# changelog

author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.34.1.11.8
changelog:
  - Updated to icedtea6 1.11.8
  - Removed patch9   7201064.patch
  - Removed patch10   8005615.patch
  - Removed  not-applied patch 6664509.patch
  - Removed mauve as deadly outdated and run on QA
    -  jtreg kept, useless, but valid
  - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch 
  - Resolves: rhbz#911522


author: Tim Waugh <twaugh@redhat.com> 1:1.3.7-30:.1
changelog:
  - Applied patch to fix CVE-2012-5519 (privilege escalation for users
    in SystemGroup or with equivalent polkit permission).  This prevents
    HTTP PUT requests with paths under /admin/conf/ other than that for
    cupsd.conf, and also prevents such requests altering certain
    configuration directives such as PageLog and FileDevice (bug #875898).


author: Colin Walters <walters@redhat.com> - 0.73-10
changelog:
  - Add patch to fix CVE-2010-1172
    Drop broken-xml.patch which this one now incorporates
    Resolves: #585395


author: Ondrej Vasik <ovasik@redhat.com> 0.11.1-7
changelog:
  - fix #235411 - CVE-2007-2027 - elinks tries to load .po files
    from non-absolute path
  - fix #523258 - CVE-2008-7224 - entity_cache static array buffer
    overflow


author: Marek Kasik <mkasik@redhat.com> 2.2.1-32
changelog:
  - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136,
    1137, 1139, 1140, 1141, 1142, 1143, 1144}
  - Protect against invalid string offsets in pcf_get_properties()
  - Check bytes per row for overflow in _bdf_parse_glyphs()
  - Resolves: #806267


author: Tomas Mraz <tmraz@redhat.com> 1.4.1-9
changelog:
  - fix CVE-2011-4128 - buffer overflow in gnutls_session_get_data() (#752308)
  - fix CVE-2012-1569 - missing length check when decoding DER lengths (#804920)
  - fix CVE-2012-1573 - security issue in packet parsing (#805432)


author: Tomas Mraz <tmraz@redhat.com> 1.4.1-10
changelog:
  - do not generate invalid certificate requests without challenge password
  - store subject DN instead of issuer DN in the CA list


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.33.1.11.6
changelog:
  - removed patch9 revertTwoWrongSecurityPatches2013-02-06.patch
  - added patch9:   7201064.patch to be reverted
  - added patch10:   8005615.patch to fix the 6664509.patch
  - Resolves: rhbz#906705


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.31.1.11.6
changelog:
  - Updated to icedtea6 1.11.6
  - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch 
  - Resolves: rhbz#906705


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.32.1.11.6
changelog:
  - added patch9 revertTwoWrongSecurityPatches2013-02-06.patch
    to remove   6664509 and 7201064 from 1.11.6 tarball
  - Resolves: rhbz#906705


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.3.el5.1
changelog:
  - Changed permissions of sa-jdi.jar to correct 644
  - Correctly removed noarch tag form javadoc, rhel5 donot support noarch subpackages
  - Resolves: rhbz#803732


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.11-2.4.0.el6.1
changelog:
  - Rewritten patch105: java-1.7.0-openjdk-disable-system-lcms.patch
  - Added jxmd and idlj to alternatives
  - make executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
  - Unapplied patch302 and deleted systemtap.patch
  - buildver increased to 11
  - icedtea_version set to 2.4.0
  - Added and applied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
  - Added /lib/security/US_export_policy.jar and lib/security/local_policy.jar
  - Resolves: rhbz#895031


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.4.el6.1
changelog:
  - Rewerted to IcedTea 2.3
    - Rewerted patch105: java-1.7.0-openjdk-disable-system-lcms.patch
    - Removed jcmd and idlj to alternatives
    - make NOT executed with   DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true
    - Reapplied patch302 and deleted systemtap.patch
    - buildver set to 9
    - icedtea_version set to 2.3.4
    - Unapplied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch
    - removed /lib/security/US_export_policy.jar and lib/security/local_policy.jar
    - java-1.7.0-openjdk-java-access-bridge-security.patch's path moved from 
      java.security-linux back to java.security
  - Resolves: rhbz#895031


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.7.0.el5_9
changelog:
  - Removed patch1000 sec-2013-02-01-8005615.patch
  - Removed patch1001 sec-2013-02-01-8005615-sync_with_jdk7u.patch
  - Removed patch1010 sec-2013-02-01-7201064.patch
  - Removed testing
   - mauve was outdated and
   - jtreg was icedtea relict
  - Updated  to icedtea 2.3.7
  - Resolves: rhbz#911527


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.7.1.el5_9
changelog:
  - Updated main source tarball
  - Removed wrong relinking of cacerts (see rhbz 904165)
  - Resolves: rhbz#911527


author: Phillip Lougher <plougher@redhat.com> [2.6.18-347.el5]
changelog:
  - [xen] add guest address range checks to XENMEM_exchange handlers (Igor Mammedov) [878034] {CVE-2012-5513}
  - [xen] x86/physmap: Prevent incorrect updates of m2p mappings (Igor Mammedov) [870149] {CVE-2012-4537}
  - [xen] VCPU/timer: Dos vulnerability prev overflow in calculations (Igor Mammedov) [870151] {CVE-2012-4535}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.1.1.el5]
changelog:
  - [pci] intel-iommu: reduce max num of domains supported (Don Dutile) [886876 885125]
  - [fs] gfs2: Fix leak of cached directory hash table (Steven Whitehouse) [886124 831330]
  - [x86] mm: randomize SHLIB_BASE (Petr Matousek) [804953 804954] {CVE-2012-1568}
  - [net] be2net: create RSS rings even in multi-channel configs (Ivan Vecera) [884702 878209]
  - [net] tg3: Avoid dma read error (John Feeney) [885692 877474]
  - [misc] Fix unsupported hardware message (Prarit Bhargava) [885063 876587]
  - [net] ipv6: discard overlapping fragment (Jiri Pirko) [874837 874838] {CVE-2012-4444}
  - [usb] Fix serial port reference counting on hotplug remove (Don Zickus) [885700 845447]
  - [net] bridge: export its presence and fix bonding igmp reporting (Veaceslav Falico) [884742 843473]
  - [fs] nfs: move wait for server->active from put_super to kill_sb (Jeff Layton) [884708 839839]
  - [scsi] libfc: fix indefinite rport restart (Neil Horman) [884740 595184]
  - [scsi] libfc: Retry a rejected PRLI request (Neil Horman) [884740 595184]
  - [scsi] libfc: Fix remote port restart problem (Neil Horman) [884740 595184]
  - [xen] memop: limit guest specified extent order (Laszlo Ersek) [878449 878450] {CVE-2012-5515}
  - [xen] get bottom of EBDA from the multiboot data structure (Paolo Bonzini) [885062 881885]


author: Stephan Wiesand <stephan wiesand desy de> 1.4.12-79.SLx
changelog:
  - 1.4.12 release, no additional patches
  - updated CellServDB from grand.central.org (phy.bris.ac.uk is ok)


author: Stephan Wiesand <stephan wiesand desy de> 1.4.14-80.SLx
changelog:
  - 1.4.14 release, no additional patches
  - updated CellServDB from grand.central.org (last changed 2010-12-13)


author: Stephan Wiesand <stephan wiesand desy de> 1.4.14-80.1.SLx
changelog:
  - patch 1073: dont-afs_flushvcbs-under-xvcache-lock-20100623
  - this hopefully fixes the client hangups on parallel directory acces


author: Troy Dawson <dawson@fnal.gov> - 8.3.7-1
changelog:
  - Update to 8.3.7
  - Separated the kernel module out to a separate rpm
    This is because the driver is now in the generic kernel
  - Combined spec files from atrpms and normal SL kernel module specs


author: Stephan Wiesand <stephan wiesand desy de> 1.4.14-82.SLx
changelog:
  - patch 1075 to fix buffer overflows (backport from 1.6.2 release)
  - backed out patch 1074 to make this is a security-only release


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.20.el5
changelog:
  - Implement some default limits in the XPath module (CVE-2011-1944)
  - Change the XPath code to percolate allocation errors (CVE-2011-1944)


author: Elio Maldonado <emaldona@redhat.com> - 3.13.6-3
changelog:
  - Fix changelog inconsistencies with commit and bug resolved
  - Resolves: rhbz#891149 [CVE-2013-0743]


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-142.el5
changelog:
  - Properly close logfile of console daemon on error (rhbz 749776)
  - Fix leaks in block-qcow driver (rhbz 749776)
  - Avoid bogus use of NULL pointer in hvmloader (rhbz 749776)
  - qemu-dm: fix unregister_iomem (rhbz 861349)
  - Backport a single hunk from qemu-xen-unstable commit 13669683 (rhbz 861349)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-142.el5_9.1
changelog:
  - libxc: move error checking next to the function which returned the error (rhbz 876997)
  - libxc: builder: limit maximum size of   kernel/ramdisk (rhbz 876997)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-26.1
changelog:
  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589)
  - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052)
  - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB
    environment variable is set (fixes CVE-2012-4929 #857051)
  - use __secure_getenv() everywhere instead of getenv() (#839735)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.2.1.el5]
changelog:
  - [misc] tainted flags, fix buffer size (Prarit Bhargava) [905829 901547]
  - [net] be2net: fix unconditionally returning IRQ_HANDLED in INTx (Ivan Vecera) [884704 878316]
  - [net] be2net: fix INTx ISR for interrupt behaviour on BE2 (Ivan Vecera) [884704 878316]
  - [net] be2net: fix a possible events_get() race on BE2 (Ivan Vecera) [884704 878316]
  - [firmware] Expand kernel boot-time storage for DMI table structs (Lenny Szubowicz) [902683 862865]
  - [fs] udf: Fortify loading of sparing table (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}
  - [fs] udf: Improve table length check to avoid possible overflow (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}
  - [fs] udf: Avoid run away loop when partition table is corrupted (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-27
changelog:
  - unintentional file creation caused by inserting an illegal NUL character
    * ruby-1.8.6-CVE-2012-4522-io.c-pipe_open-command-name-should-not-contain-null-.patch
    - Related: rhbz#867750


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-28
changelog:
  - Addresses entity expansion DoS vulnerability in REXML.
    * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch
  - Resolves: rhbz#915377


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-29
changelog:
  - Fix regression introduced by fix for entity expansion DOS vulnerability
    in REXML (https://bugs.ruby-lang.org/issues/7961)
    * ruby-2.0.0-add-missing-rexml-require.patch
  - Related: rhbz#915377


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-142.el5_9.2
changelog:
  - e1000: discard packets that are too long if !SBP and !LPE (rhbz 910843)
  - e1000: discard oversized packets based on SBP|LPE (rhbz 910843)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.3.1.el5]
changelog:
  - [utrace] ensure arch_ptrace() can never race with SIGKILL (Oleg Nesterov) [912071 912072] {CVE-2013-0871}
  - [x86] msr: Add capabilities check (Nikola Pajkovsky) [908696 908697] {CVE-2013-0268}


