# changelog

author: Nalin Dahyabhai <nalin@redhat.com> 1.9-14
changelog:
  - krb5kdc init script: pull in some changes to do a quick spot-check
    of the TGS and kadmind keys and warn if there aren't any non-weak keys
    on file for them (#651466)
  - don't use %{?_smp_mflags} -- the build machinery doesn't always work
    right for those cases
  - tag the application of patches which we use to fix compile problems with
    %{_rawbuild} so that minimum-patches builds can be done (#711032)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-15
changelog:
  - backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE
    to talk to a KDC by using poll() if it's detected at compile-time (#701446,
    RT#6905)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-16
changelog:
  - kadmind.init: drop the attempt to detect no-database-present errors (#724033)
  - build shared libraries with partial RELRO support (#723995)
  - filter out potentially multiple instances of -Wl,-z,relro from krb5-config
    output, now that it's in the buildroot's default LDFLAGS


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-17
changelog:
  - override the default build rules to not delete temporary y.tab.c files,
    so that they can be packaged, allowing debuginfo files which point to them
    do so usefully (#729044)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-19
changelog:
  - handle an assertion failure that starts cropping up when the patch for
    using poll (#701446) meets servers that aren't running KDCs or against
    which the connection fails for other reasons (#727829, #734172)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-21
changelog:
  - pull in upstream patch for RT#6952, confusion following referrals for
    cross-realm auth with AD KDCs (#734341)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-22
changelog:
  - handle a harder-to-trigger assertion failure that starts cropping up when we
    exit the transmit loop on time (#746341)
  - apply upstream patch to fix a null pointer derference with the LDAP kdb
    backend (CVE-2011-1527), an assertion failure with multiple kdb backends
    (CVE-2011-1528), and a null pointer dereference with multiple kdb backends
    (CVE-2011-1529) (MITKRB5-SA-2011-006, #740085)


author: Nalin Dahyabhai <nalin@redhat.com> 1.9-22.1
changelog:
  - add candidate patch to fix a NULL pointer dereference while processing TGS
    requests (MITKRB5-SA-2011-007, #754046)


author: Rich Megginson <rmeggins@redhat.com> - 1.2.9.8-1
changelog:
  - Bug 733443 - large targetattr list with syntax errors cause server to crash or hang
  - Bug 734267 - upgradednformat failed to add RDN value - subtree and user account lockout policies implemented?
  - Bug 733434 - passwordisglobalpolicy attribute brakes TLS chaining
  - Bug 733442 - Ignore an error 32 in this case since we're adding a new AutoMember definition
  - Bug 733440 - RFE: add option to allow server to start with an expired certificate


author: Rich Megginson <rmeggins@redhat.com> - 1.2.9.11-1
changelog:
  - Bug 739196 - Consolidate DS and DS replication bits in one package in RHEL 6.2
  - There were two patches in ds-replication for RHEL 6.2 that were added post
  - rebase - the two patches for 722292 - these are now in the 389-ds-base package
  - and have been cherry-picked to the RHEL-6 internal branch


author: Rich Megginson <rmeggins@redhat.com> - 1.2.9.12-1
changelog:
  - Bug 742661 - allow resource limits to be set for paged searches
  -  independently of limits for other searches/operations
  - Bug 742381 - part2 - MOD operations with chained delete/add get
  -  back error 53 on backend config
  - Bug 742382 - allow nsslapd-idlistscanlimit to be set dynamically and per-user
  - Bug 742381 - MOD operations with chained delete/add get back
  -  error 53 on backend config
  - Bug 739959 - Allow separate fractional attrs for incremental and total protocols


author: Rich Megginson <rmeggins@redhat.com> - 1.2.9.13-1
changelog:
  - Bug 742381 - part3 - MOD operations with chained delete/add get
  -  back error 53 on backend config


author: Rich Megginson <rmeggins@redhat.com> - 1.2.9.14-1.1
changelog:
  - git branch RHEL-6_2-Z tag 389-ds-base-1.2.9.14-1.1
  - Bug 758682 - crash when simple paged fails to send entry to client
  - Bug 758683 - rhds81 modrn operation and 100% cpu use in replication
  - Bug 758688 - Fix Coverity (11104) Resource leak: ids_sasl_user_to_entry (slapd/saslbind.c)


author: Rich Megginson <rmeggins@redhat.com> - 1.2.9.14-1.2
changelog:
  - Bug 771632 - Incorrect entryUSN index under high load in replicated environment
  - Bug 771631 - Add slapi_rwlock API and use POSIX rwlocks
  - WARNING - patches 0030 and 0031 remove and add back the file configure
  - this is necessary because the merge commit to "rebase" RHEL-6 to 1.2.9.6
  - seriously messed up configure - so in order to add the patch for 743979
  - which also touched configure, the file had to be removed and added back
  - also note that the commit for the RHEL-6 branch to remove configure does
  - not work - the way patch works, it has to match every line exactly in
  - order to remove the file, and because the merge commit messed things
  - up, it doesn't work
  - So, DO NOT TOUCH 0030-remove-configure-to-get-rid-of-merge-conflict.patch
  - BECAUSE IT IS HAND CRAFTED and not generated by git format-patch
  - if you must regenerate this file,
  - git format-patch ...args... to generate a file in patch format
  - remove all of the patch matches (all the lines beginning with -)
  - get the 1.2.9.6 version of configure from the source tarball
  - wc -l configure to get the number of lines in the file
  - sed 's/^/-/' configure >> thefile.patch
  - edit thefile.patch to have the right number of lines and have the
  - patch commands in the correct place
  - PROFIT!!!


author: Rich Megginson <rmeggins@redhat.com> - 1.2.8-0.7.rc2
changelog:
  - 389-ds-base-1.2.8 release candidate 2 - git tag 389-ds-base-1.2.8.rc2
  - Bug 689908 - (cov#10610) Fix Coverity NULL pointer dereferences
  - Bug 689895 - ns-newpwpolicy.pl needs to use the new DN format
  - Bug 689889 - RFE: allow fine grained password policy duration attributes
  -              in days, hours, minutes, as well
  - Bug 688730 - Exported tombstone cannot be imported correctly
  - Bug 684349 - slapd crashing when traffic replayed
  - Bug 682897 - Allow maxlogsize to be set if logmaxdiskspace is -1
  - introduce the concept of the srcprerel - with rc2, we did not rebase
  - the source, we are still using the .rc1 source tarball, so we use
  - srcprerel of .rc1 but package pre-release is .rc2


author: Rich Megginson <rmeggins@redhat.com> - 1.2.8-0.9.rc4
changelog:
  - Bug 668385 - DS pipe log script is executed as many times as the dirsrv service is restarted
  - bump version to 1.2.8.rc4 - bump ds console version to 1.2.5


author: Rich Megginson <rmeggins@redhat.com> - 1.2.8.0-1
changelog:
  - 389-ds-base-1.2.8.0
  - Bug 693523 - Unable to change schema online
  - Bug 693520 - matching rules do not inherit from superior attribute type
  - Bug 693522 - nsMatchingRule does not work with multiple values
  - Bug 693519 - cannot use localized matching rules
  - Bug 693516 - Segfault on index update during full replication push on 1.2.7.5


author: Rich Megginson <rmeggins@redhat.com> - 1.2.8.0-2
changelog:
  - added srcver because the version from the source is now
  - different than the source in the package


author: Rich Megginson <rmeggins@redhat.com> - 1.2.8.2-1
changelog:
  - 389-ds-base-1.2.8.2
  - Bug 696407 - If an entry with a mixed case RDN is turned to be
  -    a tombstone, it fails to assemble DN from entryrdn


author: Rich Megginson <rmeggins@redhat.com> - 1.2.8.2-1.1
changelog:
  - note: following the z-stream N-V-R convention - this is a z-stream
  - package for rhel-6.1.z - the .1 at the end means this is the first
  - z-stream release for the 389-ds-base-1.2.8.2 package in RHEL 6.1
  - this package is really 389-ds-base-1.2.8.3
  - Resolves: Bug 701560 - memory leak: entryusn value is leaked when an entry is deleted
  - Resolves: Bug 701556 - windows sync can lose old multi-valued attribute values when a new value is added
  - Resolves: Bug 701558 - ldclt core dumps
  - Resolves: Bug 701559 - Linked attributes callbacks access free'd pointers after close
  - Resolves: Bug 701554 - userpasswd not replicating


author: Rich Megginson <rmeggins@redhat.com> - 1.2.8.2-1.3
changelog:
  - Resolves: Bug 705837 - 389-ds should only be supported and supplied in channels for i386 and x86_64 Server distributions - RHEL 6.1 0day Advisory
  - Add ExclusiveArch for x86 and x86_64 only


author: Adam Tkac <atkac redhat com> 32:9.7.3-1
changelog:
  - update to 9.7.3 (CVE-2011-0414)
  - patches merged
    - bind97-gsstsig.patch
    - bind97-rh664401.patch
    - bind97-rh623638.patch


