kylin-fix-failed-to-modify-user-avatar-and-power-button-configuration.patch


author: huayadong <huayadong@kylinos.cn> - 3.1.2-27.p04
changelog:
  - Type:bugfix
  - ID:[Bug#209556]
  - SUG:NA
  - DESC:add Patch28:ukui-control-center-3.1.2-kylin-fix-the-display-resolution-does-not-match-the-actual-resolution.patch


author: peijiankang <peijiankang@kylinos.cn> - 3.1.2-27.p05
changelog:
  - Type:bugfix
  - ID:[Bug#225984]
  - SUG:NA
  - DESC:add Patch29:ukui-control-center-3.1.2-kylin-fix-authoriy-abnormal.patch


author: peijiankang <peijiankang@kylinos.cn> - 3.1.2-27.p06
changelog:
  - Type:bugfix
  - ID:[Bug#225978]
  - SUG:NA
  - DESC:add Patch30:ukui-control-center-3.1.2-kylin-fix-noopen-except-for-the-first-click.patch


author: houhongxun <houhongxun@kylinos.cn> - 3.1.2-27.p11
changelog:
  - Type: cves
  - ID  : [TASK#589295]
  - SUG : NA
  - DESC: fix KVE-2026-0104, encode password when used as command argument


author: hy-euler <eulerstoragemt@huawei.com> - 1.0.22-3
changelog:
  - delete -Sgit in 
  %setup       -q



  /usr/bin/cat /builddir/build/SOURCES/0001-descriptor-Fix-two-memory-safety-bugs-in-malformed-c.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch -f


author: xiaoyuliang <xiaoyuliang@kylinos.cn> - 6.2.0-66.p01
changelog:
  - Type: Update
  - ID:   [BUG#282187]
  - SUG:  NA
  - DESC: Add host cpu features to cpuMap to fix restore error in Kunpeng-920 CPU with ssbs feature.


author: xiaoyuliang <xiaoyuliang@kylinos.cn> - 6.2.0-66.p02
changelog:
  - Type: cves
  - ID:   CVE-2025-12748 CVE-2025-13193
  - SUG:  NA
  - DESC: Fix CVE-2025-12748 CVE-2025-13193


author: Funda Wang <fundawang@yeah.net> - 2.9.14-15
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: Funda Wang <fundawang@yeah.net> - 2.9.14-19
changelog:
  - Type:CVE
  - CVE:CVE-2025-49794
  - CVE:CVE-2025-49796
  - SUG:NA
  - DESC: fix CVE-2025-49794, CVE-2025-49796


author: zuo <zuohongsheng@kylinos.cn> - 2.9.14-20.p02
changelog:
  - Type:CVE
  - CVE:[task#590091
  - SUG:NA
  - DESC: fix CVE漏洞CVE-2026-0989（低危）CVE-2026-0992（低危）CVE-2026-0990（中危）


author: zhangxingrong <zhangxingrong@uniontech.com> - 5:2.2.12-3
changelog:
  - Fix smtp client to respect $use_envelope_from option.
  - Fix smtp client $envelope_from_address possible dangling pointer.


author: Funda Wang <fundawang@yeah.net> - 5:2.2.12-4
changelog:
  - fix CVE-2026-43859, CVE-2026-43860, CVE-2026-43861, CVE-2026-43862,
    CVE-2026-43863, CVE-2026-43864


author: gaihuiying <gaihuiying1@huawei.com> - 5.8-15
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Fix undefined behavior in asn_build_int()
         libsnmp: Rework parse_imports()
         libsnmp: Increase MAX_IMPORTS
         libsnmp: Allocate the module import list on the heap
         libsnmp: Fix a memory leak in a MIB parser error path
         libsnmp: Fix the getoid() error path


author: gaihuiying <eaglegai@163.com> - 1:5.9.1-3
changelog:
  - Type:CVE
  - CVE:CVE-2022-24805 CVE-2022-24806 CVE-2022-24807 CVE-2022-24808 CVE-2022-24809 CVE-2022-24810
  - SUG:NA
  - DESC:fix CVE-2022-24805 CVE-2022-24806 CVE-2022-24807
             CVE-2022-24808 CVE-2022-24809 CVE-2022-24810