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.38
changelog:
  - Resolves: CVE-2012-3439 rhbz#882008 three DIGEST authentication
  - implementation
  - Resolves: CVE-2012-3546, rhbz#913034 Bypass of security constraints.
  - Remove unneeded handling of FORM authentication in RealmBase


author: Petr Pisar <ppisar@redhat.com> - 4:5.8.8-40
changelog:
  - Fix CVE-2012-5195 heap buffer overrun at repeatcpy (Resolves: rhbz#915690)
  - Fix CVE-2012-5526 newline injection due to improper CRLF escaping in
    Set-Cookie and P3P headers (Resolves: rhbz#915690)
  - Fix CVE-2012-6329 possible arbitrary code execution via Locale::Maketext
    (Resolves: rhbz#915690)
  - Fix CVE-2013-1667 DoS in rehashing code (Resolves: rhbz#915690)


author: Permaine Cheung <pcheung@redhat.com> - 0:1.2.1-2jpp.7
changelog:
  - Add missing connection hostname check against X.509 certificate name
  - Resolves: CVE-2012-5784
  - Add patches to build with java 1.6


author: Petr Machata <pmachata@redhat.com> - 2013b-1
changelog:
  - Upstream 2013b
    - Paraguay will end DST on March 24 this year
    - Haiti uses US daylight-saving rules this year
    - Morocco does not observe DST during Ramadan
  - Upstream 2013a
    - Retire Chile patch, 2013a has the data
    - New Zones Asia/Khandyga, Asia/Ust-Nera, Europe/Busingen
    - Many changes in historical timestamps


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.9-2.3.8.1.el5
changelog:
  - Added some of the latest Fedora spec bugfixes
  - Bumped release
  - zlib in BuildReq restricted for  1.2.3-7 or higher
   - see https://bugzilla.redhat.com/show_bug.cgi?id=904231
  - Removed a -icedtea tag from the version
    - package have less and less connections to icedtea7
  - Added gcc-c++ build dependence. Sometimes caused troubles during rpm -bb
  - Added (Build)Requires for fontconfig and xorg-x11-fonts-Type1
    - see https://bugzilla.redhat.com/show_bug.cgi?id=721033 for details
  - logging.properties marked as config(noreplace)
    - see https://bugzilla.redhat.com/show_bug.cgi?id=679180 for details
  - nss.cfg was marked as config(noreplace)
  - slaves sync with el6
  - Resolves: rhbz#950376


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.19-2.3.9.0.el5
changelog:
  - updated to IcedTea  2.3.9 with latest security patches
  - buildver sync to b19
  - rewritten java-1.7.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#950376


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.19-2.3.9.1.el5
changelog:
  - updated to updated IcedTea  2.3.9 with fix to one of security fixes
    -  fixed font glyph offset
  - Resolves: rhbz#950376


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.4.1.el5]
changelog:
  - [virt] xen-netback: backports (Andrew Jones) [910884 910885] {CVE-2013-0216}
  - [virt] xen-netback: netif_schedulable should take a netif (Andrew Jones) [910884 910885] {CVE-2013-0216}
  - [virt] pciback: rate limit error mess from pciback_enable_msi() (Igor Mammedov) [910876 910877] {CVE-2013-0231}
  - [net] be2net: remove BUG_ON() in be_mcc_compl_is_new() (Ivan Vecera) [923910 907524]
  - [net] ipv4: Update MTU to all related cache entries (Amerigo Wang) [923353 905190]
  - [net] annotate rt_hash_code() users (Amerigo Wang) [923353 905190]
  - [net] xfrm_user: fix info leak in copy_to_user_state() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_policy() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_tmpl() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] atm: fix info leak in getsockopt(SO_ATMPVC) (Thomas Graf) [922384 922385] {CVE-2012-6546}
  - [net] atm: fix info leak via getsockname() (Thomas Graf) [922384 922385] {CVE-2012-6546}
  - [net] tun: fix ioctl() based info leaks (Thomas Graf) [922348 922349] {CVE-2012-6547}
  - [net] llc, zero sockaddr_llc struct (Thomas Graf) [922327 922329] {CVE-2012-6542}
  - [net] llc: fix info leak via getsockname() (Thomas Graf) [922327 922329] {CVE-2012-6542}
  - [net] xfrm_user: return error pointer instead of NULL (Thomas Graf) [919386 919387] {CVE-2013-1826}
  - [net] ixgbevf: allocate room for mailbox MSI-X interrupt's name (Laszlo Ersek) [924134 862862]
  - [fs] knfsd: allow nfsd READDIR to return 64bit cookies (Niels de Vos) [924087 918952]


author: Kamil Dudka <kdudka@redhat.com> 7.15.5-14
changelog:
  - fix stack smashing in the FTP implementation (#652557)
  - fix proxy kerberos authentication (#657396)
  - update running_handles counter properly in curl_multi_remove_handle (#688871)


author: Carlos O'Donell <carlos@redhat.com> - 2.5-107.3
changelog:
  - Fix multibyte character processing crash in regexp (CVE-2013-0242, #951130)
    - Fix getaddrinfo stack overflow resulting in application crash (CVE-2013-1914, #951130)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.59.1.11.11
changelog:
  - Updated to icedtea6 1.11.11 - fixed xalan/xerxes privledges
  - removed patch 9 -  removingOfAarch64.patch.patch - fixed upstream
  - removed patch10  patchToFixMalformed8007667.patch - upstreamed
  - Resolves: rhbz#950383


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.39.1.11.11
changelog:
  - added and applied (temporally) one more patch to xalan/xerces privileges
   - patch9 jaxp-backport-factoryfinder.patch
  - will be upstreamed
  - Resolves: rhbz#950383


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950383


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-spec_sl_index.html.sl.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Ran Regex: (Release: .*).el5(.*) => \1.sl5\2
  -->  Modify release string to note changes
  - Ran Regex: vstring Red Hat => vstring Scientific Linux
  -->  This package must not feature TUVs branding
  - Ran Regex: distro Red Hat => distro Scientific Linux
  -->  This package must not feature TUVs branding
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.6.1.el5]
changelog:
  - [char] ipmi: use a tasklet for handling received messages (Tony Camuso) [953435 947732]
  - [char] ipmi: do run_to_completion properly in deliver_recv_msg (Tony Camuso) [953435 947732]
  - [fs] nfs4: fix locking around cl_state_owners list (Dave Wysochanski) [954296 948317]
  - [fs] nfs: Fix bugs on short read (Sachin Prabhu) [952098 924011]
  - [xen] AMD IOMMU: spot missing IO-APIC entries in IVRS table (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: Make per-device interrupt remap table default (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: Disable IOMMU if SATA Combined mode is on (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: On creating entry clean up in remapping tables (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] ACPI: acpi_table_parse() should return handler's err code (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] introduce xzalloc() & Co (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531]


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.39
changelog:
  - Resolves: CVE-2013-1976 Improper TOMCAT_LOG management in 
  - initscript. Change location of TOMCAT_LOG to /var/log so
  - only root can write to it. Touching TOMCAT_LOG is no longer 
  - required during initscript startup. Permissions and ownership
  - changed to 0755 tomcat:root for logdir


author: David Knox <dknox@redhat.com> 0:5.5.23-0jpp.40
changelog:
  - Related: CVE-2013-1976 It was found during additional testing
  - that the tomcat5 init may fail to start because the user
  - shell is set to sbin/nologin. Fixed in init scrip. SU now
  - uses -s /bin/sh during startup


author: Adam Jackson <ajax@redhat.com> 6.5.1-7.10
changelog:
  - mesa-6.5.1-nonconformant-visual.patch: Don't warn about the non-
    conformant synthetic Composite visual (#442738)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Ran Regex: (Release: .*) => \1.slf5
  -->  Modify release string to note changes for SLF5
  - Added Source: krb5.ini
  -->  Config file for automated patch script
  - Added Patch: krb5_krb5-mwm-kshd.patch
  -->  Fix sync bug, see BZ#658217


author: Petr Machata <pmachata@redhat.com> - 2013c-1
changelog:
  - Upstream 2013c
    - Sync past stamps for Palestine and West Bank with timeanddate.com
    - Assume that the recent change to Paraguay's DST rules is permanent
    - Macquarie was uninhabited between 1919 and 1948.  It's also part
      of Australia (update in zone.tab).


author: Lars Marowsky-Bree <lmb@suse.de>
changelog:
  - version 2.99.1-1
  - Update source tarball to revision: d8710f41b9cb
  - Includes many fixes to init scripts.
  - Add sbd for shared-storage fencing.


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.10.2.el5
changelog:
  - added patch1000 MBeanFix.patch to fix regressions caused by security patches
  - Resolves: rhbz#973117


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.3.10.4.el5
changelog:
  - updated to newer IcedTea7-forest 2.3.10 with 8010118 fix
  - removed upstreamed patch1000 MBeanFix.patch
  - Resolves: rhbz#973117


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.14.1.el5]
changelog:
  - [net] Fix panic for vlan over gre via tun (Thomas Graf) [983452 981337]
  - [x86] mm: introduce proper mem barriers smp_invalidate_interrupt (Rafael Aquini) [983628 865095]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.15.1.el5]
changelog:
  - [fs] nfs: flush cached dir information slightly more readily (Scott Mayhew) [976441 853145]
  - [fs] nfs: Fix resolution prob with cache_change_attribute (Scott Mayhew) [976441 853145]
  - [fs] nfs: define function to update nfsi->cache_change_attribute (Scott Mayhew) [976441 853145]
  - [net] af_key: fix info leaks in notify messages (Jiri Benc) [980999 981000] {CVE-2013-2234}
  - [net] af_key: initialize satype in key_notify_policy_flush() (Jiri Benc) [981222 981224] {CVE-2013-2237}
  - [net] ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Jiri Pirko) [981556 981557] {CVE-2013-2232}
  - [net] fix invalid free in ip_cmsg_send() callers (Petr Matousek) [980141 980142] {CVE-2013-2224}
  - [x86_64] Early segment setup for VT (Paolo Bonzini) [979920 978305]
  - [block] cpqarray: info leak in ida_locked_ioctl() (Tomas Henzl) [971245 971246] {CVE-2013-2147}
  - [block] cdrom: use kzalloc() for failing hardware (Frantisek Hrbata) [973103 973104] {CVE-2013-2164}
  - [mm] Break out when there is nothing more to write for the fs. (Larry Woodman) [972583 965359]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.16.1.el5]
changelog:
  - [x86_64] Fix kdump failure due to 'x86_64: Early segment setup' (Paolo Bonzini) [988251 987244]
  - [xen] skip tracing if it was disabled instead of dying (Igor Mammedov) [987976 967053]
  - [ia64] fix KABI breakage on ia64 (Prarit Bhargava) [966878 960783]
  - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531]


