# changelog

author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-8
changelog:
  - Synchronize patches for Samba 4.2.10 with RHEL 7.2.z
  - Resolves: #1383685 - Update samba4 to be on par with RHEL 7.2.z


author: Remi Collet <rcollet@redhat.com> - 5.3.3-22
changelog:
  - php-xml provides php-xmlreader and php-xmlwriter (#874987)
  - fix possible NULL derefence and buffer overflow (#879179)
  - fix zend garbage collector (#848186, #868375)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-24
changelog:
  - fix buffer overflow in _pdo_pgsql_error (#969110)
  - fix double free when destroy_zend_class fails (#910466)
  - fix segfault in error_handler with
    allow_call_time_pass_reference = Off (#892158)
  - fix copy doesn't report failure on partial copy (#947428)
  - add rpm macros for packagers: %php_inidir,
    %php_incldir and %__php (#953814)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-27.1
changelog:
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
  - core: fix heap-based buffer overflow in DNS TXT record parsing.
    CVE-2014-4049
  - core: unserialize() SPL ArrayObject / SPLObjectStorage type
    confusion flaw. CVE-2014-3515
  - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
  - fileinfo: unrestricted recursion in handling of indirect type
    rules. CVE-2014-1943
  - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
  - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238


author: Tom Lane <tgl@redhat.com> 5.1.66-1
changelog:
  - Update to 5.1.66, for assorted upstream bugfixes including
    CVEs announced in July and October 2012
  Resolves: #871814


author: Tom Lane <tgl@redhat.com> 5.1.67-1
changelog:
  - Update to 5.1.67, for assorted upstream bugfixes including
    CVEs announced in January 2013
  Resolves: #901381


author: Tom Lane <tgl@redhat.com> 5.1.69-1
changelog:
  - Update to 5.1.69, for assorted upstream bugfixes including
    CVEs announced in April 2013
  Resolves: #953085


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #990796, #842052
  - Fix mysqldump failure against MySQL 5.0.x server due missing tables
    Resolves: #877557
  - Add logrotate script
    Resolves: #904061
  - Fix init script to not show failed on start even when server started
    Resolves: #884651


author: Honza Horak <hhorak@redhat.com> 5.1.71-1
changelog:
  - Update to MySQL 5.1.71, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-71.html
    Resolves: #990796


author: Jakub Dorňák <jdornak@redhat.com> - 5.1.73-1
changelog:
  - Update to MySQL 5.1.73, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-73.html
    (CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2014-0393,
    CVE-2014-0386, CVE-2014-0401, CVE-2014-0402)
    Resolves: #1055880


author: Honza Horak <hhorak@redhat.com> 5.1.73-2
changelog:
  - Make mysqld init script more robust and ignore existing but
    non-being-used unix socket file
    Resolves: #1058719


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-1
changelog:
  - New upstream version, resolves rhbz #766335
  - Build python bindings to satisfy Samba4 BuildRequires


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.7-2
changelog:
  - Obsolete older pytalloc{,-devel} releases to clear the upgrade path
    towards non-multilib pytalloc
  - Resolves: rhbz#862062


author: Andreas Schneider <asn@redhat.com> - 3.6.24-44
changelog:
  - resolves: #1451105 - Fix trusted domain handling in winbind
  - resolves: #1431000 - Fix crash while trying to authenticate with a disabled
                         account
  - resolves: #1467395 - Add 'winbind request timeout' option