author: xingwei <xingwei14@h-partners.com> - 1:5.9.1-4
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC: IF-MIB, IP-FORWARD-MIB: Improve robustness
          IF-MIB: pass the network interface index to net
          IF-MIB: fix a memory leak
          IF-MIB: fix a recently introduced use after free
          IF-MIB: add a trailing newline to an error message


author: lifeifei <lifeifei@kylinos.cn> - 1:1.24.0-1.p01
changelog:
  - Type: bugfix
  - ID: [Task#373049]
  - SUG: NA
  - DESC: Modify openEuler to Kylin in index.html,404.html,50x.html


author: lixiaoyong <lixiaoyong@kylinos.cn> - 1:1.24.0-1.p04
changelog:
  - Type: cves
  - ID: CVE-2026-40701 CVE-2026-42934 CVE-2026-42946 CVE-2026-9256
  - SUG: NA
  - DESC: fix CVE-2026-40701 CVE-2026-42934 CVE-2026-42946 CVE-2026-9256


author: lixiaoyong <lixiaoyong@kylinos.cn> - 1:1.24.0-1.p05
changelog:
  - Type: cves
  - ID: CVE-2026-27651 CVE-2026-27654 CVE-2026-27784 CVE-2026-28753
  - SUG: NA
  - DESC: fix CVE-2026-27651 CVE-2026-27654 CVE-2026-27784 CVE-2026-28753


author: zhangbinqin<zhangbinqin@h-partners.com> - 8.8p1-36
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:fix the missing member of the struct Authmethod method_gsskeyex


author: zhangbinqin<zhangbinqin@h-partners.com> - 8.8p1-41
changelog:
  - Type:CVE
  - CVE:CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388
  - SUG:NA
  - DESC:fix CVE-2026-35414 CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388


author: songjuntao <songjuntao@kylinos.cn> - 1:1.1.1wa-10.p02
changelog:
  - Type:update
  - ID:TASK#593863
  - SUG:NA
  - DESC:fix CVE-2025-68160、CVE-2026-22796、CVE-2026-22795、
             CVE-2025-69418、CVE-2025-69421、CVE-2025-69419、
             CVE-2025-69420


author: songjuntao <songjuntao@kylinos.cn> - 1:1.1.1wa-10.p03
changelog:
  - Type:update
  - ID:TASK#616231
  - SUG:NA
  - DESC:fix CVE-2026-28390,CVE-2026-28389,CVE-2026-28388,CVE-2026-28387


author: songjuntao <songjuntao@kylinos.cn> - 1:1.1.1wa-10.p04
changelog:
  - Type:update
  - ID:TASK#640713
  - SUG:NA
  - DESC:fix CVE-2026-7383,CVE-2026-9076,CVE-2026-34180,CVE-2026-42766,
             CVE-2026-45447


author: songliyang <songlyang@kylinos.cn> - 0.120-12.p01
changelog:
  - Type: update
  - ID:   [TASK#612227]
  - SUG:  NA
  - DESC: 1.Upgrade to fix CVE-2026-4897
          2.Backport Source2:10-shutdown.rules to fix BUG#191407. Author: peijiankang


author: lilu <lilu@kylinos.cn> - 13.21-2.p02
changelog:
  - Type: cves
  - ID: [TASK#599479]
  - SUG: NA
  - DESC: fix CVE-2026-2003 CVE-2026-2004 CVE-2026-2005 and CVE-2026-2006


author: xiejing <xiejing@kylinos.cn> - 13.21-2.p03
changelog:
  - Type: cves
  - ID: [TASK#615475]
  - SUG: NA
  - DESC: fix CVE-2025-8713 and CVE-2025-8714 (CVE-2025-4207 fixed in 13.21-1)


author: heppen <hepeng68@huawei.com> - 1.1.0-3
changelog:
  - Bug fix: fix build warning.
  - Bug fix: export PWR_SYS_GetRtPowerInfo.
  - Bug fix: data collection task intercept invalid task type.