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.41.1.11.11.90
changelog:
  - updated to icedtea6-1.11.11.90.tar.gz
  - removed upstreamed patch9 jaxp-backport-factoryfinder.patch
  - removed upstreamed patch10 fixToFontSecurityFix.patch.
  - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#973126


author: Petr Machata <pmachata@redhat.com> - 2013c-2
changelog:
  - Update descriptions in iso3166.tab; make Jerusalem coordinates in
    zone.tab more precise
    (0001-Adjust-commentary-to-try-to-defuse-recent-issues-som.patch)
  - Update local mean time for Jerusalem to match more-precise longitude
    (0002-asia-Asia-Jerusalem-Fix-LMT-to-match-more-precise-lo.patch)
  - Move Morocco's midsummer 2013 transitions
    (0003-Move-Morocco-s-midsummer-2013-transitions.patch)
    Fixes 980805 980807 981019 981020
  - Israel now falls back on the last Sunday of October
    (0004-Israel-now-falls-back-on-the-last-Sunday-of-October.patch)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.10.1.el5]
changelog:
  - [net] Bluetooth: fix possible info leak in bt_sock_recvmsg() (Radomir Vrbovsky) [955600 955601] {CVE-2013-3224}
  - [net] Bluetooth: HCI & L2CAP information leaks (Jacob Tanenbaum) [922415 922416] {CVE-2012-6544}
  - [misc] signal: use __ARCH_HAS_SA_RESTORER instead of SA_RESTORER (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [misc] signal: always clear sa_restorer on execve (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [misc] signal: Def __ARCH_HAS_SA_RESTORER for sa_restorer clear (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [net] cxgb4: zero out another firmware request struct (Jay Fenlason) [971872 872531]
  - [net] cxgb4: clear out most firmware request structures (Jay Fenlason) [971872 872531]
  - [kernel] Make futex_wait() use an hrtimer for timeout (Prarit Bhargava) [958021 864648]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.11.1.el5]
changelog:
  - Revert: [kernel] kmod: make request_module() killable (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] kmod: avoid deadlock from recursive kmod call (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] wait_for_helper: remove unneeded do_sigaction() (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] Fix ____call_usermodehelper errs being silently ignored (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] wait_for_helper: SIGCHLD from u/s cause use-after-free (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] kmod: avoid deadlock from recursive request_module call (Frantisek Hrbata) [957152 949568]
  - Revert: [x86-64] non lazy sleazy fpu implementation (Prarit Bhargava) [948187 731531]
  - Revert: [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - Revert: [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - Revert: [ia64] fix KABI breakage on ia64 (Prarit Bhargava) [966878 960783]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.12.1.el5]
changelog:
  - Revert: [fs] afs: export a couple of core functions for AFS write support (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: drop ec_type from the ext4_ext_cache structure (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: handle NULL p_ext in ext4_ext_next_allocated_block() (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: make FIEMAP and delayed allocation play well together (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: Fix possibly very long loop in fiemap (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: prevent race while walking extent tree for fiemap (Lukas Czerner) [960014 692071]


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-30
changelog:
  - hostname check bypassing vulnerability in SSL client.
    * ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch
    - Resolves: rhbz#979297


author: Vít Ondruch <vondruch@redhat.com> - 1.8.5-31
changelog:
  - Fix regression introduced by CVE-2013-4073
    https://bugs.ruby-lang.org/issues/8575
    * ruby-2.0.0-p255-Fix-SSL-client-connection-crash-for-SAN-marked-critical.patch
    - Related: rhbz#979297


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-83.SLx
changelog:
  - 1.4.15 security release addressing openafs-sa-2013-0003 and -0004
  - see SECURITY.txt for important info on how to actually secure your site
  - just updating to this build is *not* sufficient


author: Remi Collet <rcollet@redhat.com> - 5.3.3-23
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-30
changelog:
  - fix CVE-2014-0221 - recursion in DTLS code leading to DoS
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Fix rpmdiff test reported failures and remove other unwanted changes
  - Resolves: rhbz#949845 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Define -DNO_FORK_CHECK when compiling softoken for ABI compatibility
  - Remove the unused and obsolete nss-nochktest.patch
  - Resolves: rhbz#949845 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue


author: Bryn M. Reeves <bmr@redhat.com> - 1.7-9.62
changelog:
  - Always log plugin exceptions that are not raised to the interpreter
    Resolves: bz717480
  - Ensure relative symlink targets are correctly handled when copying
    Resolves: bz717962
  - Correctly handle libxml2 parser exceptions when reading cluster.conf
    Resolves: bz750573
  - Update Red Hat Certificate System plugin for current versions
    Resolves: bz627416


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-spec_sl_index.html.sl.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Ran Regex: vstring Red Hat => vstring Scientific Linux
  -->  This package must not feature TUVs branding
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl5\2
  -->  Modify release string to note changes
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd.ini
  -->  Config file for automated patch script
  - Ran Regex: distro Red Hat Enterprise Linux => distro Scientific Linux
  -->  This package must not feature TUVs branding


author: Ray Strode <rstrode@redhat.com> 2.16.0-59.1
changelog:
  - Don't try to pre-create directories that are internal
    implementation details of X.
    Resolves: #997619 CVE-2013-4169


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: gdm-change-theme.patch
  -->  The theme from TUV is not the theme we want to use
  - Added Source: gdm.ini
  -->  Config file for automated patch script
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl5\2
  -->  Modify release string to note changes


author: Martin Stransky <stransky@redhat.com> - 17.0.8-3
changelog:
  - Fixed rhbz#818636 - Firefox allows install of addons,
    disregarding xpinstall.enabled flag set as false.


author: Martin Stransky <stransky@redhat.com> - 17.0.8-4
changelog:
  - Added fix for mozbz#601442 - Support the extensions.getAddons.showPane 
    pref again in the Add-ons Manager UI, a part of rhbz#818636 fix.


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.17.1.el5]
changelog:
  - [net] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [999819 995961]
  - [net] be2net: Mark checksum fail for IP fragmented packets (Ivan Vecera) [983864 956322]
  - [net] be2net: Avoid double insertion of vlan tags (Ivan Vecera) [983864 956322]
  - [net] be2net: disable TX in be_close() (Ivan Vecera) [983864 956322]
  - [net] be2net: fix EQ from getting full while cleaning RX CQ (Ivan Vecera) [983864 956322]
  - [net] be2net: avoid napi_disable() when not enabled (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix receive Multicast Packets w/ Promiscuous mode (Ivan Vecera) [983864 956322]
  - [net] be2net: Fixed memory leak (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix PVID tag offload for packets w/ inline VLAN tag (Ivan Vecera) [983864 956322]
  - [net] be2net: fix a Tx stall bug caused by a specific ipv6 packet (Ivan Vecera) [983864 956322]
  - [net] be2net: Remove an incorrect pvid check in Tx (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix issues in error recovery with wrong queue state (Ivan Vecera) [983864 956322]
  - [net] netpoll: revert 6bdb7fe3104 and fix be_poll() instead (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix to parse RSS hash Receive completions correctly (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix cleanup path when EQ creation fails (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix Endian (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix to trim skb for padded vlan packets (Ivan Vecera) [983864 956322]
  - [net] be2net: Explicitly clear reserved field in Tx Descriptor (Ivan Vecera) [983864 956322]
  - [net] be2net: remove unnecessary usage of unlikely() (Ivan Vecera) [983864 956322]
  - [net] be2net: do not modify PCI MaxReadReq size (Ivan Vecera) [983864 956322]
  - [net] be2net: cleanup be_vid_config() (Ivan Vecera) [983864 956322]
  - [net] be2net: don't call vid_config() when there no vlan config (Ivan Vecera) [983864 956322]
  - [net] be2net: Ignore status of some ioctls during driver load (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix wrong status getting returned for MCC commands (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix VLAN/multicast packet reception (Ivan Vecera) [983864 956322]
  - [net] be2net: fix wrong frag_idx reported by RX CQ (Ivan Vecera) [983864 956322]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.18.1.el5]
changelog:
  - [net] be2net: enable polling prior enabling interrupts globally (Ivan Vecera) [1005239 987539]
  - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970874 970875] {CVE-2013-2141}
  - [net] ipv6: do udp_push_pending_frames AF_INET sock pending data (Jiri Benc) [987647 987648] {CVE-2013-4162}
  - [mm] use-after-free in madvise_remove() (Jacob Tanenbaum) [849735 849736] {CVE-2012-3511}
  - [fs] autofs: remove autofs dentry mount check (Ian Kent) [1001488 928098]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.1-68
changelog:
  - Add a forgotten break in a switch statement
  - Related: rhbz#886165 - sssd will stop functioning correctly if sssd_be
                           hangs for a while


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.1-69
changelog:
  - Fix startup with a broken configuration
  - Resolves: rhbz#974036 - sssd core process keeps running after backends quit


author: Jakub Hrozek <jhrozek@redhat.com> - 1.5.1-70
changelog:
  - Fix IPA provider performance issue when storing large host groups
  - Resolves: rhbz#979047 - sssd_be goes to 99% CPU and causes significant
                            login delays when client is under load


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-118.1
changelog:
  - Add support for newer L3 caches on x86-64 and correctly count
    the number of hardware threads sharing a cacheline (#1011424).


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115873


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.71-2.5.3.1
changelog:
  - Bump to 2.5.3 with security updates.
  - Remove obsolete patches which are now included upstream.
  - Disable LCMS via environment variables rather than maintaining a patch.
  - Resolves: rhbz#1148890


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-5.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - renmoved upstreamed patch9, 1051245.patch
  - Resolves: rhbz#1085008


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - Resolves: rhbz#1115866


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.33-1.13.5.0
changelog:
  - Update to IcedTea 1.13.5
  - Change versioning to match java-1.7.0-openjdk so revisions work.
  - No need to explicitly disable system LCMS any more (bug fixed upstream).
  - Add icedteasnapshot to setup lines so they work with pre-release tarballs.
  - Resolves: rhbz#1148898


author: Stephen Gallagher <sgallagh@redhat.com> - 2.0.1-13
changelog:
  - Run 'make test' during RPM build
  - Resolves: rhbz#837853 - talloc doesn't ensure that the sibling linked list
                            remains valid during a free


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-1
changelog:
  - Rebase to 2.0.7
  - Resolves: rhbz#855862 - Rebase libtalloc to version 2.0.7 to pick
                            the latest bug fixes


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-2
changelog:
  - Mark libraries as executable so that they are stripped and included
    in the -debuginfo
  - Resolves: rhbz#855862 - Rebase libtalloc to version 2.0.7 to pick
                            the latest bug fixes