author: Adam Tkac <atkac redhat com> 32:9.7.3-6.P3
changelog:
  - load/unload dyndb plugins on appropriate places to avoid crashes (#725577)
  - nsupdate could have failed if server has multiple IPs and the first
    was unreachable (#714049)
  - nsupdate returned zero when target zone didn't exist (#700097)
  - readd configtest target to initscript
  - print "the working directory is not writable" as debug message
  - fix some Coverity warnings


author: Adam Tkac <atkac redhat com> 32:9.7.3-8.P3.1
changelog:
  - fix race condition in resolver.c:validated()
  - improve error handling in zone.c:zone_refreshkeys() to avoid
    hang during shutdown


author: Michal Hlavinka <mhlavink@redhat.com> - 20100621-7
changelog:
  - ksh did not wait for pipeline to complete when pipefail option was used (#702016)
  - completion used after an environment variable reported bad susbstituion error (#702015)
  - ksh child exit code not preserved correctly (#702013)
  - do not change $0 in posix function (#702011)
  - fix man page information about default value for PATH variable (#702008)
  - do not use invalid PID values in ksh kill built-in (#701890)
  - fix crashe when IFS is unset inside a function (#683734)
  - do not count empty array elements (#702014)


author: Caolan McNamara <caolanm@redhat.com> - 4.2.1-9
changelog:
  - Resolves: rhbz#596171 drop icu.icu6284.strictalias.patch and use
    -fno-strict-aliasig as upstream has added a pile more and doesn't look
    interested in proposed patchs


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-70.1
changelog:
  - enable aes-ctr ciphers use the EVP engines from OpenSSL such as the AES-NI (#756929)
  - add CAVS test driver for the aes-ctr ciphers (#782091)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-15
changelog:
  - better documentation of the available digests in apps (#693858)
  - backported CHIL engine fixes (#693863)
  - allow testing build without downstream patches (#708511)
  - enable partial RELRO when linking (#723994)
  - add intelx engine with improved performance on new Intel CPUs
  - add OPENSSL_DISABLE_AES_NI environment variable which disables
    the AES-NI support (does not affect the intelx engine)


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-16
changelog:
  - merge the optimizations for AES-NI, SHA1, and RC4 from the intelx
    engine to the internal implementations


author: Tomas Mraz <tmraz@redhat.com> 1.0.0-20.1
changelog:
  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery
    vulnerability and additional DTLS fixes (#771770)
  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775)
  - fix for CVE-2011-4577 - possible DoS through malformed RFC 3779 data (#771778)
  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-5
changelog:
  - spec cleanup
  - simplified packaging (merge -perl in -utils)
  - remove obsoleted and/or unmaintained additional sources/patches
  - remove long time not used files from the cvs/srpm
  - update additional sources/patches from their upstream


author: Michal Hlavinka <mhlavink@redhat.com> - 2.3.16-6.4
changelog:
  - fix CVE-2011-3481: NULL pointer dereference via crafted 
    References header in email (#738391)
  - fix CVE-2011-3372: nntpd authentication bypass (#740822)


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-59
changelog:
  - Resolves: rhbz#742288 - RFC2307bis initgroups calls are slow
  - Resolves: rhbz#746654 - SSSD backend gets killed on slow systems
  - Related:  rhbz#743925 - HBAC processing is very slow when dealing with
                            FreeIPA deployments with large numbers of hosts
                            Fixes a crash introduced by the earlier patch.
  - Related:  rhbz#733382 - SSSD should pick a user/group name when there are
                            multi-valued names
                            Fixes for internationalization


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-60
changelog:
  - Related:  rhbz#743841 - SSSD can crash due to dbus server removing a UNIX
                            socket


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-64
changelog:
  - Resolves: rhbz#749822 - SSSD may go into infinite loop during RFC2307bis
                            initgroups when groups appear in multiple nesting
                            levels


author: Stephen Gallagher <sgallagh@redhat.com> - 1.5.1-66.1
changelog:
  - Resolves: rhbz#758696 - sssd_nss crashes when passed invalid UTF-8 for the
                            username in getpwnam()
  - Resolves: rhbz#758713 - LDAP failover not working if server refuses
                            connections


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-20.P1
changelog:
  - The 'hardware [ethernet|etc] ...;' parameter in host records has been
    extended to attempt to match DHCPv6 clients by the last octets
    of a DUID-LL or DUID-LLT provided by the client. (#706974)
  - Explicitly clear the ARP cache and flush all addresses & routes
    instead of bringing the interface down (#694799)
  - Use PID for seeding the random number generator in dhclient (#694798)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-21.P1
changelog:
  - A pair of defects cause the server to halt upon processing certain packets
    (CVE-2011-2748, CVE-2011-2749, #729885)


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-23.P1
changelog:
  - Build libraries with -fpic/-fPIC, not with -fPIE (#736999)
  - Add dhcp-common subpackage (#736194)
  - Do not run dhcpd as root (#693381)
    - Use '--enable-paranoia' configure flag
    - Create dhcpd user in %pre
    - Run dhcpd/dhcpd6 services with '-user dhcpd -group dhcpd'
    - Move changing of the effective user/group ID after writing new PID file.


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-216.el6]
changelog:
  - [scsi] lockless queuecommand dispatch fixup (Rob Evers) [749018]
  - [scsi] iscsi class: export pid of process that created session (Mike Christie) [747696]
  - [scsi] qla4xxx: Autologin persisted target entries (Mike Christie) [747696]
  - [netdrv] iwlagn: enable 11n aggregation without checking traffic load (John Linville) [744361]
  - [s390x] qdio: EQBS retry after CCQ 96 (Hendrik Brueckner) [747578]
  - [s390x] dasd: fix UID readout for z/VM (Hendrik Brueckner) [746000]
  - [x86] PCI: irq and pci_ids patch for Intel Panther Point DeviceIDs (Prarit Bhargava) [747638]
  - [netdrv] Help 6.1 out of tree drivers cope with ABI breakage (Thomas Graf) [746570]
  - [mm] shmem: let shared anonymous be nonlinear again (Larry Woodman) [690129]
  - [fs] ext4: fix BUG_ON() in ext4_ext_insert_extent() (Lukas Czerner) [742091] {CVE-2011-3638}
  - [ipc] mqueue: separate mqueue default value from maximum value (Motohiro Kosaki) [746606]
  - [ipc] mqueue: don't use kmalloc with KMALLOC_MAX_SIZE (Motohiro Kosaki) [746606]
  - [ipc] mqueue: revert bump up DFLT_*MAX (Motohiro Kosaki) [746606]
  - [kernel] ipc/mqueue: Up the hard limit on message queues per namespace (Doug Ledford) [746606]
  - [kernel] ipc/mqueue: update maximums for the mqueue subsystem (Doug Ledford) [746606]
  - [kernel] ipc/mqueue: enforce hard limits (Doug Ledford) [746606]
  - [kernel] ipc/mqueue: switch back to using non-max values on create (Doug Ledford) [746606 746898]
  - [kernel] ipc/mqueue: cleanup definition names and locations (Doug Ledford) [746606]
  - [kernel] Revert "Restore max mqueue message size to its previous RHEL 5 value" (Doug Ledford) [746606]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-217.el6]
changelog:
  - [fs] GFS2: rewrite fallocate code to write blocks directly (Benjamin Marzinski) [750208] {CVE-2011-4098}
  - [netdrv] bnx2x: link fixes for 57810 (Andy Gospodarek) [749421]
  - [netdrv] enic: fix accidental GRO off by default (Stefan Assmann) [749390]
  - [scsi] qla2xxx: Correct inadvertent clearing of RISC_INTR status (Chad Dupuis) [748978]
  - [debug] lockdep: double MAX_LOCKDEP_ENTRIES (Kyle McMartin) [748941]
  - [x86] Add missing KERN_DEBUG to x86 module printk (Prarit Bhargava) [747837]
  - [x86] Update module alternatives message (Prarit Bhargava) [745596]
  - [x86] UV: KABI breakage in uv_blade_info (George Beshers) [745253]
  - [net] vlan: fix panic when handling priority tagged frames (Andy Gospodarek) [714936] {CVE-2011-3593}
  - [scsi] qla4xxx: Autologin persisted target entries update (Mike Christie) [747696]
  - [mm] oom: fix integer overflow of points in oom_badness (Frantisek Hrbata) [741207] {CVE-2011-4097}