author: heppen <hepeng68@huawei.com> - 1.1.0-4
changelog:
  - Bug fix: memcpy null pointer, array out of bounds, struct align.
  - Bug fix: get watt state will failed at the first time.
  - Bug fix: use process name to query pid but return all pids.
  - Bug fix: mismatch fopen/pclose and popen/fclose, useless if statement.


author: heppen <hepeng68@huawei.com> - 1.1.0-5
changelog:
  - Bug fix: SIGPIPE cause powerapi server exit.
  - Bug fix: pstree command is too slow to get all pid.
  - Bug fix: set smart grid state failed.
  - Bug fix: get watt attr and task list is not correct.


author: Zihao Xue <xuezihao@huawei.com> - 1.1.0-6
changelog:
  - Bug fix: heap buffer overflow caused by sending incomplete strings.
  - Bug fix: too long strings into QueryProcs causes services broke down.


author: wanggang <wanggang1@kylinos.cn> - 21.3.1-8.p06
changelog:
  - Type: cves
  - ID: CVE-2025-66418 CVE-2026-21441 CVE-2026-1703
  - SUG: NA
  - DESC: Fix CVE-2025-66418 CVE-2026-21441 CVE-2026-1703


author: wanggang <wanggang1@kylinos.cn> - 21.3.1-8.p07
changelog:
  - Type: cves
  - ID: CVE-2026-44431 CVE-2026-25645 CVE-2026-8643 CVE-2026-3219
  - SUG: NA
  - DESC: fix CVE-2026-44431 CVE-2026-25645 CVE-2026-8643 CVE-2026-3219


author: lipengyu <lipengyu@kylinos.cn> - 3.9.9-45
changelog:
  - Type:CVE
  - CVE:CVE-2025-4517 CVE-2025-4138 CVE-2024-12718 CVE-2025-4330 CVE-2025-4435
  - SUG:NA
  - DESC:fix CVE-2025-4517 CVE-2025-4138 CVE-2024-12718 CVE-2025-4330 CVE-2025-4435


author: fuanan <fuanan3@h-partners.com> - 3.9.9-50
changelog:
  - Type:CVE
  - CVE:CVE-2025-12084 CVE-2025-13836 CVE-2025-13837
  - SUG:NA
  - DESC:fix CVE-2025-12084 CVE-2025-13836 CVE-2025-13837


author: gaihuiying <eaglegai@163.com> - 1.13.2-21
changelog:
  - Type:CVE
  - CVE:CVE-2025-11411
  - SUG:NA
  - DESC:Additional fix for CVE-2025-11411 to include YXDOMAIN and non-referral nodata answers in the mitigation


author: gaihuiying <eaglegai@163.com> - 1.13.2-22
changelog:
  - Type:cves
  - CVE:CVE-2026-33278,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960
  - SUG:NA
  - DESC:fix CVE-2026-33278,CVE-2026-41292,CVE-2026-42959,CVE-2026-42960


author: lixiaoyong <lixiaoyong@kylinos.cn> - 0.14.1-1
changelog:
  - Upgrade package to version 0.14.1
    - Drop support for Python older than 3.6
    - Additional ruff/Pyflakes/codespell fixes


author: <fengjiabo1@huawei.com> - 10:6.2.0-91
changelog:
  - hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/display/virtio-gpu: Protect from DMA re-entrancy bugs(CVE-2024-3446)
  - hw/virtio: Introduce virtio_bh_new_guarded() helper
  - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded
  - checkpatch: add qemu_bh_new/aio_bh_new checks
  - async: avoid use-after-free on re-entrancy guard
  - async: Add an optional reentrancy guard to the BH API
  - hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set(CVE-2024-3447)
  - rtl8139: Remove unused variable
  - tulip: Remove unused variable
  - virtio-mem: Fix the bitmap index of the section offset
  - virtio-mem: Fix the iterator variable in a vmem->rdl_list loop
  - system/memory: use ldn_he_p/stn_he_p
  - block: Fix crash when loading snapshot on inactive node
  - smmu: Clear SMMUPciBus pointer cache when system reset
  - block/mirror: Fix NULL s->job in active writes
  - amd_iommu: Fix APIC address check
  - virtio-crypto: fix NULL pointer dereference in virtio_crypto_free_reques
  - libqos/virtio.c: Correct 'flags' reading in qvirtqueue_kick
  - ivshmem-test.c: enable test_ivshmem_server for ppc64 arch
  - ivshmem.c: change endianness to LITTLE_ENDIAN
  - hw/ppc/mac.h: Remove MAX_CPUS macro
  - configure: remove dead variables
  - virtio-gpu: do not byteswap padding
  - hw/intc: clean-up error reporting for failed ITS cmd
  - qemu-iotests: Discard stderr when probing devices
  - linux-user: un-parent OBJECT(cpu) when closing thread
  - hw/net/rocker: Avoid undefined shifts with more than 31 ports
  - contrib/vhost-user-blk: Clean up deallocation of VuVirtqElement
  - scsi-disk: fix overflow when block size is not a multiple of BDRV_SECTOR_SIZE