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-1
changelog:
  - Resolves: rhbz#951045 - Rebase libtevent to version 0.9.18
  - Relax libtalloc requirements - only require 2.0.7 and do not check for
    pytalloc presence if python is disabled
  - Drop the ABI compatibility patch (no longer needed)
  - Drop the tevent_signal segv patch (upstreamed)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-2
changelog:
  - Resolves: rhbz#975488 - Additional flags might have no effect
                            on 32bit architectures


author: Jan Synáček <jsynacek@redhat.com> -2:2.3.14-18
changelog:
  - Fix leaking file descriptors (#852274)
  - Fix: Service disabled due to bind failure (#811000)
  - CVE-2012-0862 xinetd: enables unintentional services over tcpmux port (#788795)


author: - Andreas Schneider <asn@redhat.com> - 3.6.6-0.134
changelog:
  - Check for system libtevent and require version 0.9.18.
  - Use tevent epoll backend in winbind.
  - resolves: #869295


author: - Andreas Schneider <asn@redhat.com> - 3.6.6-0.135
changelog:
  - Fix PIDL parsing with newer versions of gcc.
  - Fix dereferencing a unique pointer in the WKSSVC server.
  - resolves: #982484


author: - Andreas Schneider <asn@redhat.com> - 3.6.6-0.136
changelog:
  - resolves: #984807 - CVE-2013-4124: DoS via integer overflow when reading
                        an EA list


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-26
changelog:
  - updated sudoers man-page to clarify the behavior of the user
    negation operator and the behavior of wildcard matching in command
    specifications
    Resolves: rhbz#846118
    Resolves: rhbz#856902


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-27
changelog:
  - visudo: fixed incorrect warning and parse error regarding
    undefined aliases which were in fact defined
    Resolves: rhbz#849679
    Resolves: rhbz#905624


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-28
changelog:
  - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-2777
    Resolves: rhbz#968221


author: Tom Lane <tgl@redhat.com> 2.2.11-9
changelog:
  - split out libraries into a -libs subpackage, to allow them to be installed
    concurrently with unixODBC64-libs
  Resolves: #497016


author: Tom Lane <tgl@redhat.com> 2.2.11-10
changelog:
  - Compile with -fno-strict-aliasing, per rpmdiff complaint.
  - Install icons in /usr/share/pixmaps, not /usr/share/icons as this package
    has historically done; the former is considered correct.  Also per rpmdiff.
  Related: #497016


author: Tom Lane <tgl@redhat.com> 2.2.14-1
changelog:
  - Constructed from current Fedora package, removing -kde subpackage because
    2.2.14 seems to need a newer version of Qt than RHEL-5 provides.
  - Split libraries into a -libs subpackage to allow installation concurrent
    with the original unixODBC package (or at least its -libs subpackage).
  Resolves: #742597


author: Tom Lane <tgl@redhat.com> 2.2.14-2
changelog:
  - Treat ia64 as a multilib architecture, because rpmdiff has started to
    whinge about it
  Related: #742597


author: Phillip Lougher <plougher@redhat.com> [2.6.18-369.el5]
changelog:
  - [fs] nlm: Ensure we resend pending blocking locks after a reclaim (Steve Dickson) [918592]
  - [kernel] kmod: kthread_run causes oom killer deadlock (Frantisek Hrbata) [983506]
  - [fs] nfs4: ratelimit some messages, add name to bad seq-id mess (Dave Wysochanski) [953121]
  - [fs] nfsd: fix EXDEV checking in rename (J. Bruce Fields) [515599]
  - [misc] tty: Fix abusers of current-sighand->tty (Aaron Tomlin) [858981]
  - [net] ipv6: don't call addrconf_dst_alloc again when enable lo (Jiri Benc) [981417]
  - [redhat] kabi: Adding symbol fc_fabric_login (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_recv (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_reset (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_recv (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_destroy (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_els_send (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_destroy (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_fabric_logoff (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_set_mfs (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_elsct_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_link_up (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_recv_flogi (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_change_queue_depth (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_link_down (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_change_queue_type (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_free (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_alloc (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_config (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_disc_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol strict_strtoul (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_rport_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_get_host_port_state (Jiri Olsa) [864256]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-370.el5]
changelog:
  - [net] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [995961]
  - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970875] {CVE-2013-2141}


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.100
changelog:
  - xserver-1.1.1-more-regen-leaks.patch: Cope with root cursor refcounting
    being differently broken in different DDXes. (#498357)


author: Tomas Mraz <tmraz@redhat.com> - 2.0.10-5
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Tomas Mraz <tmraz@redhat.com> - 1.4.5-17
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4242 GnuPG susceptible to Yarom/Falkner side-channel attack
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.25-2.4.1.4.el5
changelog:
  - updated to icedtea 2.4.1
  - improoved handling of patch111 - nss-config-2.patch
  - backported uniquesuffix from 6.5
  - Resolves: rhbz#978421


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.45-2.4.3.0.el5
changelog:
  - fixed and updated tapset
  - removed bootstrap
  - source 11 redeclared to 1111
  - added source12: TestCryptoLevel.java
  - removed upstreamed patch103 java-1.7.0-openjdk-arm-fixes.patch
  - removed unnecessary patch112 java-1.7.0-openjdk-doNotUseDisabledEcc.patch
  - added patch120: java-1.7.0-openjdk-freetype-check-fix.patch
  - fixed nss 
  - cleaned sources
  - Resolves: rhbz#1017623


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.1.1.el5]
changelog:
  - [crypto] ansi_cprng fix off by one err in non-block size request (Neil Horman) [1007692 1007693] {CVE-2013-4345}
  - [fs] gfs2: yield() in shrinker to allow glock_workqueues to run (Abhijith Das) [1014714 928518]
  - [net] ipv6: ipv6_create_tempaddr cleanup (Petr Holasek) [999361 999362] {CVE-2013-0343}
  - [net] ipv6: remove max_addresses check from ipv6_create_tempaddr (Petr Holasek) [999361 999362] {CVE-2013-0343}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.1.2.el5]
changelog:
  - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368}
  - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299}


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950384


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.41.1.11.11.90
changelog:
  - updated to icedtea6-1.11.11.90.tar.gz
  - removed upstreamed patch9 jaxp-backport-factoryfinder.patch
  - removed upstreamed patch10 fixToFontSecurityFix.patch.
  - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#973128


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.42.1.11.14
changelog:
  - updated to icedtea6-1.11.14.tar.gz
  - added and applied 1.11.14-fixes.patch, patch10 to fix build issues
  - Resolves: rhbz#1017615


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830724


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852019


author: Jozef Mlich <jmlich@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017833)


author: Honza Horak <hhorak@redhat.com> 5.1.69-6
changelog:
  - Restore SELinux context after installing -server package
  - Sub-package -test should require -libs
  - Added BuildRequire: scl-utils-build for any case


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #986138


author: Honza Horak <hhorak@redhat.com> 1-10
changelog:
  - Handle context of the init script
  - Change context on whole root directory (libselinux is fixed now #953947)
  - Add better descriptions for packages
  - Create SELinux context rules also for RHEL-5


author: Honza Horak <hhorak@redhat.com> 5.5.32-1
changelog:
  - Update to MySQL 5.5.32, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-32.html
    Resolves: #975113
  - Use man pages from 5.5.30 due to license change
    Resolves: #975785
  - Fix issues found by Coverity
    Resolves: #975904


author: Honza Horak <hhorak@redhat.com> 5.5.32-2
changelog:
  - Fix text in mysql-readme-devel for RHEL-5
    Resolves: #975119
  - Fix misleading error message when uninstalling built-in plugins
    Resolves: #985402
  - Do not use pie linker flags, they don't work in RHEL-5
    Resolves: #985418


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.2.1.el5]
changelog:
  - [scsi] mpt2sas: bump version (Tomas Henzl) [1018458 956330]
  - [scsi] mpt2sas: fix the incorrect scsi_dma_map error checking (Tomas Henzl) [1018458 956330]
  - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368}
  - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.3.1.el5]
changelog:
  - [net] be2net: don't use GRO for packets w/ re-inserted VLAN tags (Ivan Vecera) [1023348 1008691]
  - [net] tg3: call pci_enable_wake() to set power state (John Feeney) [1014973 996331]
  - [misc] backport fixes for percpu-rw-semaphore (Mikulas Patocka) [1014715 867997]
  - [xen] information leak via I/O instruction emulation (Igor Mammedov) [1009602 1009603] {CVE-2013-4355}


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-6
changelog:
  - Bugzilla Bug #749401 - https://server.testrelm/ipa/xml: Bad Request
    intermittent errors
  - Bugzilla Bug #749402 - may be possible to spoof mod_nss FakeBasicAuth
  - Bugzilla Bug #749405 - mod_nss fails debug assertion
  - Bugzilla Bug #749406 - Add 'libnssckbi.so' runtime dependency . .


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-7
changelog:
  - Fix 'Bugzilla Bug #749405 - mod_nss fails debug assertion' by removing
    'mod_nss-no_shutdown_if_not_init.patch' and applying
    'mod_nss-no_shutdown_if_not_init_2.patch' instead
  - The 'mod_nss-no_shutdown_if_not_init_2.patch' patch also fixes
    Bugzilla Bug #784548 - File descriptor leak after "service httpd reload"
    or httpd doesn't reload


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-8
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #989724 - mod_nss does not respect `NSSVerifyClient` in
    Directory [rhel-5.10.z]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Retagging to fix an inconsitency in the release tags
  - Resolves: rhbz#1002641 - Rebase RHEL 5 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-1
changelog:
  - Update to nspr-4.10.2
  - Remove an unused patch
  - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Fix changelog comments
  - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-1
changelog:
  - Update to nss-3.15.3
  - Remove unused patch
  - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]


author: Kai Engert <kaie@redhat.com> - 3.15.3-3
changelog:
  - remove unnecessary and problematic template-removal patch
    which was added as part of the 3.15.1 rebase
  - bump release number


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Revoke trust in one mis-issued anssi certificate
  - Resolves: Bug 1042683 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117)


author: Patsy Franklin <pfrankli@redhat.com> 2013i-1
changelog:
  - Rebase with early release of 2013i from Paul Eggert github.
    - Jordan switches back to standard time at 00:00 on December 20,2013.
    - The 2006-2011 transition schedule is planned to resume in 2014.
    - The compile-time flag NOSOLAR has been removed.
    - The files solar87, solar88, and solar89 are no longer distributed.
    - tz-link.htm now mentions Noda Time.


author: Soren Sandmann <ssp@redhat.com> 1.2.2-1.0.5.el5
changelog:
  - cve-2013-6462.patch: sscanf overflow (bug 1049684)
  - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684)


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.51-2.4.4.1.el5
changelog:
  - updated to security icedtea 2.4.4
   - icedtea_version set to 2.4.4
   - updatever bumped to       51
   - release reset to 1
  - build requires: java-devel >= 1:1.6.0 changed java7-devel 
  - Resolves: rhbz#1050192


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-3.1.13.0
changelog:
  - updated to icedtea 1.13.1
   - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/
  - updated to jdk6, b30,  21_jan_2014
   - https://openjdk6.java.net/OpenJDK6-B30-Changes.html
  - adapted patch7 1.13_fixes.patch
  - pre 2011 changelog moved to (till now  wrong) pre-2009-spec-changelog (rh1043611)
  - added --disable-system-lcms to configure options to pass build
  - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#1050187