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-218.el6]
changelog:
  - [netdrv] benet: remove bogus "unlikely" on vlan check (Ivan Vecera) [736429] {CVE-2011-3347}
  - [netdrv] be2net: non-member vlan pkts not received in promiscous mode (Ivan Vecera) [736429] {CVE-2011-3347}
  - [netdrv] be2net: fix crash receiving non-member VLAN packets (Ivan Vecera) [736429] {CVE-2011-3347}
  - [mm] fix race between mremap and removing migration entry (Andrea Arcangeli) [751084]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-219.el6]
changelog:
  - [kernel] KEYS: Fix a NULL pointer deref in the user-defined key type (David Howells) [751190] {CVE-2011-4110}
  - [scsi] fc class: fix building of Fibre Channel DUP drivers in 6.2 (Mike Christie) [750268]
  - [fs] nfs: don't call __mark_inode_dirty while holding i_lock (Steve Dickson) [747391]
  - [netdrv] vxge: allow rebinding the driver with a different number of SR-IOV VFs (Michal Schmidt) [694742]
  - [netdrv] vxge: fix crash of VF when unloading PF (Michal Schmidt) [694742]
  - [ata] revert libata: remove SCSI host lock (David Milburn) [751426]
  - [crypto] ansi_cprng: enforce key != seed in fips mode (Jarod Wilson) [751198]
  - [net] mac80211: Fix reassociation processing within ESS roaming (John Linville) [750350]
  - [net] nl80211: Allow association to change channels during reassociation (John Linville) [750350]
  - [net] mac80211: let cfg80211 manage auth state (John Linville) [750350]
  - [net] cfg80211: avoid sending spurious deauth to userspace (John Linville) [750350]
  - [net] mac80211: recalculate idle later in MLME (John Linville) [750350]
  - [net] mac80211: avoid spurious deauth frames/messages (John Linville) [750350]
  - [net] cfg80211: Allow reassociation in associated state (John Linville) [750350]
  - [net] cfg80211: remove warning in deauth case (John Linville) [750350]
  - [net] netfilter: fix nf_conntrack refcount leak in l4proto->error() (Thomas Graf) [745472]
  - [scsi] qla2xxx: Remove check for null fcport from host reset handler (Chad Dupuis) [744741]
  - [scsi] qla2xxx: Perform implicit logout during rport tear-down (Chad Dupuis) [744741]
  - [scsi] Revert "qla2xxx: Remove host_lock in queuecommand function" (Chad Dupuis) [744741]
  - [drm] nv50/disp: shutdown display on suspend/hibernate (Ben Skeggs) [740857]
  - [edac] Add sb_edac driver into the Red Hat Building system (Mauro Carvalho Chehab) [647700]
  - [edac] Fix incorrect edac mode reporting in sb_edac (Mauro Carvalho Chehab) [647700]
  - [edac] Add an experimental new driver to support Sandy Bridge CPU's (Mauro Carvalho Chehab) [647700]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-220.el6]
changelog:
  - [drm] i915: fix unmap race condition introduced with VT-d fix (Dave Airlie) [750583]
  - [scsi] iscsi: revert lockless queuecommand dispatch (Rob Evers) [751426]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-220.1.1.el6]
changelog:
  - [dm] do not forward ioctls from logical volumes to the underlying device (Paolo Bonzini) [752379 752380] {CVE-2011-4127}
  - [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752379 752380] {CVE-2011-4127}
  - [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752379 752380] {CVE-2011-4127}
  - [x86] amd: Fix align_va_addr kernel parameter (Frank Arnold) [758028 753237]
  - [md] RAID1: Do not call md_raid1_unplug_device while holding spinlock (Jonathan E Brassow) [755545 752528]
  - [pci] intel-iommu: Default to non-coherent for domains unattached to iommus (Don Dutile) [757671 746484]
  - [x86] initialize min_delta_ns in one_hpet_msi_clockevent() (Prarit Bhargava) [756426 728315]
  - [x86] Update hpet_next_event() (Prarit Bhargava) [756426 728315]
  - [kernel] sched: Use resched IPI to kick off the nohz idle balance (Vivek Goyal) [750459 717179]
  - [drm] i915: enable ring freq scaling, RC6 and graphics turbo on Ivy Bridge (Prarit Bhargava) [758513 752163]
  - [drm] i915: load a ring frequency scaling table (Prarit Bhargava) [758513 752163]
  - [x86] cpufreq: expose a cpufreq_quick_get_max routine (Prarit Bhargava) [758513 752163]
  - [sched] Cleanup/optimize clock updates (Larry Woodman) [751403 750237]
  - [sched] fix skip_clock_update optimization (Larry Woodman) [751403 750237]
  - [block] virtio-blk: Use ida to allocate disk index (Michael S. Tsirkin) [756427 692767]
  - [virt] virtio_blk: Replace cryptic number with the macro (Michael S. Tsirkin) [756427 692767]
  - [kernel] ida: simplified functions for id allocation (Michael S. Tsirkin) [756427 692767]
  - [virt] revert virtio-blk: Use ida to allocate disk index (Aristeu Rozanski) [756427 692767]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-220.3.1.el6]
changelog:
  - [kernel] Remove "WARNING: at kernel/sched.c:5915" (Larry Woodman) [768288 766051]
  - [x86] kernel: Fix memory corruption in module load (Prarit Bhargava) [769595 767140]
  - [kernel] Reset clocksource watchdog after sysrq-t (Prarit Bhargava) [755867 742890]
  - [x86] AMD: Make tsc=reliable override boot time stability checks (Prarit Bhargava) [755867 742890]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-220.4.1.el6]
changelog:
  - [fs] Revert "proc: enable writing to /proc/pid/mem" (Johannes Weiner) [782649 782650] {CVE-2012-0056}


author: Karel Klic <kklic@redhat.com> 1:23.1-16
changelog:
  - Removed PreReq from spec file
  - Fixed rhbz#517272 - emacs-23.1 update shows fonts in double the normal size


author: Karel Klic <kklic@redhat.com> 1:23.1-17
changelog:
  - Removed invalid URL for rpm-spec-mode.el. This mode in
    this version is no longer found on the Internet


author: Karel Klic <kklic@redhat.com> 1:23.1-21
changelog:
  - Added jis2004 patch to prefer non-JIS X 0213:2004 compliant fonts
    for Japanese texts (IPA fonts are counted as JIS X 0213:2004
    compliant)
    Resolves: #612385
  - Removed dependency on aspell and hunspell
    Resolves: #613759


author: Joe Orton <jorton@redhat.com> - 5.3.2-6
changelog:
  - add security fixes for CVE-2010-1866, CVE-2010-2094, CVE-2010-1917,
    CVE-2010-2531, MOPS-2010-060 (#624469)


author: Joe Orton <jorton@redhat.com> - 5.3.3-1
changelog:
  - update to 5.3.3 (#645591)
  - add security fixes for CVE-2010-3709, CVE-2010-3710,
    CVE-2010-3870, CVE-2009-5016 (#651953)
  - prevent extract() cloberring $GLOBALS (#655118)
  - ensure correct mysql_config is used in biarch builds


author: Joe Orton <jorton@redhat.com> - 5.3.3-3.1
changelog:
  - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148,
    CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470,
    CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740731)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-18.el6
changelog:
  - virDomainCoreDump: Introduce VIR_DUMP_RESET flag (rhbz#632498)
  - qemu: Implement VIR_DUMP_RESET (rhbz#632498)
  - qemu: Check for domain being active on successful job acquire (rhbz#745734)
  - Set to NULL members that have been freed to prevent crashes (rhbz#746075)
  - virFDStream: Close also given errfd (fd leak) (rhbz#746075)
  - qemu: Silence Coverity false positive (rhbz#739704)
  - command: Avoid fd leak on failure (rhbz#739704)
  - build: Add compiler attributes to virUUIDParse (rhbz#739704)
  - qemu: Check for json allocation failure (rhbz#739704)
  - qemu: Fix text block info parsing (rhbz#739704)
  - storage: Plug memory leak on error (rhbz#739704)
  - conf: Plug memory leak on error (rhbz#739704)
  - qemu: Plug memory leak on migration (rhbz#739704)
  - macvtap: Plug memory leak for 802.1Qbh (rhbz#739704)
  - macvtap: Avoid invalid free (rhbz#739704)
  - Update to require sanlock 1.8 for license compliance (rhbz#739518)
  - events: Propose a separate lock for event queue (rhbz#743817)
  - util: Make getaddrinfo failure nonfatal in virGetHostname (rhbz#738915)
  - qemu: Make sure BeginJob is always followed by EndJob (rhbz#746268)
  - pci: Fix pciDeviceListSteal on multiple devices (rhbz#733587)
  - qemu: Do not reattach PCI device used by other domain when shutdown (rhbz#733587)
  - qemu: Honor the orginal PCI dev properties when reattaching (rhbz#736214)
  - daemon: Always advertise libvirtd service (rhbz#726616)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-20.el6
changelog:
  - qemu: Avoid leaking uninit data from hotplug to dumpxml (rhbz#747516)
  - storage: Plug iscsi memory leak (rhbz#747516)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-21.el6
changelog:
  - docs: Document managed=yes of hostdev passthrough (rhbz#740686)
  - ServerClient: Flush cached data (rhbz#748025)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-23.el6_2.1
changelog:
  - nwfilter: Avoid failure with noexec /tmp (rhbz#754182)
  - nwfilter: Simplify execution of ebiptables scripts (rhbz#754182)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-23.el6_2.2
changelog:
  - qemu: Add capabilities flags related to SG_IO (rhbz#768469)
  - qemu: Add new disk type='lun' for bus='virtio' (rhbz#768469)
  - network: Don't add iptables rules for externally managed networks (rhbz#769674)
  - schema: Rewrite seclabel rng to match code (rhbz#770958)
  - seclabel: Refactor existing domain_conf usage (rhbz#770958)
  - seclabel: Move seclabel stuff earlier (rhbz#770958)
  - seclabel: Extend XML to allow per-disk label overrides (rhbz#770958)
  - seclabel: Allow a seclabel override on a disk src (rhbz#770958)
  - seclabel: Honor device override in selinux (rhbz#770958)
  - esx: Support vSphere 5.x (rhbz#759061)
  - conf: Introduce optional startupPolicy attribute for cdrom and floppy (rhbz#769853)
  - util: Create virFileAccessibleAs function (rhbz#769853)
  - qemu: Move device alias assigning before command line construction (rhbz#769853)
  - qemu: Implement startupPolicy (rhbz#769853)
  - startupPolicy: Emit event on disk source dropping (rhbz#769853)
  - util: Add virFileAccessibleAs to private symbols (rhbz#769853)
  - qemu: Fix race between async and query jobs (rhbz#770955)
  - Require avahi as an rpm dependancy (rhbz#770957)
  - qemu: Rework handling of shutdown event (rhbz#770959)
  - qemu: Don't release network actual device twice (rhbz#770961)
  - Remove a static limit on max domains in python bindings (rhbz#770966)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-23.el6_2.4
changelog:
  - seclabel: Fix regression in libvirtd restart (rhbz#770958)
  - qemu: Add capabilities flags related to SG_IO (rhbz#768469)
  - qemu: Add new disk device='lun' for bus='virtio' & type='block' (rhbz#768469)