author: <fengjiabo1@huawei.com> - 10:6.2.0-92
changelog:
  - s390x/sclp: Simplify get_sclp_device() 
  - target/ppc: Remove msr_pr macro
  - docs/system/target-arm: Re-alphabetize board list
  - migration: Extend query-migrate to provide dirty page limit info
  - migration: Implement dirty-limit convergence algo
  - migration: Put the detection logic before auto-converge checking
  - migration: Refactor auto-converge capability logic
  - migration: Introduce dirty-limit capability
  - qapi/migration: Introduce vcpu-dirty-limit parameters
  - qapi/migration: Introduce x-vcpu-dirty-limit-period parameter
  - Change the value of no_ged from true to false
  - Allow UNIX socket option for VNC websocket
  - tpm_emulator: Avoid double initialization during
  - chardev/char-socket: Update AF_UNIX for Windows
  - KVM: dirty ring: add missing memory barrier
  - i386: reset KVM nested state upon CPU reset
  - esp: Handle CMD_BUSRESET by resetting the SCSI bus
  - dbus-vmstate: Restrict error checks to registered proxies in dbus_get_proxies
  - vfio/pci: Add Ascend310b scend910b support
  - target/i386: Export RFDS bit to guests
  - target/i386: Add new CPU model SierraForest
  - target/i386: Introduce Icelake-Server-v7 to enable TSX
  - hw/virtio: handle un-configured shutdown in virtio-pci
  - target/s390x: display deprecation status in '-cpu  help'
  - target/i386: display deprecation status in '-cpu  help'
  - pc-bios/s390-ccw: Fix booting with logical block size < physical block size


author: <fengjiabo1@huawei.com> - 10:6.2.0-93
changelog:
  - cvm: bug-fix for macro isolation
  - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fix CVE-2023-5088)
  - hw/ide: reset: cancel async DMA operation before resetting state (Fix CVE-2023-5088)
  - Add support for the virtcca cvm feature.


author: <fengjiabo1@huawei.com> - 10:6.2.0-96
changelog:
  - vdpa: Fix bug where vdpa appliance migration does not resume after rollback
  - block: Parse filenames only when explicitly requested (CVE-2024-4467)
  - block: introduce bdrv_open_file_child() helper
  - iotests/270: Don't store data-file with json: prefix in image (CVE-2024-4467)
  - iotests/244: Don't store data-file with protocol in image (CVE-2024-4467)
  - qcow2: Don't open data_file with BDRV_O_NO_IO (CVE-2024-4467)
  - qcow2: Do not reopen data_file in invalidate_cache
  - hw/intc/arm_gic: Fix deactivation of SPI lines chery-pick from 7175a562f157d39725ab396e39c1e8e410d206b3
  - vhost-user: Skip unnecessary duplicated VHOST_USER_SET_LOG_BASE requests
  - target/ppc: Split off common embedded TLB init cheery-pick from 581eea5d656b73c6532109f4ced4c73fd4e5fd47`
  - vdpa: fix vdpa device migrate rollback wrong when suspend device failed 1. 
  - hw/virtio/virtio-pci:Support shadow device for virtio-net/blk/scsi devices