author: Rafael Aquini <aquini@redhat.com> [2.6.32-504.el6]
changelog:
  - [netdrv] revert "cxgb4: set skb->rxhash" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use netif_set_real_num_rx/tx_queues()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Turn on delayed ACK" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use ULP_MODE_TCPDDP" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Debugfs dump_qp() updates" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Drop peer_abort when no endpoint found" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Detect DB FULL events and notify RDMA ULD" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Common platform specific changes for DB Drop Recovery" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: DB Drop Recovery for RDMA and LLD queues" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add debugfs RDMA memory stats" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add DB Overflow Avoidance" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: DB Drop Recovery for RDMA and LLD queues" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use vmalloc() for debugfs QP dump" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Remove kfifo usage" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Include vmalloc.h for vmalloc and vfree" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: set maximal number of default RSS queues" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Remove duplicate register definitions" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Update RDMA/cxgb4 due to macro definition removal in cxgb4 driver" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Move dereference below NULL test" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix incorrect values for MEMWIN*_APERTURE and MEMWIN*_BASE" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add functions to read memory via PCIE memory window" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Code cleanup to enable T4 Configuration File support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add support for T4 configuration file" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add support for T4 hardwired driver configuration settings" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Don't attempt to upgrade T4 firmware when cxgb4 will end up as a slave" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix error handling in create_qp()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Dynamically allocate memory in t4_memory_rw() and get_vpd_params()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix build error due to missing linux/vmalloc.h include" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: allocate enough data in t4_memory_rw()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Address various sparse warnings" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Remove unnecessary #ifdef condition" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't free chunk that we have failed to allocate" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix unable to get UP event from the LLD" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix initialization of SGE_CONTROL register" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: use WARN" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Chelsio FCoE offload driver submission" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove __dev* attributes" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T4 filter support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add LE hash collision bug fix path in LLD driver" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix LE hash collision bug for active open connection" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix LE hash collision bug for passive open connection" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix bug for active and passive LE hash collision path" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use netdev_<level> and pr_<level>" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix incorrect PFVF CMASK" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Abort connections that receive unexpected streaming mode data" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Abort connections when moving to ERROR state" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Display streaming mode error only if detected in RTS" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Keep QP referenced until TID released" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Always log async errors" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Only log rx_data warnings if cpl status is non-zero" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix endpoint timeout race condition" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't reconnect on abort for mpa_rev 1" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't wakeup threads for MPAv2" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Insert hwtid in pass_accept_req instead in pass_establish" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Address sparse warnings" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: "cookie" can stay in host endianness" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix cast warning" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Allow for backward compatibility with new VPD scheme" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add register definations for T5" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add macros, structures and inline functions for T5" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Initialize T5" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Dump T5 registers" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T5 write combining support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Enable doorbell drop recovery only for T4 adapter" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T5 debugfs support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T5 PCI ids" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Update driver version and description" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Disable SR-IOV support for PF4-7 for T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add Support for Chelsio T5 adapter" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Turn off db coalescing when RDMA QPs are in use" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add module_params to enable DB FC & Coalescing on T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use DSGLs for fastreg and adapter memory writes for T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Map pbl buffers for dma if using DSGL" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Bump tcam_full stat and WR reply timeout" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix onchip queue support for T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix error return code in create_qp()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix SQ allocation when on-chip SQ is disabled" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix pci_device_id structure initialization with correct PF number" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: fix error recovery when t4_fw_hello returns a positive value" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Force uninitialized state if FW_ON_ADAPTER is < FW_VERSION and we're the MASTER_PF" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Correct comparisons and calculations using skb->tail and skb-transport_header" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Do not set net_device::dev_id to VI index" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix stack info leak in c4iw_create_qp()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add routines to create and remove listening IPv6 servers" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add CLIP support to store compressed IPv6 address" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cma: Add IPv6 support for iWARP" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add support for active and passive open connection with IPv6 address" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Handle newer firmware changes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use correct bit shift macros for vlan filter tuples" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix QP flush logic" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix accounting for unsignaled SQ WRs to deal with wrap" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Set arp error handler for PASS_ACCEPT_RPL messages" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Always do GTS write if cidx_inc == CIDXINC_MASK" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Advertise ~0ULL as max MR size" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Issue RI.FINI before closing when entering TERM" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove workqueue when driver registration fails" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove unnecessary pci_set_drvdata()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cgxb4: remove duplicate include in cxgb4.h" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Much cleaner implementation of is_t4()/is_t5()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: added much cleaner implementation of is_t4()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add new scheme to update T4/T5 firmware" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix formatting of physical address" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Make _c4iw_write_mem_dma() static" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: calls skb_set_hash" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Reserve stid 0 for T4/T5 adapters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Include TCP as protocol when creating server filters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Assign filter server TIDs properly" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Account for stid entries properly in case of IPv6" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add API to correctly calculate tuple fields" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: make functions static and remove dead code" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Calculate the filter server TID properly" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Server filters are supported only for IPv4" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use cxgb4_select_ntuple to correctly calculate ntuple fields" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: allow large buffer size to have page size" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Changed FW check version to match FW binary version" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: silence shift wrapping static checker warning" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Avoid disabling PCI device for towice" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Don't retrieve stats during recovery" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix gcc warning on 32-bit arch" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix referencing freed adapter" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add missing neigh_release in LE-Workaround path" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use pci_enable_msix_range() instead of pci_enable_msix()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add support to recognize 40G links" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Print adapter VPD Part Number instead of Engineering Change field" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Allow >10G ports to have multiple queues" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: LE-Workaround is not atomic in firmware" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Query firmware for T5 ULPTX MEMWRITE DSGL capabilities" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Remove unused registers and add missing ones" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Don't assume LSO only uses SGL path in t4_eth_xmit()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add more PCI device ids" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cgxb4: Stop using ethtool SPEED_* constants" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: use remove handler as shutdown handler" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix some small bugs in t4_sge_init_soft() when our Page Size is 64KB" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add code to dump SGE registers when hitting idma hangs" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Rectify emitting messages about SGE Ingress DMA channels being potentially stuck" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Updates for T5 SGE's Egress Congestion Threshold" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Calculate len properly for LSO path" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Treat CPL_ERR_KEEPALV_NEG_ADVICE as negative advice" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Doorbell Drop Avoidance Bug Fixes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix underflows in c4iw_create_qp()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix four byte info leak in c4iw_create_cq()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Cap CQ size at T4_MAX_IQ_SIZE" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Allow loopback connections" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Always release neigh entry" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix incorrect BUG_ON conditions" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Mind the sq_sig_all/sq_sig_type QP attributes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Default peer2peer mode to 1" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Save the correct map length for fast_reg_page_lists" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't leak skb in c4iw_uld_rx_handler()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix possible memory leak in RX_PKT processing" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Ignore read reponse type 1 CQEs" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Connect_request_upcall fixes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Update snd_seq when sending MPA messages" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Call dev_kfree/consume_skb_any instead of kfree_skb" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxbg4: Remove addressof casts to same type" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Adds device ID for few more Chelsio Adapters" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: set error code on kmalloc() failure" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Lock around accept/reject downcalls" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Drop RX_DATA packets if the endpoint is gone" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: rx_data() needs to hold the ep mutex" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Disable DSGL use by default" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use the BAR2/WC path for kernel QPs and T5 devices" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Endpoint timeout fixes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: rmb() after reading valid gen bit" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: SQ flush fix" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Max fastreg depth depends on DSGL support" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use pr_warn_ratelimited" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Initialize reserved fields in a FW work request" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add missing debug stats" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use uninitialized_var()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix over-dereference when terminating" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Save the correct mac addr for hw-loopback connections in the L2T" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: use the correct max size for firmware flash" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix endpoint mutex deadlocks" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Force T5 connections to use TAHOE congestion control" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Only allow kernel db ringing for T4 devs" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Update Kconfig to include Chelsio T5 adapter" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Decode PCIe Gen3 link speed" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix memory leaks in c4iw_alloc() error paths" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix vlan support" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add missing padding at end of struct c4iw_create_cq_resp" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: add missing padding at end of struct c4iw_alloc_ucontext_resp" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Decode the firmware port and module type a bit more for ethtool" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Check if rx checksum offload is enabled, while reading hardware calculated checksum" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Allocate and use IQs specifically for indirect interrupts" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Choose appropriate hw mtu index and ISS for iWARP connections" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: don't truncate the recv window size" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Change default Interrupt Holdoff Packet Count Threshold" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fixes cxgb4 probe failure in VM when PF is exposed through PCI Passthrough" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use FW interface to get BAR0 value" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Replaced the backdoor mechanism to access the HW memory with PCIe Window method" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Adds device ID for few more Chelsio T4 Adapters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove unnecessary null test before debugfs_remove_recursive" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Detect Ing. Padding Boundary at run-time" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: use firmware ord/ird resource limits" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: display TPTE on errors" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: work request logging feature" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Move common defines to cxgb4" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add the MC1 registers to read in the interrupt handler" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fixed incorrect check for memory operation in t4_memory_rw" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: only free allocated fls" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix possible race condition in cleanup" (Prarit Bhargava) [1140743]