author: Marek Kasik <mkasik@redhat.com> 2.3.11-4
changelog:
  - Add freetype-2.3.11-CVE-2010-2498.patch
      (Assure that `end_point' is not larger than `glyph->num_points')
  - Add freetype-2.3.11-CVE-2010-2499.patch
      (Check the buffer size during gathering PFB fragments)
  - Add freetype-2.3.11-CVE-2010-2500.patch
      (Use smaller threshold values for `width' and `height')
  - Add freetype-2.3.11-CVE-2010-2519.patch
      (Check `rlen' the length of fragment declared in the POST fragment header)
  - Add freetype-2.3.11-CVE-2010-2520.patch
      (Fix bounds check)
  - Add freetype-2.3.11-CVE-2010-2527.patch
      (Use precision for `%s' where appropriate to avoid buffer overflows)
  - Add freetype-2.3.11-axis-name-overflow.patch
      (Avoid overflow when dealing with names of axes)
  - Resolves: #613298


author: Marek Kasik <mkasik@redhat.com> 2.3.11-5
changelog:
  - Add freetype-2.3.11-CVE-2010-1797.patch
      (Check stack after execution of operations too.
       Skip the evaluations of the values in decoder, if
       cff_decoder_parse_charstrings() returns any error.)
  - Resolves: #621624


author: Marek Kasik <mkasik@redhat.com> 2.3.11-6.el6_0.1
changelog:
  - Add freetype-2.3.11-CVE-2010-2805.patch
      (Fix comparison.)
  - Add freetype-2.3.11-CVE-2010-2806.patch
      (Protect against negative string_size. Fix comparison.)
  - Add freetype-2.3.11-CVE-2010-2808.patch
      (Check the total length of collected POST segments.)
  - Add freetype-2.3.11-CVE-2010-3311.patch
      (Don't seek behind end of stream.)
  - Resolves: #638838


author: Marek Kasik <mkasik@redhat.com> 2.3.11-6.el6_0.2
changelog:
  - Add freetype-2.3.11-CVE-2010-3855.patch
      (Protect against invalid `runcnt' values.)
  - Resolves: #651761


author: Marek Kasik <mkasik@redhat.com> 2.3.11-6.el6_1.3
changelog:
  - Add freetype-2.3.11-CVE-2011-0226.patch
      (Add better argument check for `callothersubr'.)
      - based on patches by Werner Lemberg,
        Alexei Podtelezhnikov and Matthias Drochner
  - Resolves: #723467


author: Jeff Law <law@redhat.com> - 2.12-1.47.el6_2.4
changelog:
  - Make implementation of ARENAS_TEST and ARENAS_MAX match
    documentation (#769594)
  - Check malloc arena atomically  (#769594)


author: Daniel Veillard <veillard@redhat.com> - 2.7.4-1
changelog:
  - upstream release 2.7.4
  - symbol versioning of libxml2 shared libs
  - very large number of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-4.el6_2.1
changelog:
  - Make sure the parser returns when getting a Stop order CVE-2011-3905
  - Fix an allocation error when copying entities CVE-2011-3919
  - Resolves: rhbz#771913


author: Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-13
changelog:
  - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)
  - CVE-2008-3522 jasper: possible buffer overflow in 
    jas_stream_printf() (#461478)


author: Jiri Vanek <jvanek@redhat.com> - 1.6.0.0-1.31.b17
changelog:
  - excluded bin/javaws files
  		exclude  /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/bin/javaws
  		files devel
  		exclude  /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/bin/javaws

  - garbage removed to separated file
  - Resolves: rhbz#639954


author: Deepak Bhole <dbhole@redhat.com> - 1.6.0.0-1.33.1.b20
changelog:
  - Bump to IcedTea 1.9.3
  - Build with --disable-webstart and remove all javaws and plugin references
  - Moved pre 2009 changelog entries to a separate file to keep spec file small
  - Resolves: rhbz#658208


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-15.el6
changelog:
  - Add virFileLock and virFileUnlock APIs (rhbz#728153)
  - Move pidfile functions into util/virpidfile.{c, h} (rhbz#728153)
  - Introduce functions for checking whether a pidfile is valid (rhbz#728153)
  - Add some APIs which use locking for crashsafe pidfile handling (rhbz#728153)
  - Convert libvirtd to use crash-safe pidfile APIs (rhbz#728153)
  - build: Fix recent build failures (rhbz#728153)
  - daemon: Don't remove pidfiles in init scripts (rhbz#728153)
  - daemon: Modify init script to detect upstart managed libvirtd (rhbz#728153)
  - qemu: Check for outstanding async job too (rhbz#742277)
  - qemu: Make PCI multifunction support more manual (rhbz#727530)
  - network: Fill in bandwidth from portgroup for all forward modes (rhbz#743176)
  - snapshot: Refactor virsh snapshot parent computation (rhbz#742410)
  - snapshot: Better virsh handling of missing current, parent (rhbz#742410)
  - qemu: Fix migration with dname (rhbz#740533)
  - qemu: Correct misspelled 'enospc' option, and only use for werror (rhbz#730909)
  - snapshot: Add REVERT_FORCE to API (rhbz#742615)
  - snapshot: Use qemu-img on disks in use at time of snapshot (rhbz#742615)
  - snapshot: Enforce REVERT_FORCE on qemu (rhbz#742615)
  - init: Raise default system aio limits (rhbz#740899)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-16.el6
changelog:
  - qemu: Enable multifunction for older qemu (rhbz#738388)
  - qemu: Don't fail virDomainGetInfo if we can't update balloon info (rhbz#741217)
  - qemu: Leave rerror policy at default when enospace is requested (rhbz#730909)
  - snapshot: Fix virsh error message typo (rhbz#735457)
  - snapshot: Let virsh edit disk snapshots (rhbz#744071)
  - snapshot: Simplify redefinition of disk snapshot (rhbz#744071)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-17.el6
changelog:
  - Fix deadlock when the RPC program is unknown (rhbz#743843)
  - qemuDomainAttach: Initialize pidfile variable (rhbz#744548)
  - storage: Do not use comma as seperator for lvs output (rhbz#727474)
  - snapshot: Avoid accidental renames with snapshot-edit (rhbz#744724)