author: <fengjiabo1@huawei.com> - 10:6.2.0-97
changelog:
  - nbd/server: CVE-2024-7409: Close stray clients at server-stop
  - main-loop.h: introduce qemu_in_main_thread()
  - aio-wait.h: introduce AIO_WAIT_WHILE_UNLOCKED
  - nbd/server: CVE-2024-7409: Drop non-negotiating clients
  - nbd/server: CVE-2024-7409: Cap default max-connections to 100
  - nbd/server: Plumb in new args to nbd_client_add()
  - nbd: Minor style and typo fixes


author: <fengjiabo1@huawei.com> - 10:6.2.0-98
changelog:
  - pci-host: designware: Limit value range of iATU viewport register
  - hmat acpi: Fix out of bounds access due to missing use of indirection
  - migration: Skip only empty block devices
  - aspeed/hace: Initialize g_autofree pointer
  - hw/net/vmxnet3: Fix guest-triggerable assert()
  - qxl: don't assert() if device isn't yet initialized
  - Avoid unaligned fetch in ladr_match()
  - linux-user: Fix waitid return of siginfo_t and rusage
  - hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition
  - stdvga: fix screen blanking
  - virtio-net: drop too short packets early
  - ebpf: replace deprecated bpf_program__set_socket_filter
  - vhsot-user: only read reply of SET_LOG_BASE from vq 0
  - cpu: add Tengyun S5000C cpu support
  - hw/virtio: Fix obtain the buffer id from the last descriptor
  - hw/core: ensure kernel_end never gets used undefined


author: <fengjiabo1@huawei.com> - 10:6.2.0-99
changelog:
  - target/i386: Introduce SapphireRapids-v3 to add missing features
  - qtest/fuzz-lsi53c895a-test: set guest RAM to 2G
  - hw/net/lan9118: Signal TSFL_INT flag when TX FIFO reaches specified level
  - target/arm: Fix alignment for VLD4.32
  - hw/microblaze: pass random seed to fdt
  - tests/qtest: npcm7xx-emc-test: Skip checking MAC
  - tests: mark io-command test as skipped if socat is missing
  - tests: unit: add NULL-pointer check
  - tests: test-qga: close socket on failure to connect
  - vdpa:block device capacity expansion online support vdpa block device update capacity.
  - virtio-net: Ensure queue index fits with RSS(CVE-2024-6505)
  - nbd/server: CVE-2024-7409: Avoid use-after-free when closing server
  - ppc/vof: Fix unaligned FDT property access
  - vvfat: Fix reading files with non-continuous clusters
  - vvfat: Fix bug in writing to middle of file
  - savevm: Fix load_snapshot error path crash
  - hw/dma/xilinx_axidma: Use semicolon at end of statement, not comma
  - hw/remote/message.c: Don't directly invoke DeviceClass:reset
  - crypto/tlscredspsk: Free username on finalize
  - hw/display/vhost-user-gpu.c: fix vhost_user_gpu_chr_read()
  - virtio: remove virtio_tswap16s() call in vring_packed_event_read()
  - char-stdio: Restore blocking mode of stdout on exit
  - hw/ppc: spapr: Use qemu_vfree() to free spapr->htab
  - smbios: sanitize type from external type before checking have_fields_bitmap
  - spapr_pci: fix leak in spapr_phb_vfio_get_loc_code
  - KVM: use store-release to mark dirty pages as harvested
  - monitor/hmp: print trace as option in help for log command
  - tpm_crb: Avoid backend startup just before shutdown under Xen
  - crypto/block-luks: make range overlap check more readable
  - spapr: Free stdout path
  - target/rx: Use target_ulong for address in LI
  - virtio-pci: Fix the use of an uninitialized irqfd
  - rtl8139: Fix behaviour for old kernels.
  - virtio-rng: block max-bytes=0 MIME-Version: 1.0
  - hw/audio/es1370: Clean up comment
  - vhost-user-server: do not set memory fd non-blocking
  - ui: reject extended clipboard message if not activated
  - virtio-net: Fix vhost virtqueue notifiers for RSS
  - hw/misc/applesmc: Fix memory leak in reset() handler


author: yanjianqing <yanjianqing@kylinos.cn> - 10:6.2.0-99.p02
changelog:
  - Type: cves
  - ID:   CVE-2025-11234
  - SUG:  NA
  - DESC: Fix CVE-2025-11234 io:release active GSource in TLS channel finalizer