  - [infiniband] revert "iw_cxgb4: fix for 64-bit integer division" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add core T4 PCI-E SR-IOV Virtual Function hardware definitions and device communication code" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add T4 Virtual Function Scatter-Gather Engine DMA code" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add main T4 PCI-E SR-IOV Virtual Function driver for cxgb4vf" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add new Makefile for T4 PCI-E SR-IOV Virtual Function driver cxgb4vf" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Stitch new T4 PCI-E SR-IOV Virtual Function driver into the build" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Remove obsolete comment about the lack of a TX Timer Callback" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Use correct shift factor for extracting the SGE DMA Ingress Padding Boundary" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: remove obsolete DECLARE_PCI_UNMAP_ADDR usage" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Implement "Unhandled Interrupts" statistic" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix TX Queue restart" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix SGE resource resource deallocation bug" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix off-by-one error checking for the end of the mailbox delay array" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix bug where we were only allocating one queue in MSI mode" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: do not use PCI resources before pci_enable_device()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Use netif_set_real_num_rx/tx_queues()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: make single bit signed bitfields unsigned" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: remove call to stop TX queues at load time" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: don't implement trivial (and incorrect) ndo_select_queue()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix bug in Generic Receive Offload" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix some errors in Gather List to skb conversion" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: flesh out PCI Device ID Table" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fail open if link_start() fails" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: add call to Firmware to reset VF State" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: minor comment/symbolic name cleanup" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: add ethtool statistics for GRO" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix up "Section Mismatch" compiler warning" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Advertise NETIF_F_TSO_ECN" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix setting unicast/multicast addresses" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Ingress Queue Entry Size needs to be 64 bytes" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix mailbox data/control coherency domain race" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: recover from failure in cxgb4vf_open()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Check driver parameters in the right place" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Behave properly when CONFIG_DEBUG_FS isn't defined" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Quiesce Virtual Interfaces on shutdown" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Use defined Mailbox Timeout" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: improve Kconfig dependencies" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: do vlan cleanup" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: remove __dev* attributes" (Prarit Bhargava) [1140743]
  - [netdrv] revert "chelsio: Use netdev_<level> and pr_<level>" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix extraction of cpl_rx_pkt from the response queue descriptor" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix VLAN extraction counter increment" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add support for Chelsio T5 adapter" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG" (Prarit Bhargava) [1140743]
  - [netdrv] revert "net: cxgb4vf: Staticize local symbols" (Prarit Bhargava) [1140743]
  - [netdrv] revert "net: cxgb4vf: remove unnecessary pci_set_drvdata()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "net: cxgb4vf: use DEFINE_PCI_DEVICE_TABLE" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: added much cleaner implementation of is_t4()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: make functions static and remove dead code" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Remove superfluous call to pci_disable_msix()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Adds device Id for few more Chelsio adapters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Export symbols required by cxgb4i for ipv6 support and required defines" (Prarit Bhargava) [1140743]
  - [scsi] revert "libcxgbi: Add ipv6 api to driver" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: Add ipv6 code to driver, call into libcxgbi ipv6 api" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: Fix ipv6 build failure caught with randconfig" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: remove spurious use of rcu" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: Guard ipv6 code with a config check" (Prarit Bhargava) [1140743]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.1.1.el6]
changelog:
  - [fs] call d_op->d_hash on last component of umount path (Abhijith Das) [1145193 1129712]
  - [usb] serial: memory corruption flaw (Jacob Tanenbaum) [1141401 1141402] {CVE-2014-3185}
  - [char] ipmi: Clear drvdata when interface is removed (Tony Camuso) [1149578 1135910]
  - [char] ipmi: init shadow_ipmi_smi_handlers early in ipmi_si_intf (Tony Camuso) [1149580 1139464]
  - [net] ipsec: update MAX_AH_AUTH_LEN to support sha512 (Herbert Xu) [1149083 1140103]
  - [net] revert "bridge: Set vlan_features to allow offloads on vlans" (Vlad Yasevich) [1144442 1121991]
  - [netdrv] virtio-net: fix big buffer receiving (Jason Wang) [1148693 1144073]
  - [netdrv] tg3: prevent ifup/ifdown during PCI error recovery (Ivan Vecera) [1142570 1117009]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.2.1.el6]
changelog:
  - [fs] udf: Avoid infinite loop when processing indirect ICBs (Jacob Tanenbaum) [1142319 1142320] {CVE-2014-6410}
  - [fs] isofs: unbound recursion when processing relocated directories (Jacob Tanenbaum) [1142268 1142269] {CVE-2014-5472 CVE-2014-5471}
  - [net] ipv6: delete expired route in ip6_pmtu_deliver (Hannes Frederic Sowa) [1161418 1156137]
  - [net] sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann) [1155746 1154676] {CVE-2014-3688}
  - [net] sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [1155733 1154676] {CVE-2014-3687}
  - [net] sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [1147857 1154676] {CVE-2014-3673}
  - [net] sctp: handle association restarts when the socket is closed (Daniel Borkmann) [1147857 1154676]
  - [md] dm-thin: refactor requeue_io to eliminate spinlock bouncing (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: optimize retry_bios_on_resume (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: sort the deferred cells (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: direct dispatch when breaking sharing (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: remap the bios in a cell immediately (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: defer whole cells rather than individual bios (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: factor out remap_and_issue_overwrite (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: performance improvement to discard processing (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: grab a virtual cell before looking up the mapping (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: implement thin_merge (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm: improve documentation and code clarity in dm_merge_bvec (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: adjust max_sectors_kb based on thinp blocksize (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] block: fix alignment_offset math that assumes io_min is a power-of-2 (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: throttle incoming IO (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: prefetch missing metadata pages (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-transaction-manager: add support for prefetching blocks of metadata (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin-metadata: change dm_thin_find_block to allow blocking, but not issuing, IO (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bio-prison: switch to using a red black tree (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: evict buffers that are past the max age but retain some buffers (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: switch from a huge hash table to an rbtree (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: update last_accessed when relinking a buffer (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: use kzalloc when allocating dm_bufio_client (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin-metadata: do not allow the data block size to change (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: cleanup noflush_work to use a proper completion (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: fix DMERR typo in pool_status error path (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [fs] xfs: xlog_cil_force_lsn doesn't always wait correctly (Eric Sandeen) [1158325 1133304]
  - [netdrv] ixgbe: allow TXDCTL.WRTHRESH to be 1 will small ITR values (John Greene) [1158326 1132267]
  - [netdrv] ixgbe: Intel Change to allow itr changes without CONFIG_BQL support (John Greene) [1158326 1132267]
  - [video] offb: Fix setting of the pseudo-palette for >8bpp (Gerd Hoffmann) [1158328 1142450]
  - [video] offb: Add palette hack for qemu "standard vga" framebuffer (Gerd Hoffmann) [1158328 1142450]
  - [video] offb: Fix bug in calculating requested vram size (Gerd Hoffmann) [1158328 1142450]
  - [net] sock_queue_err_skb() dont mess with sk_forward_alloc (Jiri Benc) [1155427 1148257]
  - [net] guard tcp_set_keepalive() to tcp sockets (Florian Westphal) [1141744 1141746] {CVE-2012-6657}
  - Revert: [net] revert "bridge: Set vlan_features to allow offloads on vlans" (Vlad Yasevich) [1144442 1121991]
  - [x86] kvm: fix PIT timer race condition (mguzik) [1149592 1149593] {CVE-2014-3611}
  - [x86] kvm: vmx: handle invept and invvpid vm exits gracefull (mguzik) [1144826 1144837 1144827 1144838] {CVE-2014-3646 CVE-2014-3645}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.3.1.el6]
changelog:
  - [s390] zcrypt: toleration of new crypto adapter hardware (Hendrik Brueckner) [1158311 1134984]
  - [s390] zcrypt: support for extended number of ap domains (Hendrik Brueckner) [1158311 1134984]
  - [md] dm-thin: fix potential for infinite loop in pool_io_hints (Mike Snitzer) [1161420 1161421 1142773 1145230]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.4.1.el6]
changelog:
  - [fs] nfs: Make sure pre_change_attr is initialized correctly (Scott Mayhew) [1163214 1160042]
  - [usb] ehci: Fix a regression in the ISO scheduler (Gustavo Duarte) [1162072 1145805]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.5.1.el6]
changelog:
  - [fs] nfsd: don't halt scanning the DRC LRU list when there's an RC_INPROG entry (J. Bruce Fields) [1168129 1150675]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.6.1.el6]
changelog:
  - [fs] ext4: don't count external journal blocks as overhead (Eric Sandeen) [1168504 1163811]
  - [net] sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann) [1163090 1153980] {CVE-2014-7841}
  - [netdrv] e100: fix typo in MDI/MDI-X eeprom check in e100_phy_init (John Greene) [1165985 1156417]
  - [powerpc] Add smp_mb()s to arch_spin_unlock_wait() (Gustavo Duarte) [1165986 1136224]
  - [powerpc] Add smp_mb() to arch_spin_is_locked() (Gustavo Duarte) [1165986 1136224]
  - [kernel] cpuset: PF_SPREAD_PAGE and PF_SPREAD_SLAB should be atomic flags (Aaron Tomlin) [1165002 1045310]
  - [documentation] cpuset: Update the cpuset flag file (Aaron Tomlin) [1165002 1045310]
  - [alsa] control: Make sure that id->index does not overflow (Jacob Tanenbaum) [1149140 1117312] {CVE-2014-4656}
  - [alsa] control: Handle numid overflow (Jacob Tanenbaum) [1149140 1117312] {CVE-2014-4656}
  - [s390] mm: fix SIGBUS handling (Hendrik Brueckner) [1169433 1145070]
  - [fs] gfs2: fix bad inode i_goal values during block allocation (Abhijith Das) [1165001 1130684]
  - [md] dm-thin: fix pool_io_hints to avoid looking at max_hw_sectors (Mike Snitzer) [1161420 1161421 1142773 1145230]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.7.1.el6]
changelog:
  - [kernel] ipc/sem: Fully initialize sem_array before making it visible (Rik van Riel) [1172029 1165277]
  - [kernel] ipc/sem: synchronize semop and semctl with IPC_RMID (Rik van Riel) [1172029 1165277]
  - [kernel] ipc/sem: update sem_otime for all operations (Larry Woodman) [1172025 1168588]
  - [fs] fuse: prevent null nd panic on dentry revalidate (Brian Foster) [1172022 1162782]
  - [net] netfilter: ipset: timeout values corrupted on set resize (Marcelo Leitner) [1172764 1152754]
  - [net] netfilter: fix xt_TCPOPTSTRIP in forwarding path (Marcelo Leitner) [1172027 1135650]
  - [usb] ehci: Fix panic on hotplug race condition (Don Zickus) [1172024 1107010]
  - [usb] usb_wwan: replace release and disconnect with a port_remove hook (Stanislaw Gruszka) [1172030 1148615]
  - [x86] traps: stop using IST for #SS (Petr  Matousek) [1172810 1172811] {CVE-2014-9322}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.8.1.el6]
changelog:
  - [crypto] crc32c: Kill pointless CRYPTO_CRC32C_X86_64 option (Jarod Wilson) [1175509 1036212]
  - [crypto] testmgr: add larger crc32c test vector to test FPU path in crc32c_intel (Jarod Wilson) [1175509 1036212]
  - [crypto] tcrypt: Added speed test in tcrypt for crc32c (Jarod Wilson) [1175509 1036212]
  - [crypto] crc32c: Optimize CRC32C calculation with PCLMULQDQ instruction (Jarod Wilson) [1175509 1036212]
  - [crypto] crc32c: Rename crc32c-intel.c to crc32c-intel_glue.c (Jarod Wilson) [1175509 1036212]