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-214.el6]
changelog:
  - [dm] table: add immutable feature (Mike Snitzer) [747438]
  - [mm] reduce overhead on paravirt functions (Larry Woodman) [743554]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-215.el6]
changelog:
  - [virt] index of virtio disk is not decremented when removed (Mark Wu) [692767]
  - [edac] i7core_edac: Initialize memory name with cpu, channel, bank (Mauro Carvalho Chehab) [712957]
  - [kernel] perf: Optimize event scheduling locking (Steve Best) [744986]
  - [drm] i915: set the right SDVO transcoder for CPT (Adam Jackson) [735122]
  - [scsi] libfc: Prevent race that causes panic during FCoE port destroy (Neil Horman) [735959]
  - [scsi] qla4xxx: Update driver version to 5.02.00-k8 (Mike Christie) [732622]
  - [scsi] qla4xxx: updated device id check for BFS (Mike Christie) [732622]
  - [scsi] qla4xxx: Fixed target discovery failed issue (Mike Christie) [732622]
  - [scsi] qla4xxx: Fixed active session re-open issue (Mike Christie) [732622]
  - [scsi] qla4xxx: Fixed device blocked issue on link up-down (Mike Christie) [732622]
  - [scsi] qla4xxx: Fixed session destroy issue on link up-down (Mike Christie) [732622]
  - [scsi] qla4xxx: Clear DDB map index on the basis of AEN (Mike Christie) [732622]
  - [scsi] qla4xxx: Free Device Database (DDB) reserved by FW (Mike Christie) [732622]
  - [scsi] qla4xxx: Fix getting BIDI CHAP for boot targets (Mike Christie) [732622]
  - [scsi] qla4xxx: Fix exporting boot targets to sysfs (Mike Christie) [732622]
  - [scsi] qla4xxx: Do not add duplicate CHAP entry in FLASH (Mike Christie) [732622]
  - [scsi] qla4xxx: Fix bidirectional CHAP (Mike Christie) [732622]
  - [scsi] qla4xxx: Add new FLT firmware region (Mike Christie) [732622]
  - [scsi] qla4xxx: Update license (Mike Christie) [732622]
  - [scsi] iscsi class: fix vlan configuration (Mike Christie) [732622]
  - [scsi] qla4xxx: fix data alignment and use nl helpers (Mike Christie) [732622]
  - [scsi] iscsi class: fix link local mispelling (Mike Christie) [732622]
  - [scsi] qla4xxx: Added Get ACB support using BSG (Mike Christie) [732622]
  - [scsi] qla4xxx: Added restore factory defaults support using BSG (Mike Christie) [732622]
  - [scsi] qla4xxx: added support to update initiator iscsi port (Mike Christie) [732622]
  - [scsi] scsi_transport_iscsi: Added support to update initiator iscsi port (Mike Christie) [732622]
  - [scsi] qla4xxx: Added vendor specific sysfs attributes (Mike Christie) [732622]
  - [scsi] qla4xxx: Add read/update NVRAM support for 40xx adapters using BSG (Mike Christie) [732622]
  - [scsi] qla4xxx: Add get ACB state support using BSG (Mike Christie) [732622]
  - [scsi] qla4xxx: Code cleanup for read/update flash using BSG (Mike Christie) [732622]
  - [scsi] qla4xxx: Added support to update mtu (Mike Christie) [732622]
  - [scsi] scsi_transport_iscsi: Added support to update mtu (Mike Christie) [732622]
  - [scsi] libfc: improve flogi retries to avoid lport stuck (Mike Christie) [745667]
  - [scsi] libfc: avoid exchanges collision during lport reset (Mike Christie) [745667]
  - [scsi] libfc: fix checking FC_TYPE_BLS (Mike Christie) [745667]
  - [scsi] libfc: revert fix deadlock bug in fc_exch_abort_locked (Mike Christie) [745667]
  - [dm] log userspace: Allow for 'log device name' response in CTR msg exchange (Jonathan E Brassow) [746254]
  - [dm] kcopyd: fix job_pool leak (Mike Snitzer) [748441]
  - [netdrv] igb: Fix for Alt MAC Address feature on 82580 and later (Andy Gospodarek) [748503]


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0-3
changelog:
  - when checking for pty-handling functions, do so with the benefit of the
    libutil library we think might include them (#595411)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2
changelog:
  - krshd: don't limit user names to 16 chars when utmp can handle names
    at least a bit longer than that (#632442, RT#6773)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-2.1
changelog:
  - ftpd: add candidate patch to detect setegid/setregid/setresgid and check
    for errors when calling them (MITKRB5-SA-2011-005, CVE-2011-1526, #713342)


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-3
changelog:
  - drop calls to pam_selinux from the gssftp PAM configuration (#713459)
  - reference password-auth instead of system-auth in the gssftp and kshell
    PAM configurations


author: Nalin Dahyabhai <nalin@redhat.com> - 1.0.1-4
changelog:
  - increase the size of the ftp client's command line input buffer (#665834)
  - incorporate patch to correct parsing errors with "restrict" lines in
    ftpusers (#713521, RT#6889)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-31
changelog:
  * fixed BRIDGE-MIB implementation in /usr/bin/snmp-bridge-mib,
    now it supports embedded perl and answers GETNEXT requests correctly
    (#630157).


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-32
changelog:
  - fixed varbind parsing in python netsnmp module (#711481)
  - fixed session initialization in python netsnmp module (#710667)
  - fixed crash when getting out-of-memory in inetNetToMediaTable (#708947)
  - added xfs and jfs filesystem support to hrStorageTable (#707912)
  - fixed snmpd to purge zombies resulted from pass_persist process exit
    (#703682)
  - added a log message when snmpd detects two interfaces with the same
    IP address and thus having only one ipTable entry for both (#702171)
  - added new snmpd.conf options 'interface_fadeout' and
    'interface_replace_old' to controll snmpd behavior when more
    interfaces get the same name (#702165)
  - fixed snmptrapd leaking memory when processing traps in embedded perl
    (#678314)
  - fixed hrSystemDate timezone sign (#683680)
  - fixed snmp logging 'truncating integer value > 32 bits' for
    UCD-SNMP-MIB::systemStats (#681949)
  - fixed rare race condition in hrSWRunTable (#683563)
  - recompiled with relro for better security (#725657)
  - snmpd should not change request-id when sending multiple SMUX messages
    (#708370)


author: Warren Togami <wtogami@redhat.com> - 2.6.6-2
changelog:
  - Upstream backports:
      0e3079d15adeb12c1e57ceaf5bf037f9b71c8abd Fix AIM SSL clientLogin
      b14ee507e932a395a0e1f29298af162c8614ca0f Fix AIM clientLogin with proxy


author: Matthew Barnes <mbarnes@redhat.com> - 2.7.9-1.el6
changelog:
  - Update to 2.7.9 (RH bug #616917).
  - Remove patches now included upstream:
      pidgin-2.6.6-clientLogin-proxy-fix.patch
      pidgin-2.6.6-clientLogin-use-https.patch
      pidgin-2.6.6-CVE-2010-1624.patch
      pidgin-2.6.6-CVE-2010-3711.patch
  - Disable the translation updates patch.  It doesn't apply anymore and
    will have to be redone.  Saving the patch for now in case some parts
    are still useful to translators.


author: Petr Machata <pmachata@redhat.com> - 2011d-3
changelog:
  - Morocco introduced DST for 2011 from April 2 to July 31. (tzdata-2011d-morocco.patch)
  - Resolves: #692031


author: Petr Machata <pmachata@redhat.com> - 2011g-1
changelog:
  - Upstream 2011e:
    - Morocco introduced DST for 2011 from April 2 to July 31.
    - Delay end of DST in Chile in 2011 until May 7.
  - Resolves: #694521
  - Upstream 2011f:
    - The Falkland Islands will not turn back clocks this winter, but
      stay on daylight saving time.
  - Upstream 2011g:
    - Egypt abandons DST in 2011 (and forward)
  - Resolves: #698613
  - Dropped tzdata-2011d-chile.patch
  - Dropped tzdata-2011d-morocco.patch


author: Petr Machata <pmachata@redhat.com> - 2011h-2
changelog:
  - Upstream 2011h:
    - Russia abandons DST in 2011.
    - *.tab: change AN (Netherlands Antilles) to CW (Curacao)
  - Resolves: #716936


author: Petr Machata <pmachata@redhat.com> - 2011h-3
changelog:
  - Patch for upcoming change in Newfoundland.  The transition time
    changes from 12:01 AM to 2:00 AM.
  - Resolves: #729693


author: Petr Machata <pmachata@redhat.com> - 2011k-0.1.20110921
changelog:
  - Upstream 2011i:
    - Add Africa/Juba (South Sudan) zone
    - Samoa skips over the date line on 2011-12-30
    - Use KALT as abbreviation for Europe/Kalinigrad
    - Canonical version of the Newfoundland patch
    - Change America/Resolute use of EST to 2006-2007 only
    - Assume Metlakatla abandoned use of daylight saving in 1983
    - Sync iso3166.tab and zone.tab with above
  - Upstream 2011j:
    - Fix the Samoa date line skip
    - Changes in past timestamp typos several Africa zones
  - Proposed upstream 2011k:
    - Belarus and Ukraine adopt permanent DST in 2011
    - Palestine suspends DST during Ramadan in 2011
    - Gaza and West Bank split in 2011.  West Bank is tracked in the
      timezone Asia/Hebron.  zone.tab update accordingly.
  - Resolves: #740000


author: Petr Machata <pmachata@redhat.com> - 2011l-2
changelog:
  - Upstream 2011l:
    - Fix ancient stamps for America/Sitka
    - Asia/Hebron transitioned to standard time already on Sep 30, not Oct 3
    - Fiji will introduce DST on Oct 22
  - Resolves: #740000


author: Petr Machata <pmachata@redhat.com> - 2011l-3
changelog:
  - State of Bahia, Brazil, to resume Summer Time on Oct 16
  - The project moved, reflect this in URL
  - Resolves: #740000


author: Petr Machata <pmachata@redhat.com> - 2011n-1
changelog:
  - Rebase to 2011n
    - Cuba postponed DST by two weeks to Nov 13
    - Fiji will enter DST on Jan 21
  - Add a patch for the leap second that will occur this summer
  - Resolves: #773755


author: Petr Machata <pmachata@redhat.com> - 2011n-2
changelog:
  - The Chilean Government has decided to postpone the entrance into
    winter time (to leave DST) from March 11 2012 to April 28th 2012
  - Resolves: #796569