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-4
changelog:
  - Type:CVES
  - ID:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126
  - SUG:NA
  - DESC:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126


author: zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-5
changelog:
  - Type:CVES
  - ID:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572
  - SUG:NA
  - DESC:CVE-2022-44570 CVE-2022-44571 CVE-2022-44572


author: zhongjiawei<zhongjiawei1@huawei.com> - 1.1.3-27
changelog:
  - Type:bugfix
  - CVE:NA
  - SUG:NA
  - DESC:Set temporary single CPU affinity before cgroup cpuset transition


author: yueyuankun <yueyuankun@kylinos.cn> - 15.6-27.p01
changelog:
  - Types:bugfix
  - ID:BUG#500965;BUG#276525
  - SUG:NA
  - DESC:Remove debugsource requirement from debuginfo
         Allow debuginfo to be installed alone without pulling in the debugsource package
         Support secure boot


author: wjiang <app@cameyan.com> - 15.6-28
changelog:
  - backport bugfix patches from upstream
  - Fix build with binutils 2.46 (c4665d2)
  - Fix memory leak on TPM log error in mirror_one_mok_variable (92630f2)


author: Jianmin <jianmin@iscas.ac.cn> - 1:1.8.0-7
changelog:
  - Type:cve
  - CVE:CVE-2023-39325 and CVE-2023-44487
  - SUG:NA
  - DESC:backport CVE-2023-39325 and CVE-2023-44487


author: cenhuilin <cenhuilin@kylinos.cn> - 21.01.1-15.p02
changelog:
  - Type: cves
  - ID: [BUG#546969]
  - SUG: NA
  - DESC:1.fix CVE-2025-57275: lib/nvmf: limit number of NVMe-oF registrants when updating PTPL info
         2.scripts: Do msr existence check only on x86_64 machines


author: xinghe <xinghe2@h-partners.com> - 7:4.9-29
changelog:
  - Type:cves
  - ID:CVE-2023-49288 CVE-2025-54574 CVE-2023-5824 CVE-2025-62168
  - SUG:NA
  - DESC:fix CVE-2023-49288 CVE-2025-54574 CVE-2023-5824 CVE-2025-62168


author: wangkai <13474090681@163.com> - 1:9.0.100-1
changelog:
  - Update to 9.0.100 for fix CVE-2024-56337
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337,
    the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not.


author: yaoxin <1024769339@qq.com> - 1:9.0.117-1
changelog:
  - Update to 9.0.117 for fix CVEs: CVE-2026-24880, CVE-2026-25854,
    CVE-2026-29129, CVE-2026-29145, CVE-2026-29146, CVE-2026-32990,
    CVE-2026-34483, CVE-2026-34486, CVE-2026-34487, CVE-2026-34500


author: yaoxin <1024769339@qq.com> - 1:9.0.118-1
changelog:
  - Update to 9.0.118 for fix CVEs: CVE-2026-41284, CVE-2026-41293,
    CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514,
    CVE-2026-43515
  - Fix tomcat-jsvc stop failed


author: mengchaoming<mengchaoming@kylinos.cn> - 2:9.0-35.p01
changelog:
  - Type:update
  - ID:[TASK#509419]
  - SUG:NA
  - DESC:AQKK服务器项目重新集成双内核版本移植vim安全补丁
  -   修改sepc文件，将python相关的编译参数设置为no,解决bug#101652:vim绕过exectl执行未在白名单内的python脚本的问题
  -   add patch vim-add-zh_HK.patch
  -   kylin modify sensitive words
  -   revise the expression of sensitive words
  -   Adapt unit tests for CVE-2025-53905


author: kouwenqi <kouwenqi@kylinos.cn> - 5.2.5-4
changelog:
  - Type:enhancement
  - CVE:NA
  - SUG:NA
  - DESC:Add overflow check for Unpadded size in lzma_index_append