author: ClearFoundation <developer@clearfoundation.com> [2.6.32-504.8.1.clear]
changelog:
  - Change signing key to ClearOS
  - Add IMQ patch and update kABI accordingly
  - Updated IMQ patch for 2.6.32-431.


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> - 1.3.3-15
changelog:
  - Update to 1.3.3
  - Changed source file to bz2
  - Removed libxvidcore.so-file preventing correct build


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> 0.98a-20150706-97c6ae2-1
changelog:
  - New upstream release
  - Introduced separate devel and libs rpms to enable future API updates without breaking dependencies


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.54-1
changelog:
  - specfile: require newer lvm
  - ifdown-eth: add timeout for when flushing global scope
  - functions: support boolean values in is_true() & is_false()
  - ifup-aliases: do not return with error when arping fails
  - netconsole: resolve domain name via 'getent' instead of 'hosts'


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.55-1
changelog:
  - ipcalc: detect invalid mask
  - ifup-aliases: send gratuitous ARPs when adding addresses
  - network: treat other tunnel interfaces (fixes ifdown stage)
  - kexec-disable.conf: release kexec memory properly
  - network-functions: do not send hostname via dhclient everytime
  - sysconfig/network: NO_DHCP_HOSTNAME option introduced
  - ipv6_add_addr_on_device: replace the existing address on NIC


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.59-1
changelog:
  - init.d/network: start vpninterfaces
  - ARPUPDATE option introduced
  - init.d/functions: sourcing for ksh fixed


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.9-1
changelog:
  - New upstream release 1.1.9
  - Required for Samba 4 Beta 5
  - Ensure rename target does not exist before deleting old record
  - Add parameter to avoid NULL format string flagged by -Werror=format


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.13-3
changelog:
  - use the proper %patch stanza to make rpmdiff happy
  - related: rhbz#873422 - LDB 1.1.13 exports improper ABI


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.13-3.1
changelog:
  - Resolves: rhbz#1290712 - CVE-2015-5330 libldb: samba: Remote memory read
                             in Samba LDAP server [rhel-7.2.z]
  - Remove the patch from the previous commit, it doesn't fix a remotely
    eploitable issue. Add patches from upstream #11636 instead.


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> - 2.7-1
changelog:
  - New upstream release
  - Removed dependency on atrpms scritps to comply with ClearOS policy
  - Disabled static build and enabled stripping to reduce size


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> - 2.7.1-1
changelog:
  - New upstream release
  - Structured spec file for better readability and prepared for future libs
  - Removed obsolete BuildReq imlib2, faad2, a52dec and libnut (xmms not needed anymore)
  - Added vid.stab, libbluray, fontconfig, libbs2b, ladspa, libcdio
  - Added openal, opus, pulseaudio, soxr, libv4l, vo-amrwbenc, vo-aacenc
  - Added libcaca, libwavpack, lzma, zlib


author: Andreas Schneider <asn@redhat.com> - 3.6.23-42
changelog:
  - resolves: #1391256 - Performance issues with vfs_dirsort and extended
                         attributes


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-3
changelog:
  - drop the S390 build workaround as it is no longer needed
  - additional spec file cleanups for merge review (#226008)


author: Tomas Mraz <tmraz@redhat.com> 1.4.5-5
changelog:
  - use /dev/urandom for seeding in the FIPS mode
  - make the tests to pass in the FIPS mode also fixing
    the FIPS-186-3 DSA keygen


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> 1.5-2
changelog:
  - Changed build so that libx265.so will be a protocol version specific rpm so that an update of x265 will not break old dependencies


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> 1.6-2
changelog:
  - Defined pkgconfig to enable builds when pkgconfig has not been declared (ClearOS 7 Beta1) without errors


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-1
changelog:
  - Rebase to 0.9.16 to provide the version Samba4 needs
  - Resolves: rhbz#766336
  - Drop ABI compatibility patch (no longer needed)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-2
changelog:
  - Add BuildRequires on libxslt and docbook-style-xsl to enable
    building manual pages

  - Related: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.17-1
changelog:
  - Rebase to 0.9.17 to provide the version Samba4 needs
  - Drop EXCLUDE_PATTERNS workaround in specfile
  - Resolves: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-2
changelog:
  - Resolves: rhbz#975489 - Additional flags might have no effect
                            on 32bit architectures