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-4
changelog:
  - Address CVE-2010-0541 "Ruby WEBrick javascript injection flaw"
    by applying the patch from Apple as included in
    http://bugzilla.redhat.com/587731.
    * ruby-1.8.7-webrick-CVE.patch: New file.
  - Resolves: rhbz#605418


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-5
changelog:
  - avoid a false-positive readline-related test failure
    * ruby-readline-TERM-dumb.patch: New file.
    * Run "make test-all" in addition to "make test", in spite of its known
    failures (e.g., when using out of date gdbm).  Suggested by Ondrej Moris.
  - skip minor gdbm test to avoid failure
    * ruby-skip-gdbm-test.patch: New file.
  - avoid segfault on powerpc64
    * ruby-ppc64-segv-fix.patch: New file.
  - Resolves: rhbz#628715


author: Jim Meyering <meyering@redhat.com> - 1.8.7.299-6
changelog:
  - Now that ruby uses the two-clause BSDL, it may once again use the
  latest readline, which is covered by the LGPLv3.  2-clause BSDL is
  GPLv3-compatible, per http://www.gnu.org/philosophy/license-list.html
  Before, ruby used the GPLv2, which precluded use of readline6, so it
  had to resort to using the old readline5 library.
  Remove references to the old readline5 library.
  - Resolves: rhbz#631701


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.299-8
changelog:
  - Address CVE-2011-1004 "Symlink race condition by removing directory trees in
    fileutils module"
    * ruby-1.8.7-CVE-2011-1004.patch
  - Address CVE-2011-1005 "Untrusted codes able to modify arbitrary strings"
    * ruby-1.8.7-CVE-2011-1005.patch
  - Address CVE-2011-0188 "memory corruption in BigDecimal on 64bit platforms"
    * ruby-1.8.7-CVE-2011-0188.patch
  - Resolves: rhbz#709964


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-1
changelog:
  - Update to Ruby 1.8.7-p352.
    * Remove Patch43: ruby-1.8.7-CVE-2011-1004.patch; subsumed
    * Remove Patch44: ruby-1.8.7-CVE-2011-1005.patch; subsumed
    * Remove Patch200: ruby-1.8.7-webrick-CVE.patch; subsumed
  - Resolves: rhbz#706332
  - Fix of conflict between 32bit and 64bit library versions.
  - Resolves: rhbz#674787
  - Add systemtap static probes.
  - Resolves: rhbz#673162
  - Remove duplicate path entry
  - Resolves: rhbz#722887


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-3
changelog:
  - mkconfig.rb: fix for continued lines.
    * ruby-1.8.7-p352-mkconfig.rb-fix-for-continued-lines.patch
  - Resolves: rhbz#730287


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-4
changelog:
  - Address CVE-2011-4815 "DoS (excessive CPU use) via hash meet-in-the-middle
    attacks (oCERT-2011-003)"
    * ruby-1.8.7-p352-CVE-2011-4815.patch
  - Resolves: rhbz#768831


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-123
changelog:
  - MLS Overrides needed for a user running at a level to be able to use sudo and talk to sssd
  - Allow initrc_t to manage dirsrv pid files with disabled unconfined module
  - Fixed for deltacloudd policy


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-125
changelog:
  - Change the postinstall to load_policy separately from the semodule command
  - This will put the proper files in place even if the kernel rejects the policy.
  - Allow login programs to connect to the pki_ca_port
  - Allow vhostmd to read /dev/rand and signal


author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.15-4
changelog:
  - Related: rhbz#543948
  - TPROXY needs libcap. Also increases security a little.
  - merged relevant upstream bugfixes waiting for next 3.1 release


author: Jiri Skala <jskala@redhat.com> - 7:3.1.0.16-1
changelog:
  - Resolves: #564296 - Rebase to new upstream tarball (fixes licensing issues)
  - Resolves: #561743 - CVE-2010-0308 squid: temporary DoS (assertion failure) triggered by truncated DNS packet (SQUID-2010:1)
  - fixes rpmlint issues in spec file
  - fixed rpmlint issue initscript file


author: Jiri Skala <jskala@redhat.com> -7:3.1.4-1
changelog:
  - Resolves: #564296 - Rebase squid to stable upstream tarball 3.1.4
  - bugfix release, issues relating to IPv6, TPROXY, Memory
    management, follow_x_forwarded_for, and stability fixes


author: Jiri Skala <jskala@redhat.com> -7:3.1.10-1
changelog:
  - Resolves: #639365 - Rebase squid to version 3.1.10
  - Resolves: #666533 - small memleak in squid-3.1.4


author: David Knox <dknox@redhat.com> 0:6.0.24-25
changelog:
  - Installed permissions do not allow tomcat to start
  - incrementing NVR so yum won't get confused with the zstream


author: David Knox <dknox@redhat.com> 0:6.0.24-28
changelog:
  - Resovles  rhbz#695284 - wrapper logs to different locations
  - CVE-2010-4172, CVE-2011-0013, CVE-2010-3718 commented out 
  - until needed.


author: David Knox <dknox@redhat.com> 0:6.0.24-29
changelog:
  - Resolves: rhbz#656403, rhbz#675926, rhbz#676011
  - CVE-2010-4172, CVE-2010-3718, CVE-2011-0013, CVE-2010-4476,
  - CVE-2011-0534


author: David Knox <dknox@redhat.com> 0:6.0.24-35
changelog:
  - Resolves: cve-2011-3190
  - Resolves: cve-2011-2204
  - Resolves: cve-2011-2526
  - Resolves: cve-2011-1184
  - Resolves: rhbz 748807 - tomcat6 broken when LANG="fr"


author: Jiri Skala <jskala@rehat.com> - 2.2.2-1
changelog:
  - Resolves: #555321 - vsftpd segfaults with passive mode and SSL
  - updated to latest upstream version - fixes the bug #555321


author: Jiri Skala <jskala@rehat.com> - 2.2.2-3
changelog:
  - Resolves: #540818 - Local user access denied by default vsftpd.conf
  - Resolves: #580521 - vsftpd issues in RHEL5.4 (cloned)


author: Peter Hutterer <peter.hutterer@redhat.com> 1.10.3-2
changelog:
  - xserver-1.10.3-Initialize-the-fd-to-1-for-xorg.conf-input-devices.patch:
    avoid erroneously closing the log on some drivers (e.g. wacom)


author: Peter Hutterer <peter.hutterer@redhat.com> 1.10.3-3
changelog:
  - Fix xserver-1.10-2-xfree86-duplicate-xorg.conf-device-information-befor.patch,
    fd must be reset to -1, otherwise drivers may close the log file early.


author: Adam Jackson <ajax@redhat.com> 1.10.4-4
changelog:
  - xserver-1.10.4-lid-hack.patch: Revive. (#740581)
  - Conflict against older gnome-screensaver to avoid a deadlock condition
    more easily triggered with the above patch.


author: Dave Airlie <airlied@redhat.com> 1.10.4-6
changelog:
  - fix etracer crashes server with no modes (#746926)
  - don't allow rightof with single crtc (#738724)


author: Tim Waugh <twaugh@redhat.com> - 8.70-7
changelog:
  - Fixed jbig2dec-nullderef patch (bug #621118).
  - Applied upstream patch to fix iname.c segfault (bug #629562).


author: Tim Waugh <twaugh@redhat.com> - 8.70-11:.3
changelog:
  - Applied patch to prevent integer underflow in TrueType bytecode
    interpreter (CVE-2009-3743, bug #627902).
  - Applied patch to avoid reading initialization files from CWD
    (CVE-2010-2055, bug #599564).