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.4.1.el5]
changelog:
  - [char] ipmi: fix message handling during panics (Tony Camuso) [1049731 995293]
  - [net] igb: Use 32bit mask calculating the flow control watermarks (Stefan Assmann) [1041694 1036115]
  - [fs] NTLM auth and sign - Use appropriate server challenge (Sachin Prabhu) [1029865 1018286]
  - [xen] gnttab: correct locking order reversal (Radim Krcmar) [1026245 1026246] {CVE-2013-4494}


author: Lukas Nykryn <lnykryn@redhat.com> - 8.45.44-1
changelog:
  - move VLAN= docs to the interface configuration section, rather than /etc/sysconfig/network (#860252)
  - fix comments in sysctl.conf (#862597)
  - sysctl.d manpage (#735982)
  - check_device_down: Don't bother calling ip to check link state if the device doesn't exist (#814058)
  - test if there is /dev/rtc before syncing hardware clock (#636861)
  - sysconfig.txt advised saslauthd -a instad of -v (#957109)


author: Pat Riehecky <riehecky@fnal.gov> 5x-2-0.sl5
changelog:
  - No longer conflicts with yum-conf-<release>
  - Now can be built for rolling with little risk to the real release


author: Honza Horak <hhorak@redhat.com> 5.5.36-1
changelog:
  - Update to MySQL 5.5.36, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-36.html
    Including fixes for CVE-2014-0412, CVE-2014-0437, CVE-2013-5908,
    CVE-2013-5807, CVE-2014-0420, CVE-2014-0393, CVE-2013-5891,
    CVE-2014-0386, CVE-2013-3839, CVE-2014-0401, CVE-2014-0402,
    Resolves: #1055875


author: Ryan O'Hara <rohara@redhat.com> 0.8.4-25
changelog:
  - Resolves: #739223 - ipvsadm errors should not be fatal
  - Resolves: #786364 - reread config can cause lvsd to segfault


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.6.1.el5]
changelog:
  - [net] be2net: don't use skb_get_queue_mapping() (Ivan Vecera) [1066302 1063955]
  - [ipc] change refcount to atomic_t (Phillip Lougher) [1024866 1024868] {CVE-2013-4483}
  - [s390] qeth: buffer overflow in snmp ioctl (Jacob Tanenbaum) [1034402 1034404] {CVE-2013-6381}
  - [scsi] AACRAID Driver compat IOCTL missing capability check (Jacob Tanenbaum) [1033531 1033532] {CVE-2013-6383}
  - [xen] x86/AMD: work around erratum 793 (Radim Krcmar) [1035834 1035836] {CVE-2013-6885}
  - [xen] do not expose hypercalls to rings 1 and 2 of HVM guests (Andrew Jones) [1029112 1029113] {CVE-2013-4554}
  - [redhat] kabi: Adding symbol print_hex_dump (Jiri Olsa) [1054055 662558]
  - [scsi] Add 'eh_deadline' to limit SCSI EH runtime (Ewan Milne) [1050097 956132]
  - [scsi] remove check for 'resetting' (Ewan Milne) [1050097 956132]
  - [scsi] dc395: Move 'last_reset' into internal host structure (Ewan Milne) [1050097 956132]
  - [scsi] tmscsim: Move 'last_reset' into host structure (Ewan Milne) [1050097 956132]
  - [scsi] advansys: Remove 'last_reset' references (Ewan Milne) [1050097 956132]
  - [scsi] dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset (Ewan Milne) [1050097 956132]
  - [scsi] dpt_i2o: Remove DPTI_STATE_IOCTL (Ewan Milne) [1050097 956132]
  - [net] ipv6: fix leaking uninit port number of offender sockaddr (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] fix addr_len/msg->msg_namelen assign in recv_error funcs (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] prevent leakage of uninitialized memory to user in recv (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] be2net: prevent Tx stall on SH-R when packet size < 32 (Ivan Vecera) [1051535 1007995]
  - [net] be2net: Trim padded packets for Lancer (Ivan Vecera) [1051535 1007995]
  - [net] be2net: Pad skb to meet min Tx pkt size in lancer (Ivan Vecera) [1051535 1007995]
  - [net] be2net: refactor HW workarounds in be_xmit() (Ivan Vecera) [1051535 1007995]
  - [fs] exec/ptrace: fix get_dumpable() incorrect tests (Petr Oros) [1039483 1039484] {CVE-2013-2929}


author: Pat Riehecky <riehecky@fnal.gov> 4.2.6-4
changelog:
  - switched to a define based ntp server list
  - updated ntp server list
  - made version independent, now works on SLF5 and SLF6
  - added comments to help explain the configuration options


author: Pat Riehecky <riehecky@fnal.gov> 4.2.6-5
changelog:
  - switched to 'bash' for triggers and post to avoid errors
  - updated requires list to get things more in order


author: Pat Riehecky <riehecky@fnal.gov> 4.2.6-6
changelog:
  - removing "restrict 131.225.0.0 mask 255.255.0.0 nomodify noquery"
      per RITM0088723
  - switched to augeas based config to try and simplify the transition


author: Tom Lane <tgl@redhat.com> 3.8.2-17
changelog:
  - Fix incomplete patch for CVE-2012-3401
  - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works
    with pre-4.0.2 libtiff
  Resolves: #885309


author: Petr Hracek <phracek@redhat.com> - 3.8.2-19
changelog:
  - Resolves: #1063460 CVE-2013-1960 CVE-2013-1961 CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244
    libtiff various flaws


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065839) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 1.4.1-14
changelog:
  - Renamed gnutls-1.4.1-cve-2014-0092-1.patch to cve-2014-5138.patch
  - Renamed gnutls-1.4.1-cve-2014-0092-2.patch to cve-2014-0092.patch


author: Pavel Raiskup <praiskup@redhat.com> - 8.1.23-9
changelog:
  - fix #1065840: CVE-2014-0060, CVE-2014-0061, CVE-2014-0063, CVE-2014-0064,
    CVE-2014-0065
  - better incorporate strlcpy function (upstream git diff c92f7e..062421)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p1-29
changelog:
  - added patch for CVE-2014-0106: certain environment variables not
    sanitized when env_reset is disabled
    Resolves: rhbz#1072210


author: Pat Riehecky <riehecky@fnal.gov> 0.9.9-15
changelog:
  - added missing dependency on /bin/mail
  - added /usr/lib/perl5/vendor_perl to @INC for non SLF systems (patch)
  - added /usr/share/perl5/vendor_perl to @INC for non SLF systems (patch)


author: Pat Riehecky <riehecky@fnal.gov> 0.9.9-16
changelog:
  - made /etc/sysconfig/ocsinventory-fermi for control values
  - merged Connie's 'ip addr' patch for the cronjob
  - added requirement for iproute and iputils
  - added extra check for DNS resolution
  - added syntax check for cronjob at build time


author: Connie Sieh <csieh@fnal.gov> 0.9.9-17
changelog:
  - On SLF 6 some systems now use a name other than ethx for ethernet
  - On Dell systems in particular  em1 is used 
  - Symptom of this was no "NETWORKS" entry sent to server


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-19
changelog:
  - fixed support for port numbers in 'clientaddr' configuration option
    (#840861, #845974)
  - added support of cvfs filesystem hrStorageTable (#846391)
  - removed various error log messages when IPv6 is disabled (#845155)
  - removed various error log messages related to counte64 expansions
    (#846905)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20
changelog:
  - fixed error message when the address specified by clientaddr option
    is wrong or cannot be bound (#840861)


author: Jan Safranek <jsafrane@redhat.com> - 5.3.2.2-20.1
changelog:
  - Fixed CVE-2012-6151: snmpd crashing when AgentX subagent disconnects in
    the middle of request processing (#1073224)
  - Fixed CVE-2014-2285: snmptrapd crash when using a trap with empty community
    string (#1073224)


author: Patsy Franklin <pfrankli@redhat.com> - 2014b-1
changelog:
  - Rebase to 2014b
    - Crimea switches to Moscow time on 2014-03-30 at 02:00 local time.
    - New entry for Troll station, Antarctica.


author: Peter Hatina <phatina@redhat.com> 1.0.15-6
changelog:
  - security patches
  - Resolves: CVE-2012-6056
              CVE-2012-6060
              CVE-2012-6061
              CVE-2012-6062
              CVE-2013-3557
              CVE-2013-3559
              CVE-2013-4081
              CVE-2013-4083
              CVE-2013-4927
              CVE-2013-4931
              CVE-2013-4932
              CVE-2013-4933
              CVE-2013-4934
              CVE-2013-4935
              CVE-2013-5721
              CVE-2013-7112
              CVE-2014-2281
              CVE-2014-2299


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-5.1.13.3
changelog:
  - updated to icedtea 1.13.3
  - updated to openjdk-6-src-b31-15_apr_2014
  - renmoved upstreamed patch7, 1.13_fixes.patch
  - Resolves: rhbz#1085007


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.55-2.4.7.0.el5
changelog:
  - bumped to future icedtea-forest 2.4.7
  - updatever set to 55, buildver se to 13, release reset to 0
  - removed BuildRequires on pulseaudio >= 0.9.1, devel is enough
  - removed Requires: rhino, BuildRequires is enough
  - updated patch400, java-1.7.0-openjdk-remove-gstabs.patch
  - added JRE_RELEASE_VERSION and ALT_PARALLEL_COMPILE_JOBS
  - ppc64 repalced by power64 macro
  - patch111 applied as dry-run (6.5 forward port)
  - Resolves: rhbz#1085000


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.7.1.el5]
changelog:
  - [s390x] af_iucv: Kernel panic during connect (IUCV transport) (Hendrik Brueckner) [1077045 1026388]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.8.1.el5]
changelog:
  - [virt] HID: memory corruption flaw drivers/usb/input/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888}
  - [virt] HID: memory corruption flaw in drivers/hv/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888}
  - [scsi] lpfc: Fix task management commands having a fixed timeout (Ewan Milne) [1073123 1061120]
  - [net] tcp: drop SYN+FIN messages (Jiri Pirko) [1066057 1066058] {CVE-2012-6638}
  - [fs] GFS2: Check if glock held in gfs2_readpage (Robert S Peterson) [1073953 1063434]
  - [net] sunrpc: fix deadlock in task wakeup code (Jeff Layton) [1073731 998126]


author: Martin Stransky <stransky@redhat.com> - 24.4.0-3
changelog:
  - Added a workaround for Bug 1054242 - RHEVM: Extremely high memory
    usage in Firefox 24 ESR on RHEL 6.5


author: Deepak Bhole <dbhole@redhat.com> 1.2.9-4jpp.7
changelog:
  - Resolves: rhbz#1092457
  - CVE-2014-0114: Fixed ClassLoader manipulation vulnerability
  - Added dist tag to release


author: Honza Horak <hhorak@redhat.com> - 5.5.37-1
changelog:
  - Update to MySQL 5.5.37, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html
    Includes fixes for: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432
    CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1089202


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 1.4.1-15
changelog:
  - fix session ID length check and null pointer dereference (#1102355)
  - fix minitasn1 issues (#1102355)
  - Renamed gnutls-1.4.1-cve-2014-5138.patch to cve-2009-5138.patch


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.9.1.el5]
changelog:
  - [nfs] sunrpc: don't use a credential with extra groups (Mateusz Guzik) [1095062 976201]
  - [scsi] lpfc: Remove NDLP reference put in lpfc_cmpl_els_logo_acc (Rob Evers) [1096061 1075228]
  - [infiniband] rds: dereference of a NULL device (Jacob Tanenbaum) [1079216 1079217] {CVE-2013-7339}
  - [kernel] futex: check relative timeouts for overflow (Denys Vlasenko) [1091832 1084168]
  - [virt] kvm: correctly detect KVM when hv emulation is enalbed (Jason Wang) [1094152 985767]
  - [security] Fix spurious warnings in security_ops_task_setrlimit (Mateusz Guzik) [1092869 916235]
  - [block] floppy: don't write kernel-only members to FDRAWCMD output (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737}
  - [block] floppy: ignore kernel-only members in FDRAWCMD input (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737}


author: Patsy Franklin <pfrankli@redhat.com> - 2014c-1
changelog:
  - Rebase to 2014c
    - Egypt's government to re-apply daylight saving time.
    - zic now generates transitions for minimum time values
    - Port to Cygwin sans glibc.
    - Remove now-confusing comment about Jordan.


author: Patsy Franklin <pfrankli@redhat.com> - 2014d-1
changelog:
  - Rebase to 2014d
    - zic no longer generates files containing time stamps before
      the Big Bang.  This works around GNOME bug 730332


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-1
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan 
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.6-0.140
changelog:
  - resolves: #1112150 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1112150 - CVE-2014-3493: DoS in smbd with unicode path names.