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.1.1.el6]
changelog:
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1574592]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1574592]
  - [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1574592]
  - [x86] microcode: Sanitize per-cpu microcode reloading interface (Prarit Bhargava) [1574592]
  - [x86] virt_spec_ctrl: Set correct host SSDB value for AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Fix missing void (Waiman Long) [1584356] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584356] {CVE-2018-3639}
  - [uapi] prctl: Add force disable speculation (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Show IBPB in the Spectre_v2 sysfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Check MSR_IA32_ARCH_CAPABILITIES for Meltdown vulnearability (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Fix kexec warning on debug kernel (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] kvm/fpu: Enable eager FPU restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] always enable eager FPU by default (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Load xsave pointer *after* initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix 32-bit signal frame handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always restore_xinit_state() when use_eager_cpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Rename drop_init_fpu() to fpu_reset_state() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix math_state_restore() race with kernel_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fold __drop_fpu() into its sole user (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse drop_init_fpu() in flush_thread() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce restore_init_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Document user_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always allow FPU in interrupt if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce per-cpu in_kernel_fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Check tsk_used_math() in kernel_fpu_end() for eager FPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change math_error() to use unlazy_fpu(), kill (now) unused save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Merge simd_math_error() into math_error() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't reset thread.fpu_counter (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Allow FPU to be used at interrupt time even with eagerfpu (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387.c: Initialize thread xstate only on CPU0 only once (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: fix kvm's usage of kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] rhel: initialize scattered CPUID features early (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: make eagerfpu= boot param tri-state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: enable eagerfpu by default for xsaveopt (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: decouple non-lazy/eager fpu restore from xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: use non-lazy fpu restore for processors supporting xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: remove unnecessary user_fpu_end() in save_xstate_sig() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop_fpu() before restoring new state from sigframe (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Unify signal handling code paths for x86 and x86_64 kernels (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop the fpu state during thread exit (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signals: ia32_signal.c: add __user casts to fix sparse warnings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Consolidate inline asm routines for saving/restoring fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signal: Cleanup ifdefs and is_ia32, is_x32 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu/xsave: Keep __user annotation in casts (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] debug: Add KERN_<LEVEL> to bare printks, convert printks to pr_<level> (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] extable: Remove open-coded exception table entries in arch/x86/include/asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Split up <asm/i387.h> into exported and internal interfaces (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Uninline the generic FP helpers that we expose to kernel modules (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: (DON'T ACTUALLY) support lazy restore of FPU state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: use 'restore_fpu_checking()' directly in task switching code (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix up some fpu_counter confusion (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: re-introduce FPU state preloading at context switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU flag from thread_info to task_struct (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move AMD K7/K8 fpu fxsave/fxrstor workaround from save to restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: do not preload FPU state at task switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: don't ever touch TS_USEDFPU directly, use helper functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU clearing out of __save_init_fpu and into callers (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix x86-64 preemption-unsafe user stack save/restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: math_state_restore() isn't called from asm (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fix potentially dangerous trailing '; ' in #defined values/expressions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Fix FPU exception handling on non-SSE systems (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Fix common misspellings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: Initialize fpu state in preemptible context (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Rewrite fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove PSHUFB_XMM5_* macros (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove unnecessary ifdefs from i387 code. (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Simplify constraints for fxsave/fxtstor (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Fix cs value in convert_from_fxsr() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Disable preemption when using TS_USEDFPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge __save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge tolerant_fwait() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Disable xsave in i387 emulation mode (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make xstate_enable_boot_cpu() __init, protect on CPU 0 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Add __init attribute to setup_xstate_features() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make init_xstate_buf static (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Check cpuid level for XSTATE_CPUID (0x0d) (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Introduce xstate enable functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Do not include asm/i387.h in asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Avoid unnecessary __clear_user() and xrstor in signal handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Cleanup return codes in check_for_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Separate fpu and xsave initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Move boot cpu initialization to xsave_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: change save_i387_xstate() to rely on unlazy_fpu()" (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: shift clear_used_math() from save_i387_xstate() to handle_signal()" (Paolo Bonzini) [1589047] {CVE-2018-3665}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.2.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1596113] {CVE-2018-10872}
  - [fs] gfs2: Flush delayed work earlier in gfs2_inode_lookup (Andreas Grunbacher) [1506281]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576757] {CVE-2018-10675}
  - [mm] Fix NULL pointer dereference in dequeue_hwpoisoned_huge_page() (Larry Woodman) [1381653]
  - [fs] NFSv4.1: Fix up replays of interrupted requests (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Simplify struct nfs4_sequence_args too (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Label each entry in the session slot tables with its slot number (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Shrink struct nfs4_sequence_res by moving the session pointer (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: nfs4_alloc_slots doesn't need zeroing (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: clean up nfs4_recall_slot to use nfs4_alloc_slots (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Fix a NFSv4.1 session initialisation regression (Benjamin Coddington) [1553423]
  - [scsi] ipr: Fix sync scsi scan (Gustavo Duarte) [1572310]
  - [scsi] ipr: Wait to do async scan until scsi host is initialized (Gustavo Duarte) [1572310]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.1.el6]
changelog:
  - [infiniband] ib/iser: Rewrite bounce buffer code path (Don Dutile) [1585312]
  - [sound] alsa: pcm: prevent UAF in snd_pcm_info (CVE-2017-0861) (Jaroslav Kysela) [1565188] {CVE-2017-0861}
  - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550176] {CVE-2018-7566}
  - [sound] alsa: seq: Fix use-after-free at creating a port (Jaroslav Kysela) [1503383] {CVE-2017-15265}
  - [sound] alsa: seq: Make ioctls race-free (Jaroslav Kysela) [1537452] {CVE-2018-1000004}
  - [mm] reduce total RAM held in per-CPU pvecs by flushing them on compound/THP page arrival (Larry Woodman) [1575819]
  - [usb] acm: fix the computation of the number of data bits (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner, part 2 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] kvm/vmx: Remove barrier_nospec() in slot_largepage_idx() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kvm] Remove memory alias support (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] posix-timers: Protect posix clock array access against speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [ipc] sysvipc/sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.4.1.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.5.1.el6]
changelog:
  - [s390] dasd: fix IO error for newly defined devices (Hendrik Brueckner) [1574448]
  - [s390] dasd: fix failing path verification (Hendrik Brueckner) [1581684]
  - [s390] qeth: on channel error, reject further cmd requests (Hendrik Brueckner) [1562009]
  - [s390] qdio: fix access to uninitialized qdio_q fields (Hendrik Brueckner) [1581685]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1585299]
  - [x86] Add host_initiated check in reading MSR_AMD64_VIRT_SPEC_CTRL (Wei Huang) [1608576]
  - [x86] KVM: pass host_initiated to functions that read MSRs (Wei Huang) [1608576]
  - [fs] gfs2: Special-case rindex for gfs2_grow (Robert S Peterson) [1384184]
  - [fs] Revert "[fs] gfs2: Special case the rindex in gfs2_write_alloc_required()" (Robert S Peterson) [1384184]
  - [net] ip: process in-order fragments efficiently (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: add helpers to process in-order fragments faster. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: use rb trees for IP frag queue. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: discard IPv4 datagrams with overlapping segments. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: modify skb_rbtree_purge to return the truesize of all purged skbs. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: speed up skb_rbtree_purge() (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] skbuff: Rename RHEL6 version of skb_tree_purge() to skb_tree_purge_sk() (Stefano Brivio) [1613925] {CVE-2018-5391}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.1.el6]
changelog:
  - [x86] set __max_smt_threads for 1 core systems (Prarit Bhargava) [1623255]
  - [md] dm rq: fix a race condition in rq_completed() (Ming Lei) [1574568]
  - [scsi] scsi_transport_fc: Hold queue lock while calling blk_run_queue_async() (Ming Lei) [1574568]
  - [block] Avoid scheduling delayed work on a dead queue (Ming Lei) [1574568]
  - [block] Avoid that request_fn is invoked on a dead queue (Ming Lei) [1574568]
  - [block] Let blk_drain_queue() caller obtain the queue lock (Ming Lei) [1574568]
  - [block] Rename queue dead flag (Ming Lei) [1574568]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.2.el6]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-754.6.3.el6]
changelog:
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.1.el6]
changelog:
  - [net] ip: Don't leak head fragment on queue timeout (Stefano Brivio) [1752536]
  - [vhost] vhost_net: fix possible infinite loop (Eugenio Perez) [1702941]
  - [vhost] vhost: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: use packet weight for rx handler, too (Eugenio Perez) [1702941]
  - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Eugenio Perez) [1702941]
  - [x86] x86/pti: Fix incorrect global bit setting with PTI on (Waiman Long) [1645724]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Rafael Aquini) [1560787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.25.1.el6]
changelog:
  - [kvm] KVM: VMX: Set VMENTER_L1D_FLUSH_NOT_REQUIRED if !X86_BUG_L1TF (Waiman Long) [1733760]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746799] {CVE-2019-14821}
  - [virt] KVM: MMIO: Lock coalesced device when checking for available entry (Bandan Das) [1746799] {CVE-2019-14821}
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1749512]
  - [security] KEYS: prevent creating a different user's keyrings (David Howells) [1537371]
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Denys Vlasenko) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.26.1.el6]
changelog:
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1764544]
  - [drm] vmwgfx: refuse to hibernate if we have any resources v2 (Kenneth Yin) [1748195]
  - [fs] CIFS: avoid using MID 0xFFFF (Leif Sahlberg) [1739948]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.27.1.el6]
changelog:
  - [mm] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() (Waiman Long) [1785321]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.28.1.el6]
changelog:
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1795404]
  - [isdn] mISDN: enforce CAP_NET_RAW for raw sockets (Andrea Claudi) [1779473] {CVE-2019-17055}
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778625] {CVE-2019-17133}
  - [netdrv] bonding: speed/duplex update at NETDEV_UP event (Patrick Talbert) [1772779]
  - [netdrv] bonding: make speed, duplex setting consistent with link state (Patrick Talbert) [1772779]
  - [netdrv] bonding: simplify / unify event handling code for 3ad mode (Patrick Talbert) [1772779]
  - [netdrv] bonding: unify all places where actor-oper key needs to be updated (Patrick Talbert) [1772779]
  - [netdrv] bonding: simple code refactor (Patrick Talbert) [1772779]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.29.1.el6]
changelog:
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775226] {CVE-2019-17666}
  - [x86] mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB (Denys Vlasenko) [1485759]
  - binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: Use generic PIE randomization (Denys Vlasenko) [1485759]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.1.el6]
changelog:
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827226] {CVE-2020-10711}
  - [netdrv] bonding: don't set slave->link in bond_update_speed_duplex() (Patrick Talbert) [1828604]
  - [security] KEYS: prevent KEYCTL_READ on negative key (Patrick Talbert) [1498368] {CVE-2017-12192}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.31.1.el6]
changelog:
  - [x86] x86/speculation: Provide SRBDS late microcode loading support (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Patrick Talbert) [1841819]
  - [mm] mm: migration: add migrate_entry_wait_huge() (Waiman Long) [1839653]
  - [powerpc] powerpc/book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Update Spectre v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make stf barrier PPC_BOOK3S_64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Gustavo Duarte) [1796810]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enhance the information in cpu_show_spectre_v1() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Use barrier_nospec in syscall entry (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enable barrier_nospec based on firmware settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Patch barrier_nospec in modules (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for ori barrier_nospec patching (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add barrier_nospec (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Add helper to check if offset is within relative branch range (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Have patch_instruction detect faults (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Introduce asm-prototypes.h (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Move local setup.h declarations to arch includes (Gustavo Duarte) [1796810]