author: Tom Lane <tgl@redhat.com> 5.1.42-7
changelog:
  - Add backported patch for CVE-2008-7247 (upstream bug 39277)
  Resolves: #549329
  - Use non-expired certificates for SSL testing (upstream bug 50702)


author: Tom Lane <tgl@redhat.com> 5.1.43-2
changelog:
  - Update to MySQL 5.1.43, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-43.html
  Resolves: #565554
  - Remove mysql-cluster, which is no longer supported by upstream in this
    source distribution.  If we want it we'll need a separate SRPM for it.
  Resolves: #565210


author: Tom Lane <tgl@redhat.com> 5.1.44-2
changelog:
  - Update to MySQL 5.1.44, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-44.html
  Resolves: #565554
  - Remove mysql.info, which is not freely redistributable
  Related: #560181
  - Revert broken upstream fix for their bug 45058
  Related: #566547
  - Bring init script into some modicum of compliance with Fedora/LSB standards
  Resolves: #557711
  Resolves: #562749


author: Tom Lane <tgl@redhat.com> 5.1.47-1
changelog:
  - Update to MySQL 5.1.47, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-47.html
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-46.html
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-45.html
    including fixes for CVE-2010-1621, CVE-2010-1626,
    CVE-2010-1848, CVE-2010-1849, CVE-2010-1850
  Resolves: #590598
  - Create mysql group explicitly in pre-server script, to ensure correct GID


author: Tom Lane <tgl@redhat.com> 5.1.47-2
changelog:
  - Add back "partition" storage engine
  Resolves: #598585
  - Fix broken "federated" storage engine plugin
  Resolves: #587170
  - Read all certificates in SSL certificate files, to support chained certs
  Resolves: #598656


author: Tom Lane <tgl@redhat.com> 5.1.47-3
changelog:
  - Add -p "$mypidfile" to initscript's status call to improve corner cases.
    (Note: can't be fixed in Fedora until 595597 is fixed there.)
  Resolves: #596008


author: Tom Lane <tgl@redhat.com> 5.1.47-4
changelog:
  - Add backported patch for CVE-2010-2008 (upstream bug 53804)
  Resolves: #614215
  - Add BuildRequires perl(Time::HiRes) ... seems to no longer be installed
    by just pulling in perl.


author: Tom Lane <tgl@redhat.com> 5.1.52-1
changelog:
  - Update to MySQL 5.1.52, for various fixes described at
    http://dev.mysql.com/doc/refman/5.1/en/news-5-1-52.html
    including numerous small security issues
  Resolves: #652554
  - Sync with current Fedora package; this includes:
  - Duplicate COPYING and EXCEPTIONS-CLIENT in -libs and -embedded subpackages,
    to ensure they are available when any subset of mysql RPMs are installed,
    per revised packaging guidelines
  - Allow init script's STARTTIMEOUT/STOPTIMEOUT to be overridden from sysconfig


author: Tom Lane <tgl@redhat.com> 5.1.61-1.el6_2.1
changelog:
  - Update to 5.1.61, for assorted upstream bugfixes including
    numerous CVEs announced in January 2012
  Resolves: #787191


author: Joe Orton <jorton@redhat.com> - 2.2.15-11
changelog:
  - rebase mod_reqtimeout to 2.2.17 (#676634)
  - mod_proxy_ajp: honour ProxyErrorOverride (#694939)
  - mod_ssl: add fix for handling incomplete lines w/revproxy (#700074)
  - mod_filter: fix matching against non-std response headers (#700075)
  - core: abort() on malloc() failure (#700393)
  - mod_ssl: fix startup crash w/client cert shared across vhosts (#720980)


author: Joe Orton <jorton@redhat.com> - 2.2.15-12
changelog:
  - mod_ssl: ignore SNI hints unless required by config (#714704)
  - mod_ssl: fix segfault with bad SSLCryptoDevice argument (#729585)


author: Joe Orton <jorton@redhat.com> - 2.2.15-15
changelog:
  - mod_proxy_ftp: fix handling of EPSV w/IPv6 localhost (#737960)
  - core: add security fix for CVE-2011-3368 (#743659)
  - mod_proxy_ajp: add security fix for CVE-2011-3348 (#738961)
  - mod_cache: forward-port CacheMaxExpire "hard" option (#740242)


author: Joe Orton <jorton@redhat.com> - 2.2.15-15.1
changelog:
  - add security fixes for CVE-2011-4317, CVE-2012-0053, CVE-2012-0031,
    CVE-2011-3607 (#787598)
  - obviates fix for CVE-2011-3638, patch removed


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.43.1.10.6
changelog:
  - Updated to IcedTea6 1.10.6
  - Resolves: rhbz#787144
  - Security fixes
    - S7082299: Fix in AtomicReferenceArray
    - S7088367: Fix issues in java sound
    - S7110683: Issues with some KeyboardFocusManager method
    - S7110687: Issues with TimeZone class
    - S7110700: Enhance exception throwing mechanism in ObjectStreamClass
    - S7110704: Issues with some method in corba
    - S7112642: Incorrect checking for graphics rendering object
    - S7118283: Better input parameter checking in zip file processing
    - S7126960: Add property to limit number of request headers to the HTTP Server
  - Bug fixes
    - RH580478: Desktop files should not use hardcoded path
  - Removed upstreamed patch7 - java-1.6.0-openjdk-6_2-Z-rmi-fix.patch


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.12
changelog:
  - Back port option handling in semanage to handle semodule module -D correctly
  - Back port manpage from Fedora
  Resolves: #666861


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.13
changelog:
  - Fix spec file to require rsync for sandbox
  Resolves: #734467
  - Fix spec file to require gtkhtml2 for lockdown booleans program
  Resolves: #702860
  - Fix bugs found by Coverity
  Resolves: #717640
  Resolves: #728833


author: Miroslav Grepl <mgrepl@redhat.com> 2.0.83-19.15
changelog:
  - Needs require gnome-python2-gtkhtml2 to make system-config-selinux working
  - Not use open_init_pty by default


author: Dan Walsh <dwalsh@redhat.com> 2.0.83-19.16
changelog:
  - Restorecon should not be exiting with a 1 when it is successful in relabeling a file
  Resolves: #740699
  Resolves: #739587


author: Miroslav Grepl <mgrepl@redhat.com> 2.0.83-19.18
changelog:
  - Other fix for semanage man page
  Resolves: #677541
  - Don't report error on load_policy when system is disabled.


author: Dan Walsh <dwalsh@redhat.com> - 2.0.83-19.19
changelog:
  - Change semanage to produce proper audit records for Common Criteria
  - Fix the handling of namespaces in seunshare/sandbox.
  - Currently mounting of directories within sandbox is propogating to the 
  - parent namesspace.
  - restorecond -u needs to watch terminal for exit if run outside of dbus.
  - Fix unchecked return codes
  Related: #785678


author: Jindrich Novy <jnovy@redhat.com> 2007-48
changelog:
  - add missing defattr to filelists
  - do not own /var/lib/texmf/web2c/, it is owned by texlive-texmf
  - use official tarball for dvipsk-jpatch


author: Jindrich Novy <jnovy@redhat.com> 2007-57
changelog:
  - fix CVE-2010-2642 CVE-2011-0433 CVE-2011-0764 CVE-2011-1552
    CVE-2011-1553 CVE-2011-1554, texlive various flaws (#773183)


author: Adam Jackson <ajax@redhat.com> 1.2.2-2
changelog:
  - libvorbis-1.2.2-svn16228.patch: Backport a fix from pre-1.2.3 to hopefully
    fix small sound file playback. (#505610)


author: Tom Lane <tgl@redhat.com> 2.0.13-2
changelog:
  - Fix rpmlint complaints: remove unneeded explicit Requires:, use Conflicts:
    instead of bogus Obsoletes: to indicate lack of zope subpackage


author: Tom Lane <tgl@redhat.com> 2.0.14-1.el6_2.1
changelog:
  - Update to 2.0.14 to get the last few upstream fixes in this release series,
    and to not be behind what MRG has shipped for RHEL-5
  - Fix refcount leaks in _mogrify()
  Resolves: #787164


author: Ian Kent <ikent@redhat.com> - 5.0.5-31
changelog:
  - bz700691 - autofs sometimes stops expiring mounts
    - fix next task list update race.
    - fix stale map read.
  - bz700697 - autofs with null maps specified in auto.master segfaults on reload
    - fix null cache clean.
  - Resolves: rhbz#700691 rhbz#700697