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115872


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.1-6.1.13.4
changelog:
  - moved to  icedteaver 1.13.4
  - moved to openjdkver b32 and openjdkdate 15_jul_2014
  - Resolves: rhbz#1115865


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.11.1.el5]
changelog:
  - [fs] dcache: fix cleanup on warning in d_splice_alias (Denys Vlasenko) [1109720 1080606]
  - [net] neigh: Make neigh_add_timer symmetrical to neigh_del_timer (Marcelo Ricardo Leitner) [1111195 1109888]
  - [net] neigh: set NUD_INCOMPLETE when probing router reachability (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: router reachability probing (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: probe routes asynchronous in rt6_probe (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ndisc: Update neigh->updated with write lock (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: remove the unnecessary statement in find_match() (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: fix route selection if CONFIG_IPV6_ROUTER_PREF unset (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: Fix def route failover when CONFIG_IPV6_ROUTER_PREF=n (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: Prefer reachable nexthop only if the caller requests (Marcelo Ricardo Leitner) [1106354 1090806]
  - [fs] ext4/jbd2: don't wait forever stale tid caused by wraparound (Eric Sandeen) [1097528 980268]
  - [fs] ext4: Initialize fsync transaction ids in ext4_new_inode() (Eric Sandeen) [1097528 980268]
  - [fs] jbd2: don't wake kjournald unnecessarily (Eric Sandeen) [1097528 980268]
  - [fs] jbd2: fix fsync() tid wraparound bug (Eric Sandeen) [1097528 980268]
  - [infiniband] rds: do not deref NULL dev in rds_iw_laddr_check() (Jacob Tanenbaum) [1093311 1093312] {CVE-2014-2678}
  - [fs] nfs4: Add recovery for individual stateids - partial backport. (Dave Wysochanski) [1113468 867570]
  - [fs] nfs4: Don't start state recovery in nfs4_close_done - clean backport. (Dave Wysochanski) [1113468 867570]
  - [xen] page-alloc: scrub anonymous domain heap pages upon freeing (Vitaly Kuznetsov) [1103648 1103649] {CVE-2014-4021}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.12.1.el5]
changelog:
  - [audit] auditsc: audit_krule mask accesses need bounds checking (Denys Vlasenko) [1102702 1102703] {CVE-2014-3917}
  - [mm] writeback: Fix hang when low on memory due to NFS traffic (Larry Woodman) [1125246 1080194]
  - [net] tg3: Fix Read DMA workaround for 5719 A0 (Ivan Vecera) [1121017 924590]
  - [fs] jbd: don't wake kjournald unnecessarily (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd: don't wait (forever) for stale tid caused by wraparound (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4: fix waiting and sending of barrier in ext4_sync_file() (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd2: Add function jbd2_trans_will_send_data_barrier() (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd2: fix sending of data flush on journal commit (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4, jbd2: Add barriers for file systems with ext journals (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd: fix fsync() tid wraparound bug (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4: fix fdatasync() for files with only i_size changes (Eric Sandeen) [1117665 1102768]


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-5
changelog:
  - Remove two unused patches
  - Resolves: Bug 1042683 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: yum-updatesd-spec_add-provides.patch
  -->  On SL5 you must have "yum-autoupdate" this adds the necessary provide
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl5\2
  -->  Modify release string to note changes
  - Added Source: yum-updatesd.ini
  -->  Config file for automated patch script


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.5-118.3
changelog:
  - Remove gconv transliteration loadable modules support (CVE-2014-5119,
    - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,


author: Michal Luscon <mluscon@redhat.com> 7:2.6.STABLE21-7
changelog:
  - Resolves: #1134976 - CVE-2013-4115 buffer overflow when processing overly long DNS names
  - Resolves: #1134976 - CVE-2014-3609 assertion failure in header processing


author: Olga Terlyga <terlyga@fnal.gov> 4.8-1
changelog:
  - Update  krb5.conf to v4.8 adding kdc to PILOT realm
  - Added i-krb-22 and added pilot KDCs t domain-realm section


author: Olga Terlyga <terlyga@fnal.gov> 5.0a-1
changelog:
  - Update krb5.conf to v5.0a adding new enctypes
  - Added aes256-cts-hmac-sha1-96  aes128-cts-hmac-sha1-96 des3-cbc-sha1
  - to default tgs,tkt and permitted enctypes


author: Olga Terlyga <terlyga@fnal.gov> 4.8-1
changelog:
  - Update  krb5.conf to v4.8 adding kdc to PILOT realm 
  - Added i-krb-22 and added pilot KDCs t domain-realm section


author: Olga Terlyga <terlyga@fnal.gov> 5.0-1
changelog:
  - Update krb5.conf to v5.0 adding new enctypes        
  - Added aes256-cts-hmac-sha1-96  aes128-cts-hmac-sha1-96 des3-cbc-sha1
  - to default tgs,tkt and permitted enctypes


author: Jan Pokorny <jpokorny@redhat.com> - 0.12.2-78
changelog:
  - luci: reflect startup_wait parameter added in postgres-8 RA
    Resolves: rhbz#1065263
  - luci: Multiple information leak flaws in various luci site extensions
    Resolves: rhbz#1076148


author: Jan Pokorny <jpokorny@redhat.com> - 0.12.2-79
changelog:
  - luci: drop unsuccessful monkey patch application wrt. Plone 20121106 advisory
    Related: rhbz#956861


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-1
changelog:
  - Rebase to nss-3.16.1 for FF31
  - Resolves: Bug 1110860 - Rebase nss in RHEL 5.11 to NSS 3.16.1, required for FF 31


author: Roman Rakus <rrakus@redhat.com> - 3.2-33
changelog:
  - Fixed a bug that caused trap handlers to be executed recursively,
    corrupting internal data structures.
    Resolves: #964753


author: Karsten Hopp <karsten@redhat.com> 1.9.6-2.3
changelog:
  - increase delay in self checks
  - add delays in aclocal7 self check
    http://osdir.com/ml/sysutils.automake.bugs/2006-09/msg00012.html
  - preserve timestamps of configure files


author: Pavel Raiskup <praiskup@redhat.com> - 1.9.6-3
changelog:
  - fix for CVE-2012-3386 -- 'make distcheck' was making the directory distdir
    world-writeable (#848470)


author: Kai Engert <kaie@redhat.com> - 3.16.1-4
changelog:
  - Adjust softokn patch to be compatible with legacy softokn API.
  - Resolves: Bug 1145430 - CVE-2014-1568


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-78.el5
changelog:
  - gssapi: pull in upstream fix for a possible NULL dereference in spnego
    (CVE-2014-4344, #1121509)


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.1-71.el5_10.1
changelog:
  - add patch based on one from Filip Krska to not call poll() with a negative
    timeout when the caller's intent is for us to just stop calling it (#1089732)


author: Frank Nagy <nagy@fnal.gov> 4.6-1
changelog:
  - Update krb5.conf to v4.6 updating list of Accelerator Division servers
  - Fixed bug in make-cron-keytab so it will take error exit if run
  - in shared account via ksu rather than ssh into the account.


author: Frank Nagy <nagy@fnal.gov> 4.5-1
changelog:
  - Added Nova Far Detector KDC to search list, edit and re-format
  - SysAdmin HowTo instructions for a local KDC search list and
  - set so krb5-fermi-config and krb5-fermi-krb5.conf conflict with
  - each other so only one gets installed


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: krb5-auth-dialog.ini
  -->  Config file for automated patch script
  - Ran Regex: (Release: .*) => \1.slf5
  -->  Modify release string to note changes for SLF5
  - Added Patch: fix-session-manager.patch
  -->  Fix Session bug, see BZ1140848/RITM0115117


author: Benjamin Tissoires <btissoir@redhat.com> 1.2.2-1.0.6
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)


author: Frank Nagy <nagy@fnal.gov> 1.0-2
changelog:
  - Now have SLF5 executables for kcron and kcron-create, remove
  - libraries and incorporated changes from SLF4 krb1-1.8d.spec


author: Frank Nagy <nagy@fnal.gov> 1.1-1
changelog:
  - New versions of SLF5 executables for kcron and kcron-create
  - Adds -d (debug print) flag to kcron.  kcron modified to
  - invoke /usr/krb5/bin/kinit so that aklog will be invoked
  - on AFS client systems.  Also added aklog executable (replaces
  - link to /usr/bin/akoog from OpenAFS) for SLF5 made from the
  - OpenAFS aklog with added support for Fermilab compound
  - principals.


author: Frank Nagy < nagy@fnal.gov > 2.1-14
changelog:
  - Re-recorrect z_krb5.csh so path varialbe is setup with
  - correct word list.  Shell will automaintian PATH variable
  - to matxh


author: Frank Nagy < nagy@fnal.gov > 2.2-1
changelog:
  - Modified kinit and kinit-debug scripts to (1) invoke aklog
  - provided with OpenAFS (as /usr/bin/aklog) and (2) added the
  - -noprdb option to aklog call so it will work for both normal
  - user principals and compound principals


author: Frank Nagy < nagy@fnal.gov > 2.2-2
changelog:
  - Modify the aklog.csh/sh and z_krb5.csh/sh scripts for
  - /etc/profile.d/ replace "aklog" by "/usr/bin/aklog -noprdb"


author: Remi Collet <rcollet@redhat.com> - 5.1.6-45
changelog:
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
  - xmlrpc: fix buffer overflow in date parser #1155607


author: Remi Collet <rcollet@redhat.com> - 5.3.3-25
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Petr Machata <pmachata@redhat.com> - 2014h-1
changelog:
  - Rebase to 2014h
    - Changes to historical transitions in America/Jamaica and
      Asia/Novokuznetsk.
    - Africa/{Blantyre, Bujumbura, Gaborone, Harare, Kigali, Lubumbashi,
      Lusaka} now alias Africa/Maputo, because they don't differ in
      post-1970 stamps.
    - Africa/Maseru and Africa/Mbabane now alias Africa/Johannesburg for
      the same reason.