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.7.3-17
changelog:
  - Remove vendor prefix from desktop file for f19+ https://fedorahosted.org/fesco/ticket/1077
  - Fix build by explicitly linking to libpthread


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-1
changelog:
  - rebase to 2.4.39 (#923680)
    + drop a lot of upstreamed patches, backport the rest
    + compile in mdb
    + remove automatic slapd.conf -> slapd-config conversion


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-3
changelog:
  - add another missing patch forgotten during the rebase
  - fix: enable dynamic linking - unresolved symbols in the smbk5pwd module


author: ClearFoundation <developer@clearfoundation.com> - 2.4.39-8.clear
changelog:
  - add upgrade support for audit log
  - add bind security policy to init script
  - remove /etc/openldap/slapd.d


author: Dan Walsh <dwalsh@redhat.com> - 2.0.94-5.1
changelog:
  - Cleanup selinux_mnt on disabled machines
  Resolves: #706049
  - Make restorecon python binding use realpath
  Resolves: #698583


author: Dan Walsh <dwalsh@redhat.com> - 2.0.94-5.6
changelog:
  - Back port handling of is_selinux_enabled form rhel7. We need is_selinux_enabled() to report disabled in a docker container so that SELinux aware applications do not attempt to do SELinux activities.
  Resolves: #1096816


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.94-5.7
changelog:
  - Fix selinuxdefcon to print end of line at the end of output.
  Resolves:#913115
  - Fix security_get_initial_context desc in security_compute_av.3
  Resolves:#1011109
  - Apply fix for selinux.8 man page from pschiffe@redhat.com.
  Resolves:#1011145


author: Miroslav Grepl <mgrepl@redhat.com> - 2.0.94-5.8
changelog:
  - avc_has_perm will now return yes if the machine is in permissive mode
  Resolves:#753675
  - nscd permission support for netgroup
  - Fix matchpathcon verify handling to fail on non-existing objects


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-5
changelog:
  - spec cleanup
  - simplified packaging (merge -perl in -utils)
  - remove obsoleted and/or unmaintained additional sources/patches
  - remove long time not used files from the cvs/srpm
  - update additional sources/patches from their upstream


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-6.4
changelog:
  - fix CVE-2011-3481: NULL pointer dereference via crafted 
    References header in email (#738391)
  - fix CVE-2011-3372: nntpd authentication bypass (#740822)


author: Support <support@atomicorp.com> - 2.7-19
changelog:
  - Feature Request #XXX, revert duplicate detection in log events to help detect extremely fast brute force attacks
  - Add FORTIFY_SOURCE, PIE, and relro (full)


author: Support <support@atomicorp.com> - 2.7-21
changelog:
  - Bugfix on permissions for files in shared/ directory for client installs
  - Add GeoIP support
  - Remove dependency on perl-DBD-SQLite
  - Update asl-shun to new non-perl based version.
  - Deprecate firewall-drop-update.patch
  - Add sqlite support to execd (/var/ossec/var/execd.sqlite)


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.23-6
changelog:
  - resolves: #1105500 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108841 - CVE-2014-3493: DoS in smbd with unicode path names.


author: - Andreas Schneider <asn@redhat.com> - 3.6.23-8
changelog:
  - resolves: #1110733 - Fix write operations as guest with 'security = share'.
  - resolves: #1053886 - Fix receiving the gecos field with winbind.


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.39-1
changelog:
  - remount /proc to set attributes from fstab #984003
  - print something when arping is detecting colliding ip addresses
  - try dhcpv6 after v4 failed
  - Allow dhclient configuration files for DHCPv6 as well. (#815676)
  - ifdown: don't call nmcli on interface that is alread down
  - call flush addresses with scope global
  - init: inform users about .override files in .conf files
  - netfs: do not force NFS exports to be mounted before _netdev mounts
  - set net.ipv6.conf..autoconf in ifup-ipv6
  - mention rule6 files
  - securetty: check if the device is in the file before attempting to write to it
  - Process rule6-* for sit devices (#840009)
  - Killproc -d should parse same values as sleep
  - Make killproc more granular when delay is passed. (#428029, <xjakub@fi.muni.cz>)
  - bonding: set master up before slaves
  - Fix greps to correctly handle comments and quotation (#915659)


author: Lukas Nykryn <lnykryn@redhat.com> - 9.03.40-1
changelog:
  - sync disks before halt (#1006294)
  - provide KVM guest count and limit info message (#1014731)
  - add ability to disable LVM activation on boot (#1015065)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.41-1
changelog:
  - netfs: implicitly handle glusterfs as a network filesystemd
  - init.d/functions: check parent dir of pid file for accessibility
  - ifup-eth: some options for bridge can be applied after the bridge is up
  - rc.sysinit: apply sysctl settings before starting udev
  - ifup: add possibility to specify value for -w parameter of arping
  - ifup-tunnel: call ifup-ipv6 in the end
  - pids_var_run: handle '(deleted)'
  - require correct version of upstart
  - rc.sysinit: use 'vgchange --ignoreskippedcluster'
  - during install do not create /var/lib/random-seed if /dev/urandom does not exist
  - rc.sysinit: increase the saved random-seed to 4K (#1023471)
  - umount-loop: make sure that we don't kill our own process
  - umount-loop: don't use xargs
  - ifup-eth: remove ipx relic (#1028135)
  - init.d/functions: add -b optin to status and killproc (#1047948)
  - remove duplicit then


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.42-1
changelog:
  - ipcalc: -c allow netmask
  - ipcalc: parse prefix more safely
  - vi.po: fix parentheses
  - network-functions: handle BONDING_OPTS better
  - custom naming for VLAN devices
  - bonding: match whole name of interface
  - network-functions: ETHTOOL_DELAY introduction patch
  - ifup-wireless: add support for wowlan
  - Remove NETWORKING_IPV6 from sysconfig.txt (#918622)
  - bridging: add possibility to set prio and ageing


author: Lukáš Nykrýn - 9.03.43-1
changelog:
  - ifup-aliases: arpcheck - check for parent operstate and carrier
  - ifdown: don't wait for aliases
  - hotplug: don't call ifup when new vlan appears
  - ifup-wireless: add support for wowlan (second part)
  - readonly-root: remount rpc_pipefs if readonly-root is used


author: John W. Linville <linville@redhat.com> - 0.7.3-4
changelog:
  - Add reference to sample hostapd.conf in the default installed version
  - Include README-WPS from the hostapd distribution as part of the docs


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-58
changelog:
  - Applied patch to fix 'Bad request' errors as a result of adding in
    httpSetTimeout (STR #4440, also part of svn revision 9967).


author: Jiri Popelka <jpopelka@redhat.com> - 1:1.4.2-60
changelog:
  - CVE-2014-2856: cross-site scripting flaw (bug #1117798)
  - CVE-2014-3537: insufficient checking leads to privilege escalation (bug #1117794)


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-63
changelog:
  - Applied upstream patch to fix CVE-2014-5029 (bug #1122600),
    CVE-2014-5030 (bug #1128764), CVE-2014-5031 (bug #1128767).
  - Fix conf/log file reading for authenticated users (STR #4461).