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00.


author: Peter Hatina <phatina@redhat.com> 1.0.15-7
changelog:
  - security patches
  - Resolves: CVE-2014-6421
              CVE-2014-6423
              CVE-2014-6425
              CVE-2014-6428
              CVE-2014-6429


author: Daniel Veillard <veillard@redhat.com> - 2.6.26-2.1.24.el5
changelog:
  - fixed one regexp bug and added a (rhbz#922450)
  - Another small change on the algorithm for the elimination of epsilon (rhbz#922450)


author: Honza Horak <hhorak@redhat.com> - 5.5.37-1
changelog:
  - Update to MySQL 5.5.37, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html
    Includes fixes for: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432
    CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419
    Resolves: #1089203


author: Matej Muzila <mmuzila@redhat.com> - 5.5.40-1
changelog:
  - Rebase to 5.5.40
    Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464
    CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
    CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564
    Resolves: #1160514


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-400.el5]
changelog:
  - [net] bridge: disable snooping if there is no querier (Frantisek Hrbata) [902454]
  - [s390] kernel: sysinfo: convert /proc/sysinfo to seqfile (Alexander Gordeev) [1131283]
  - [net] netlink: verify permisions of socket creator (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: store effective caps at socket() time (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Rename netlink_capable netlink_allowed (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Fix permission check in netlink_connect() (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix possible spoofing from non-root processes (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Make NETLINK_USERSOCK work again (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix for too early rmmod (Jiri Benc) [1094266] {CVE-2014-0181}


author: Panu Matilainen <pmatilai@redhat.com> - 4.4.2.3-34
changelog:
  - Fix segfault on rpmdb addition when header unload fails (#706935)
  - Fix segfault on invalid OpenPGP packet (#743203)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-35
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163057)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-402.el5]
changelog:
  - [block] virtio: Reset device after blk_cleanup_queue() (Stefan Hajnoczi) [1006536]
  - [block] virtio: Call del_gendisk() before disable guest kick (Stefan Hajnoczi) [1006536]
  - [block] virtio: Drop unused request tracking list (Stefan Hajnoczi) [1006536]
  - [fs] cifs: setfacl removes part of ACL when setting POSIX ACLs (Sachin Prabhu) [1105625]
  - [fs] splice: perform generic write checks (Eric Sandeen) [1155908] {CVE-2014-7822}
  - [fs] ext4: verify block bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: fix type declaration of ext4_validate_block_bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: error out if verifying the block bitmap fails (Lukas Czerner) [1034403]
  - [x86] traps: stop using IST for #SS (Petr Matousek) [1172809] {CVE-2014-9322}


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.104
changelog:
  - xserver-1.1.1-randr-config-timestamps.patch: Backport timestamp comparison
    fix from upstream RANDR code (#1006076)


author: Adam Jackson <ajax@redhat.com> 1.1.1-48.107
changelog:
  - CVE-2014-8091 denial of service due to unchecked malloc in client
    authentication (#1168680)
  - CVE-2014-8092 integer overflow in X11 core protocol requests when
    calculating memory needs for requests (#1168684)
  - CVE-2014-8097 out of bounds access due to not validating length or offset
    values in DBE extension (#1168705)
  - CVE-2014-8095 out of bounds access due to not validating length or offset
    values in XInput extension (#1168694)
  - CVE-2014-8096 out of bounds access due to not validating length or offset
    values in XC-MISC extension(#1168700)
  - CVE-2014-8099 out of bounds access due to not validating length or offset
    values in XVideo extension (#1168710)
  - CVE-2014-8100 out of bounds access due to not validating length or offset
    values in Render extension (#1168711)
  - CVE-2014-8102 out of bounds access due to not validating length or offset
    values in XFixes extension (#1168714)
  - CVE-2014-8101 out of bounds access due to not validating length or offset
    values in RandR extension (#1168713)
  - CVE-2014-8093 xorg-x11-server: integer overflow in GLX extension requests
    when calculating memory needs for requests (#1168688)
  - CVE-2014-8098 xorg-x11-server: out of bounds access due to not validating
    length or offset values in GLX extension (#1168707)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.2p1-18.el5
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)


author: Olga Terlyga <terlyga@fnal.gov> 5.1-1
changelog:
  - Update krb5.conf to v5.1 to remove aklog line
  - Added krb4_convert_524 = false and krb4_use_as_req = false
  - to pam section of appdefaults
  - Added SLAC realm definition


author: Jan Horak <jhorak@redhat.com> - 31.3.0-9
changelog:
  - Fixed problems with dictionaries (mozbz#1097550)
  - Fixed rhbz#1164855 - firefox.desktop is missing
    x-scheme-handler MimeType entries


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.0
changelog:
  - Update to IcedTea 1.13.6
  - Apply pr2125.patch in generate_rhel_zip.sh to remove unwanted elliptic curves.
  - Add no_pr2125.patch to avoid repeating the procedure during the IcedTea build.
  - Avoid duplicating the OpenJDK build version by making more use of %{openjdkver}.
  - Add US_export_policy.jar and local_policy.jar to packages.
  - Resolves: rhbz#1180289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.34-1.13.6.1
changelog:
  - Update to latest 1.13.6 release candidate tarball
  - Fixes a number of issues found with b34:
  - * OJ51, PR2187: Sync patch for 4873188 with 7 version
  - * OJ52, PR2185: Application of 6786276 introduces compatibility issue
  - * OJ53, PR2181: strict-aliasing warnings issued on PPC32
  - * OJ54, PR2182: 6911104 reintroduces test fragment removed in existing 6964018 backport
  - * S6730740, PR2186: Fix for 6729881 has apparently broken several 64 bit tests: "Bad address"
  - * S7031830, PR2183: bad_record_mac failure on TLSv1.2 enabled connection with SSLEngine
  - Also includes PR2180, so patch dropped from RPM.
  - Resolves: rhbz#1180289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.0
changelog:
  - Bump to 2.5.4 using OpenJDK 7u75 b13.
  - Fix elliptic curve list as part of fsg.sh
  - Resolves: rhbz#1180294


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Dave Anderson <anderson@redhat.com> - 5.1.8-1.el5
changelog:
  - Rebase to upstream version 5.1.8.
    Resolves: rhbz#715072

  - Fix for the x86_64 "bt" command if the shutdown NMI is issued to a
    32-bit task that has executed a "sysenter" instruction and the RSP
    still contains the zero value loaded from the MSR_IA32_SYSENTER_ESP
    register.  The backtrace issued a warning message indicating 
    "WARNING: possibly bogus exception frame", and was unable to make a 
    transition from the NMI exception stack back to the process stack. 
    Resolves: rhbz#676408

  - Fix for the x86 "bt" command for several backtraces of non-crashing
    active tasks that fail with "bt: cannot resolve stack trace" errors
    due to the failure to properly transition from the shutdown NMI stack 
    back to the process stack.
    Resolves: rhbz#713050

  - Fix to more correctly determine the KVM I/O hole size and location.
    The I/O hole size to this point in time is either 1GB or 512MB, but
    its setting is hardwired into the Qemu code that was used to create 
    the dumpfile.  The dumpfile is a "savevm" file that is designed to be
    used for guest migration, and since inter-version save/load is not 
    supported, the I/O hole information does not have to be encoded into the
    dumpfile.  Without the patch, the I/O hole for dumpfiles created by 
    older Qemu version was not being set to 1GB, so if the KVM guest was 
    configured with more than 3GB of memory, the crash session would 
    typically display numerous "read error" messages during session 
    initialization.
    Resolves: rhbz#715070

  - Fix for KVM dumpfiles from guests that were provisioned with more
    than 3.5GB of RAM.  KVM virtual systems contain an I/O hole in the
    physical memory region from 0xe0000000 to 0x100000000 (3.5GB to 4GB).
    If a guest is provisioned with more than 3.5GB of RAM, then the
    memory above 3.5GB is "pushed up" to start at 0x100000000 (4GB).
    But the "ram" device headers in the KVM dumpfiles do not reflect
    that, and so without the patch, numerous error messages would be
    displayed during invocation, and in all probability, the session
    would fail.
    Resolves: rhbz#716327


author: Dave Anderson <anderson@redhat.com> - 5.1.8-2.el5
changelog:
  - Fix to handle xen dom0 dumpfiles created with "makedumpfile -d1" on very
    large systems, where the ELF vmcore may be mistakenly determined to be
    an old-style netdump vmcore.  
    Resolves: rhbz#876046


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-403.el5]
changelog:
  - [s390] zcrypt: Toleration of new crypto hardware (Hendrik Brueckner) [1182522]
  - [fs] cifs: Use pid from cifsFileInfo in wrt pages/set_file_size (Sachin Prabhu) [1169304]
  - [xen] x86: confine internally handled MMIO to solitary regions (Denys Vlasenko) [1164256] {CVE-2014-8867}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-404.el5]
changelog:
  - [infiniband] core: Prevent integer overflow in ib_umem_get (Doug Ledford) [1179353] {CVE-2014-8159}


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-33
changelog:
  - fix CVE-2014-8275 (without introduction of CVE-2015-0286) - various
    certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Pat Riehecky <riehecky@fnal.gov> 4.2.6-7
changelog:
  - New NTP servers
  - Prep for SLF7
  - Moved somewhat away from triggers so you can customize your config after
  - per: RITM0096493 no more default broadcast client


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200921 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Enable additional ssl test cycles and document why some aren't enabled
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Copy PayPalICA.cert and PayPalRootCA.cert to nss/tests/libpkix/certs
  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-5.11]


author: Kai Engert <kaie@redhat.com> - 3.18.0-6
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d:
    - The Egyptian Cabinet announced that DST will be cancelled for 2015.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style. This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-143.el5
changelog:
  - libxc: move error checking next to the function which returned the error (rhbz 870413)
  - libxc: builder: limit maximum size of   kernel/ramdisk (rhbz 870413)
  - e1000: discard packets that are too long if !SBP and !LPE (rhbz 910844)
  - e1000: discard oversized packets based on SBP|LPE (rhbz 910844)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-144.el5
changelog:
  - xm: Fix vcpu-pin complain for CPU number out of range (rhbz 955656)
  - libxc: Support set affinity for more than 64 CPUS (rhbz 955656)
  - libxc: Fixes for "support affinity for more than 64 CPUS" (rhbz 955656)
  - xend: Fix bug of a cpu affinity vcpu-pin under ia32pa (rhbz 955656)
  - libxc: Fix cpu number overflow for vcpu-pin (rhbz 955656)


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-146.el5
changelog:
  - xen-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch
  - xen-FDC-Fix-buffer-overflow-Herv-Poussineau.patch
  - Resolves: bz#1219333
   (xen: qemu: floppy disk controller flaw [rhel-5.11.z])


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-405.el5]
changelog:
  - [net] tcp: zero retrans_stamp if all retrans were acked (Marcelo Leitner) [1205521]
  - [net] tcp: fix retrans_stamp advancing in error cases (Marcelo Leitner) [1205521]
  - [net] tcp: Fix inconsistency source (Marcelo Leitner) [1205521]
  - [ipc] sem: fix the potential use-after-free in freeary() (Oleg Nesterov) [1124574]
  - [scsi] lpfc: Fix crash in device reset handler (Rob Evers) [1070964]
  - [mm] fix broken max_reclaims_in_progress memory reclaim throttle (Lachlan McIlroy) [1164105]
  - [x86_64] fpu: save_i387() must clr TS_USEDFPU along with stts() (Oleg Nesterov) [1193505]
  - [block] virtio: Call revalidate_disk() upon online disk resize (Stefan Hajnoczi) [1200855]
  - [block] virtio: fix config handler race (Stefan Hajnoczi) [1200855]
  - [block] virtio: allow re-reading config space at runtime (Stefan Hajnoczi) [1200855]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-406.el5]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Mateusz Guzik) [1203787] {CVE-2015-1805}


author: Kai Engert <kaie@redhat.com> 0.9.8e-34
changelog:
  - Rebase ca-bundle.crt to the upstream version 2.4 with legacy
    modifications. For compatibility reasons, several CA certificates with
    RSA sizes of 1024 bits are still included.
  - Add a patch to the source RPM that documents the changes from the
    upstream version.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-35
changelog:
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.85-2.6.1.3
changelog:
  - Check return value of gio_init in gsettings_init and return false if necessary.
  - Re-enable the use of system GConf.
  - Only ifdef g_type_init&g_free if USE_SYSTEM_GIO and USE_SYSTEM_GCONF are undefined.
  - Resolves: rhbz#1242587


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-86.SLx
changelog:
  - apply relevant security fixes from openafs-1.6.13 (patches 1082..1086)
  - (the 6th patch in that release is specific to Solaris)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.36-1.13.8.0
changelog:
  - Update to IcedTea 1.13.8
  - Update no_pr2125.patch to work against new version.
  - Resolves: rhbz#1235149


author: Matej Muzila <mmuzila@redhat.com> - 5.5.45-1
changelog:
  - Rebase to 5.5.45
    Includes fixes for: CVE-2014-6568 CVE-2015-0374
    CVE-2015-0381 CVE-2015-0382 CVE-2015-0391 CVE-2015-0411 CVE-2015-0432
    CVE-2015-0501 CVE-2015-2568 CVE-2015-0499 CVE-2015-2571 CVE-2015-0433
    CVE-2015-0441 CVE-2015-0505 CVE-2015-2573 CVE-2015-2582 CVE-2015-2620
    CVE-2015-2643 CVE-2015-2648 CVE-2015-4737 CVE-2015-4752 CVE-2015-4757
    Resolves: #1247020


author: Frank Nagy <nagy@fnal.gov> 1.3-1
changelog:
  - Replaced k5push with updated version from Marc Mengel
  - Modified new-portal-ticket to display obsolescence message and exit


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-7
changelog:
  - Pick up upstream patch from nss-3.19.1
  - Resolves: Bug 1236954 - CVE-2015-2730 NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)
  - Resolves: Bug 1236967 - CVE-2015-2721 NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-1
changelog:
  - Rebase nss to 3.19.1
  - Pick up upstream fix for client auth. regression caused by 3.19.1
  - Revert upstream change to minimum key sizes
  - Remove patches that rendered obsolote by the rebase
  - Update existing patches on account of the rebase


author: Olga Terlyga <terlyga@fnal.gov> 5.2-1
changelog:
  - Adjusted list of KDCs for SLAC realm
  - New version since Windows and Mac version will not have reference enctypes


author: Frank Nagy <nagy@fnal.gov> 2.0-2
changelog:
  - Merged get-cert.sh versions from SLF5 and SLF6 (which added checks
  - for Firefox and/or Seamonkey current running)


author: Frank Nagy <nagy@fnal.gov> 2.1-1
changelog:
  - Added -q (quiet) and -o (output file spec) options
  - to v2.1 of kx509.  Modified kxlist to just exit.


author: Frank Nagy <nagy@fnal.gov> 2.2-1
changelog:
  - Updated to get-cert v3.4 by replacing "ps -ef" with "ps ux" so
  - "Is Firefox running" test works on multiuser systems where other
  - users might be running Firefox.  Replaced certutil/pk12util with
  - scripts (unused) but modified get-cert.sh to user certutil/pk12util
  - from /usr/bin/ and added dependence on nss-tools package


author: Connie Sieh <csieh@fnal.gov> 0.9.9-19
changelog:
  - added ability to use a proxy via <PROXY>proxyurl<\PROXY> entry to
  - /etc/ocsinventory/ocsinv.conf
  - Also can define proxy with environment variable http_proxy
  - http_proxy overrides <PROXY>proxyurl<\PROXY> 
  - proxy has to be defined with full url -- http://proxyserver:port


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-87.SLx
changelog:
  - implement the vlserver fix from openafs-1.6.14:
  - back out patch 1086 (which disabled querying the vldb by regex)
  - new patches 1087, 1088 to limit this to admins and fix buffer overflows


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-88.SLx
changelog:
  - added OPENAFS-SA-2015-007.1.4.patch, fix for CVE-2015-7762 from 1.6.15
  - note tat CVE-2015-7763 does not apply to openafs-1.4


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269359 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption [rhel-5.11.z]


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.2
changelog:
  - Update with new IcedTea & b37 tarballs, including Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.3
changelog:
  - Update with new IcedTea & b37 tarballs, including more Kerberos fixes for TCK regression.
  - Resolves: rhbz#1271926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.37-1.13.9.4
changelog:
  - Update with new IcedTea & b37 tarballs, including fix for appletviewer regression.
  - Resolves: rhbz#1271926


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-147.el5
changelog:
  - net: add checks to validate ring buffer pointers 
  - Resolves: bz#1263273
    (xen: qemu: Heap overflow vulnerability in ne2000_receive() function)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Remove unneeded build dependencies on jakarta-commons-logging and prelink/execstack
  - Resolves: rhbz#1295764


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-407.el5]
changelog:
  - [utrace] check ->utrace != NULL in utrace_unsafe_exec() (Oleg Nesterov) [1226967]
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1238991]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-408.el5]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] ipv6/udp: Use correct var to determine non-blocking cond (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] SNMP: Restore Udp6InErrors incrementation (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.38-1.13.10.0
changelog:
  - Add patch to replace -fno-strict-overflow with -fwrapv on older RHEL 5.11 GCC.
  - Resolves: rhbz#1295772


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-38
changelog:
  - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
  - disable SSLv2 in the generic TLS method (can be reenabled
    by setting environment variable OPENSSL_ENABLE_SSL2)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-409.el5]
changelog:
  - [fs] ext4: limit group search loop for non-extent files (Lukas Czerner) [1301100]
  - [fb] vm: convert fb_mmap to vm_iomap_memory() helper (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [s390] add dummy io_remap_pfn_range() to asm-s390/pgtable.h (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [mm] vm: add vm_iomap_memory() helper function (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [sched] prevent division by zero x->cpu_power (Denys Vlasenko) [1209728]
  - [xen] x86: fully ignore segment override for register-only ops (Mateusz Guzik) [1200373] {CVE-2015-2151}


author: Stephan Wiesand <stephan wiesand desy de> 1.4.15-89.SLx
changelog:
  - patch 1090 to fix CVE-2015-8312 (from release 1.6.16)
  - patches 1091..1095 to fix OPENAFS-SA-2016-001 & 2 (from release 1.6.17)


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Connie Sieh <csieh@fnal.gov> 0.9.9-24
changelog:
  - Changed from using "ifconfig" to "ip" for NETWORKS as more consistent between
  - versions.  This allows for same version for 5, 6 and 7


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Resolves: rhbz#1320655


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Explictly required libXcomposite-devel for PR2867 as nothing else pulls it in
  - Resolves: rhbz#1320655


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Guenther Deschner <gdeschner@redhat.com> - 3.6.23-10
changelog:
  - resolves: #1322685 - Fix CVE-2015-5370
  - resolves: #1322685 - Fix CVE-2016-2110
  - resolves: #1322685 - Fix CVE-2016-2111
  - resolves: #1322685 - Fix CVE-2016-2112
  - resolves: #1322685 - Fix CVE-2016-2115
  - resolves: #1322685 - Fix CVE-2016-2118 (Known as Badlock)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.101-2.6.6.0
changelog:
  - Bump to 2.6.6 and u101b00.
  - Drop a leading zero from the priority as the update version is now three digits
  - Resolves: rhbz#1325424


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-0.1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297943 - Rebase RHEL 5.11.z to NSPR 4.11 in preparation for Firefox 45


author: Connie Sieh <csieh@fnal.gov> 0.9.9-25
changelog:
  - Changed from hardcoding what interfaces we will look at to finding all
  - that are UP and have either a ipv4 or ipv6 address


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d 
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.6.0.39-1.13.11.0
changelog:
  - Explictly required libXcomposite-devel for PR2868 as nothing else pulls it in
  - Resolves: rhbz#1325429


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.0
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (S8161262 (8147466_wrapv) and PR2939 (fontpath)) applied upstream.
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350038


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-415.el5]
changelog:
  - [fs] gfs2: Initialize atime of I_NEW inodes (Andreas Grunbacher) [1374861]
  - [fs] gfs2: Update file times after grabbing glock (Andreas Grunbacher) [1374861]
  - Revert: [fs] gfs2: Only refresh newer in-memory timestamps (Andreas Grunbacher) [1374861]


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.0
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.1
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Remove unneeded AArch64 environment variable setting.
  - Resolves: rhbz#1381990


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-417.el5]
changelog:
  - [virt] hv: do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1391167]
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390044] {CVE-2016-7117}


author: Miroslav Rezanina <mrezanin@redhat.com> - 3.0.3-148.el5_11
changelog:
  - xen-qemu-ioport-array-overflow.patch [bz#1401521]
  - Resolves: bz#1401521
    (CVE-2016-9637 xsa199 xen: qemu ioport array overflow (XSA-199) [rhel-5.11.z])


author: Petr Mensik <pemensik@redhat.com> - 30:9.3.6-25.P1.12
changelog:
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.0
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate RH1022017 against 2.6.9.
  - Resolves: rhbz#1410612


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-419.el5]
changelog:
  - [net] dccp: Use AF-independent rebuild_header routine (Hannes Frederic Sowa) [1424751]
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424633] {CVE-2017-6074}
  - [redhat] kernel.spec.template: disable autoloading for dccp proto (Hannes Frederic Sowa) [1425177]


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST (BZ #1425223)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab to the install files. (BZ #1427696)