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-66
changelog:
  - More STR #4461 fixes from upstream: make rss feeds world-readable,
    but cachedir private.
  - Fix icon display in web interface during server restart (STR #4475).


author: Lennart Poettering <lpoetter@redhat.com> - 0.6.25-7
changelog:
  - Fix for CVE-2010-2244
  - Resolves: #607296
  - Resolves: #594405
  - Related 587761
  - Related 584761
  - Related 584766
  - Related 596151
  - Related 599435


author: Tomas Mraz <tmraz@redhat.com> - 6.1.12-6
changelog:
  - add support for joining IPAv2 domains
  - fix exception handling (#689717)
  - drop obsolete configuration files from manual page
  - use krb5_server instead of obsolete krb5_kdcip (#749700)
  - do not signal error on saving backups for missing config files (#755975)


author: Tomas Mraz <tmraz@redhat.com> - 6.1.12-7
changelog:
  - detect error exit value from ipa-client-install
  - use --noac option with ipa-client-install
  - add sss to the services entry in nsswitch.conf (#804615)


author: Tomas Mraz <tmraz@redhat.com> - 6.1.12-15
changelog:
  - save backups of password files when toggling shadow support (#852997)
  - read and overwrite only the general ldap base (#912851)
  - use sss for automount
  - more robust initialization of SSSDConfig (#1016404)
  - output error message from write error
  - properly set IPAV2DOMAINJOINED and call ipa client uninstall
    when appropriate (#1023286)
  - add umask=0077 to initial pam_mkhomedir args (#1025065)
  - fix broken --help output (#1066811)
  - check whether ldap URI is valid (#707590)
  - restart only services affected by configuration changes (#1023293, #975203)
  - report error from winbind and ipa domain joins


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.6-1
changelog:
  - New upstream release 1.1.6
  - Drop upstream patches
  - Required for upcoming Samba 4 beta
  - Explicitly build with tdb1 support


author: Stephen Gallagher <sgallagh@redhat.com> - 1.1.8-1
changelog:
  - New upstream release 1.1.8
  - Required for latest Samba 4 beta
  - Fixes for pyldb
  - Revert to using tdb1 by default
  - Drop support for tdb_compat
  - CCAN is no longer built as a static library


author: HAT <hat@fa2.so-net.ne.jp> - 4:3.0.3-0.0.7
changelog:
  - updated to latest upstream 3.0.3
  - BuildRequires: dbus-devel dbus-glib-devel glib2-devel systemtap-sdt-devel
  - remove netatalk-3.0.2-rc.patch and netatalk-3.0.2-libevent.patch


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> - 0.144-2533_1
changelog:
  - Removed dependency of atrpms to comply with ClearOS policy
  - Updated upstream to latest stable from Git
  - Added post and postun ldconfig


author: Fredrik Fornstad <fredrik.fornstad@gmail.com> - 0.148-26_20160123.2245
changelog:
  - Updated upstream to latest stable snapshot
  - Changed naming of shared lib after discussion with ClearOS team


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.32.1.el6]
changelog:
  - [wireless] libertas: make lbs_ibss_join_existing() return error code on rates overflow (Jarod Wilson) [1776569]
  - [wireless] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held (Jarod Wilson) [1776569]
  - [wireless] libertas: Fix two buffer overflows at parsing bss descriptor (Jarod Wilson) [1776569]
  - [security] keys: Protect request_key() against a type with no match function (Patrick Talbert) [1433220] {CVE-2017-2647}


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.10-15
changelog:
  - New upstream release 1.2.10
  - Remove upstreamed patches
  - Provides functionality for the upcoming Samba 4 beta


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-66
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-68
changelog:
  - Resolves: #1450298 - when ProxyErrorOverride is On, modcluster
    return 503 status code on subsequent requests (2)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-69
changelog:
  - Resolves: #1471383 - httpd.worker abort()s with misc/apr_reslist.c:159:
    reslist_cleanup: Assertion `rl->ntotal == 0' failed


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-55.P1
changelog:
  - Resolves: #1527995 - allow static route with a 0.0.0.0 next-hop address
  - Related: #1527995 -  install link-local static routes with correct scope


author: Karanbir Singh <kbsingh@centos.org> 0.7.5-2.el7.centos.1
changelog:
  - Add OpenNebula patch to work with requiretty in sudoers (Jfontan #7543)
  - Add cloudstack url workaround patch (Lucian #7544)


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-22
changelog:
  - mod_cache: fix header merging for 304 case, thanks to Roy Badami (#868283)
  - mod_cache: fix handling of 304 responses (#868253)


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-25
changelog:
  - htcacheclean: exit with code 4 if nonprivileged user runs initscript (#805810)
  - rotatelogs: omit the second arg when invoking a post-rotate program (#876923)


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-30
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1078174)
  - mod_log_config: add security fix for CVE-2014-0098 (#1078174)


author: Nils Philippsen <nils@redhat.com> - 2.72-3
changelog:
  - don't include /etc/dnsmasq.d in triplicate, ignore RPM backup files instead
  - package is dual-licensed GPL v2 or v3
  - drop %triggerun, we're not supposed to automatically migrate from SysV to
    systemd anyway


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-8
changelog:
  - Addresses entity expansion DoS vulnerability in REXML.
    * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch
  - Resolves: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-9
changelog:
  - Fix regression introduced by fix for entity expansion DOS vulnerability
    in REXML (https://bugs.ruby-lang.org/issues/7961)
    * ruby-2.0.0-add-missing-rexml-require.patch
  - Related: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-10
changelog:
  - $SAFE escaping vulnerability about Exception#to_s / NameError#to_s
    * ruby-1.8.7-p371-CVE-2012-4481.patch
    - Related: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-11
changelog:
  - hostname check bypassing vulnerability in SSL client.
    * ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch
    - Resolves: rhbz#979301


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-12
changelog:
  - Fix regression introduced by CVE-2013-4073
    https://bugs.ruby-lang.org/issues/8575
    * ruby-2.0.0-p255-Fix-SSL-client-connection-crash-for-SAN-marked-critical.patch
    - Related: rhbz#979301


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-13
changelog:
  - Workaround build issues against OpenSSL with enabled ECC curves.
  - Make DRb compatible with OpenSSL 1.0.1.
    * ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch
  - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing
    * ruby-1.9.3-p484-CVE-2013-4164-ignore-too-long-fraction-part-which-does-not-affect-the-result.patch
    - Resolves: rhbz#1033502


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-1
changelog:
  - Update to Ruby 1.8.7-p374.
    * Remove Patch41: ruby-ppc64-segv-fix.patch; subsumed
    * Remove Patch45: ruby-1.8.7-CVE-2011-0188.patch; subsumed
    * Remove Patch46: ruby-1.8.7-FIPS.patch; subsumed
    * Remove Patch47: ruby-1.8.7-p352-mkconfig.rb-fix-for-continued-lines.patch; subsumed
    * Remove Patch48: ruby-1.8.7-p352-CVE-2011-4815.patch; subsumed
    * Remove Patch49: ruby-1.8.7-p358-marshal-load-segv-fix.patch; subsumed
    * Remove Patch50: ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch; subsumed
    * Remove Patch51: ruby-2.0.0-add-missing-rexml-require.patch; subsumed
    * Remove Patch52: ruby-1.8.7-p371-CVE-2012-4481.patch; subsumed
    * Remove Patch53: ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch; subsumed
    Resolves: rhbz#830098
  - Enable ECC support, provided by OpenSSL, in Ruby
    * ruby-1.9.3-p482-Fix-build-against-OpenSSL-with-enabled-ECC-curves.patch
    Resolves: rhbz#1033864
  - Exclude test that fails when issuing a certificate with RSA signature and
    DSS1 digest for earlier OpenSSL versions when used in conjunction with
    OpenSSL 1.0.1.
    * ruby-1.9.3-p172-Exclude-failing-tests-written-for-earlier-OpenSSL.patch
    Resolves: rhbz#1034351
  - Rename Tracer.fire to SystemTap.fire to avoid conflict with Ruby's tracer.
    Resolves: rhbz#784766


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-2
changelog:
  - Replace hardcoded MD5 by sha256 to prevent SSL server failure in FIPS mode.
    * ruby-1.8.7-p374-Replace-md5-by-sha256-to-fix-SSL-server-FIPS-compatibility.patch
  - Resolves: rhbz#802946


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-3
changelog:
  - Fix REXML billion laughs attack via parameter entity expansion
    (CVE-2014-8080).
    Resolves: rhbz#1163993
  - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
    Resolves: rhbz#1163993


author: Paulo Roma <roma@lcg.ufrj.br> - 3.98-17
changelog:
  - Removed patch0 (libm).
  - Using %bcond_with mp3rtp (the build fails with it).
  - Using nasm for x86_64.
  - Disabled rpath.
  - Changed license.
  - Converted ChangeLog to utf8.


author: Jiri Popelka - 12:4.1.1-35.P1
changelog:
  - various memory leaks in omapi (#978420)
  - Modify the reply handling in the server code to send to a specified port
    rather than to the source port for the incoming message. (#952126)
  - Multiple key statements in zone definition causes inappropriate error (#919221)
  - Make sure range6 is correct for subnet6 where it's declared (#902966)
  - Relay no longer crashes, when DHCP packet is received over interface
    without any IPv4 address assigned. (#863936)
  - Expose next-server DHCPv4 option to dhclient script. (#658855)


author: Jaromír Končický <jkoncick@redhat.com> - 12:4.1.1-40.P1
changelog:
  - Fix handling of UDP packets with checksum 0xffff. (#1015997)
  - Add GUIDs in the DHCP logs for IPoIB. (#1064416)


author: Jaromír Končický <jkoncick@redhat.com> - 12:4.1.1-41.P1
changelog:
  - Fix dhcpd.leases reverting to root:root on every dhcpd start (#1067142)
    New patch "paranoia" merged with older "paranoia-pid" patch
  - Add init script for dhcrelay IPv6 version (#1053155)


author: Kristian Høgsberg <krh@redhat.com> - 7.2-1
changelog:
  - Use the new catalogue font install mechanism, drop all chkfontpath dependencies.
  - Unsplit base and misc subpackages, we don't require any base fonts
    now that we have built-ins.


author: Tom "spot" Callaway <tcallawa@redhat.com> - 7.2-5
changelog:
  - Remove bh-ttf and bh-type1 (Luxi fonts) and truetype subpackage, due to 
    licensing issues (#317641)
  - Correct license tag


author: Tom "spot" Callaway <tcallawa@redhat.com> - 7.2-6
changelog:
  - IBM refused to relicense ibm-type1 fonts with permission to modify,
    so they were dropped (bugzilla 317641)
  - Meltho Syrian fonts (misc-meltho) have a bad license, upstream did not
    respond to request for relicensing, so they were dropped. This also
    means that the -syriac subpackage has been removed. (bugzilla 317641)


author: Petr Menšík <pemensik@redhat.com> - 2.76-1
changelog:
  - Rebase to 2.76 (#1375527)
  - Include also dhcp_release6 (#1375569)
  - Fix compilation warnings
  - Correct manual about interface aliases, warn if used without --bind*


author: Petr Menšík <pemensik@redhat.com> - 2.76-2
changelog:
  - Fix a few coverity warnings
  - package is dual-licensed GPL v2 or v3
  - don't include /etc/dnsmasq.d in triplicate, ignore RPM backup files instead


author: Petr Menšík <pemensik@redhat.com> - 2.76-2.1
changelog:
  - Fix CVE-2017-14491
  - Fix CVE-2017-14492
  - Fix CVE-2017-14493
  - Fix CVE-2017-14494
  - Fix CVE-2017-14496
  - Fix CVE-2017-14495
  - extra fixes


author: Jesse Keating <jkeating@redhat.com> - 2.0.14-1
changelog:
  - Fix package excludes in kickstart files
  - Correctly account for ppc bootable isofs overhead
  - Wire in support for composing 'full' trees with all subpackages


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-5
changelog:
  - Correctly mark the LDAP default password value as encrypted (CVE-2011-0002)
    Resolves: #668021
  - Default LDAP cn to username if gecos is empty
    Resolves: #670151
  - Preserve setuid and setgid bits when copying files from /etc/skel
    Resolves: #724987
  - Fix segfault when reading database files with certain sizes
    Resolves: #788521


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-3
changelog:
  - Resolves: rhbz#692251 - tdb_extend() can cause a memory-usage explosion if
  -                         the size of its entries are very large


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.10-1
changelog:
  - Resolves: rhbz#766334 - Rebase libtdb to match the version required
                            by Samba4
  - Enable the Python bindings to satisfy samba4 BuildRequirements
  - Obsoletes tdb-1.2.9-limit-tdb_expand.patch


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.8-3.2
changelog:
  - Move _tdb_text.py to python-tdb subpackage
  - Resolves: rhbz#1329664 - tdb mispackaged tdb_text.py file


author: Tom Lane <tgl@redhat.com> 2:1.2.46-1
changelog:
  - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,
    CVE-2011-2691, CVE-2011-2692
  Resolves: #721305


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-1
changelog:
  - Rebase libtevent to 0.9.26
  - Remove upstreamed or no longer applicable patches
  - Related: rhbz#1322688


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-2
changelog:
  - temporarily disable make check, which keeps failing in mock despite
    working correctly on a full system
  - Related: rhbz#1322688


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-11
changelog:
  - fixed shutdown hang if root filesystem is network based (rhbz#1007632)
    Thanks to Rodrigo A B Freire for the patch


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-12
changelog:
  - added ip6t_set (rhbz#1033270)
  - do not block uninstall on a failing alternatives --remove call in preun
    (rhbz#1059214) (rhbz#1070123)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-15
changelog:
  - Add message for init script error returns (rhbz#1081191)
  - Fix rule deletion of ipset matches (rhbz#1081422)
  - Add space after dccp types (rhbz#1084974)
  - Add -C option to check for existing rules (rhbz#1088361)
  - Copy custom plugins for updates from iptables < 1.4.7-10 (rhbz#1088400)
  - Enable the IPv6 set target (rhbz#1161330)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-16
changelog:
  - Fixed ressource leak in libiptc found by coverity (rhbz#1088361)
  - Copy custom plugins also for releases up to 14 (rhbz#1088400)


author: Phil Sutter <psutter@redhat.com> - 1.4.7-17
changelog:
  - Include /etc/sysctl.d when searching for settings to apply (rhbz#1459673)
  - Ignore security table when setting chain policies (rhbz#1210563)


author: ClearFoundation <developer@clearfoundation.com> 1.4.7-19.clear
changelog:
  - added IMQ patches
  - removed init scripts and sysconfig configuration
  - removed chkconfig reference


author: Dan Walsh <dwalsh@redhat.com> - 2.0.41-1
changelog:
  - Update to upstream
    * Add pkgconfig file from Eamon Walsh.
    * Add semanage_set_check_contexts() function to disable calling
    setfiles


author: Dan Walsh <dwalsh@redhat.com> - 2.0.43-1
changelog:
  - Update to upstream
    * Move libsemanage.so to /usr/lib
    * Add NAME lines to man pages from Manoj Srivastava<srivasta@debian.org>


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.34.1.el6]
changelog:
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705003]
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705003]