author: Ian Kent <ikent@redhat.com> - 5.0.5-32
changelog:
  - bz704940 - autofs-5.0.1-0.rc2.131.el5_4.1 is missing man 8 auto.master
    - automount(8) man page correction.
  - bz704929 - automount hangs with nested mounts using YP lookups
    - don't hold lock for simple mounts.
  - bz703332 - autofs fails to find duplicate key after key removal
    - fix prune cache valid check.
    - fix map source check in file lookup.
  - bz704933 - [RHEL 5.4] automounter dies with pthreads error
    - wait for master source mutex.
  - bz704927 - autofs should support paged results from ldap server
    - auto adjust ldap page size.
    - fix paged ldap map read.
  - bz704932 - [RFE] Support for encrypted secret in /etc/autofs_ldap_auth.conf
    - add base64 password encode.
  - bz704416 - RFE: automounter to dump maps
    - add dump maps option.
  - bz704935 - [RFE] resolve negative cache invalidation on signal to automount
    - reset negative status on cache prune.
  - bz704937 - Segmentation fault when looking up '*.'
    - fix wildcard map entry match.
  - bz704228 - AD/LDAP connection using GSSAPI auth fails with Error: An invalid
    name was supplied (Hostname cannot be canonicalized)
    - fix sasl bind host name selection.
  - bz692816 - automount does not perform a sanity check of server name in
    configuration
    - fix sanity checks for brackets in server name.
  - bz704939 - automount segfaults in lookup_mount
    - mapent becomes negative during lookup.
  - Resolves: rhbz#704940 rhbz#704929 rhbz#703332 rhbz#704933 rhbz#704927
  - Resolves: rhbz#704932 rhbz#704416 rhbz#704935 rhbz#704937 rhbz#704228
  - Resolves: rhbz#692816 rhbz#704939


author: Ian Kent <ikent@redhat.com> - 5.0.5-33
changelog:
  - bz704228 - AD/LDAP connection using GSSAPI auth fails with Error: An invalid
    name was supplied (Hostname cannot be canonicalized)
    - check each dc server.
  - Related: rhbz#704228


author: Ian Kent <ikent@redhat.com> - 5.0.5-34
changelog:
  - bz718927 - Lock ordering problem on re-load of direct maps
    - fix null cache deadlock.
  - Resolves: rhbz#718927


author: Ian Kent <ikent@redhat.com> - 5.0.5-35
changelog:
  - bz725931 - Fix GPL v3 dependency in autofs.
    - replace GPLv3 with GPLv2 code for SRV record handling.
  - Resolves: rhbz#725931


author: Ian Kent <ikent@redhat.com> - 5.0.5-36
changelog:
  - bz704928 - autofs should support paged results from ldap server on
    ppc64 and s390x
    - fix paged query more results check.
  - Resolves: rhbz#704928


author: Ian Kent <ikent@redhat.com> - 5.0.5-37
changelog:
  - bz704416 - RFE: automounter to dump maps
    - fix dumpmaps not reading maps.
  - Related: rhbz#704416


author: Ian Kent <ikent@redhat.com> - 5.0.5-38
changelog:
  - bz700136 - autofs/automount 5.0.5 error in mounting expanded entry
    - improve mount location error reporting 
  - Resolves: rhbz#700136


author: Ian Kent <ikent@redhat.com> - 5.0.5-39
changelog:
  - bz732667 - Defects added by downstream patches
    - code analysis defect fixes, installment 1.
  - Resolves: rhbz#732667


author: Ian Kent <ikent@redhat.com> - 5.0.5-39.el6_2.1
changelog:
  - bz787122 - autofs-5.0.5-39.el6.x86_64 fails to load some LDAP maps
    - fix improve mount location error reporting.
  - Resolves: rhbz#787122


author: Tomas Mraz <tmraz@redhat.com> 0.75-1
changelog:
  - fix disabling SELinux and audit in spec (#433284)
  - remove obsolete no.po (#332121)
  - updated translations


author: Tomas Mraz <tmraz@redhat.com> 0.77-4.2
changelog:
  - add -e option to expire the password for user
  - compile the binary with PIE and full RELRO options


author: Jiri Moskovcak <jmoskovc@redhat.com> - 1.11.23.5
changelog:
  - added support for passing arguments thru stdin (patch from arozansk@redhat.com)
  - Resolves: #501942


author: Harald Hoyer <harald@redhat.com> 004-234
changelog:
  - add broadcom iscsi offload support
  Resolves: rhbz#701864
  - fixed dm dracut module, to no require dmraid
  Resolves: rhbz#732686
  - fixed md raid assembly
  Resolves: rhbz#732967


author: Harald Hoyer <harald@redhat.com> 004-239
changelog:
  - fixed raid assembly with encrypted members
  Resolves: rhbz#737593
  - support bnx2fc for FCoE
  Resolves: rhbz#736094
  - fixed iscsi module loading
  Resolves: rhbz#737479


author: Harald Hoyer <harald@redhat.com> 004-244
changelog:
  - add dracut-fips-aesni subpackage
  Resolves: rhbz#740487 
  - add /var/log in initramfs
  Resolves: rhbz#701864


author: Harald Hoyer <harald@redhat.com> 004-247
changelog:
  - add "-F" to selinux restorecon 
  Resolves: rhbz#741430
  - kill iscsiuio before switching root
  Resolves: rhbz#701864


author: Harald Hoyer <harald@redhat.com> 004-248
changelog:
  - 95fcoe/fcoe-up: load 8021q module before fipvlan
  Resolves: rhbz#736094
  - modprobe iscsi_boot_sysfs
  Resolves: rhbz#737134


author: Harald Hoyer <harald@redhat.com> 004-254
changelog:
  - fixed killproc()
  Resolves: rhbz#701864
  - hardcode modprobe of various iscsi offload drivers
  Resolves: rhbz#737134


author: Harald Hoyer <harald@redhat.com> 004-256
changelog:
  - increase timeout to wait for dhcp connections
  Resolves: rhbz#742920
  - check /tmp/net.$netif.override before sourcing it
  Resolves: rhbz#696980


author: Harald Hoyer <harald@redhat.com> 004-256.1
changelog:
  - fixed loading of dracut-fips-aesni module
  Resolves: rhbz#790943
  - fixed assembling of mdraid degraded arrays
  Resolves: rhbz#791128


author: Elio Maldonado <emaldona@redhat.com> - 3.13.1-1
changelog:
  - Resolves: Bug 744070 - Update to 3.13.1
  - nss should protect against being called before nss_Init [784674]
  - CVE-2011-3389 HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST) [784490]


author: Matthias Clasen <mclasen@redhat.com> - 2.16.0-4
changelog:
  - Don't call xmlCleanupParser, it breaks other users of thread-private
    storage
    Resolves: #578568


author: Johnny Hughes <johnny@centos.org> - 2.26.0-5.el6_1.1.0.1.centos
changelog:
  - rebuilt due to a bad i386-redhat-linux-gnu variable on the previous build.  This package
    has not been modified in any way and will lose the .centos tag the next
    time upstream releases a new version.


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-1
changelog:
  - new version 1.4.6 with support for all new features of 2.6.32
    - several man page fixes
    - Support for nommu arches
    - realm: remove static initializations
    - libiptc: remove unused functions
    - libiptc: avoid strict-aliasing warnings
    - iprange: do accept non-ranges for xt_iprange v1
    - iprange: warn on reverse range
    - iprange: roll address parsing into a loop
    - iprange: do accept non-ranges for xt_iprange v1 (log)
    - iprange: warn on reverse range (log)
    - libiptc: fix wrong maptype of base chain counters on restore
    - iptables: fix undersized deletion mask creation
    - style: reduce indent in xtables_check_inverse
    - libxtables: hand argv to xtables_check_inverse
    - iptables/extensions: make bundled options work again
    - CONNMARK: print mark rules with mask 0xffffffff as set instead of xset
    - iptables: take masks into consideration for replace command
    - doc: explain experienced --hitcount limit
    - doc: name resolution clarification
    - iptables: expose option to zero packet/byte counters for a specific rule
    - build: restore --disable-ipv6 functionality on system w/o v6 headers
    - MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmark
    - DNAT: fix incorrect check during parsing
    - extensions: add osf extension
    - conntrack: fix --expires parsing


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-2
changelog:
  - moved libip*tc and libxtables libs to /lib[64], added symlinks for .so libs
    to /usr/lib[64] for compatibility (rhbz#558796)


author: Thomas Woerner <twoerner@redhat.com> 1.4.6-3
changelog:
  - fixes according to review:
  - fixed license
  - moved /bin/iptables-xml to iptables main package fixes dangling symlink in
    ipv6 sub-package
  - added missing lsb keywords Required-Start and Required-Stop to init script


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-1
changelog:
  - rebase to version 1.4.7:
    - libip4tc: Add static qualifier to dump_entry()
    - libipq: build as shared library
    - recent: reorder cases in code (cosmetic cleanup)
    - several man page and documentation fixes
    - policy: fix error message showing wrong option
    - includes: header updates
    - Lift restrictions on interface names
  - fixed license and moved iptables-xml into base package according to review
  - added default values for IPTABLES_STATUS_VERBOSE and
    IPTABLES_STATUS_LINENUMBERS in init script


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-2
changelog:
  - fixed initscript to be LSB compliant (rhbz#593228)
    - added euid 0 check
    - reload returns 3 (unimplemented feature)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-4
changelog:
  - added IPv6 transparent proxy support (rhbz#590186)
  - added auditing support (rhbz#642393)
    Thanks to Thomas Graf for the patch
  - init: restore context for save and use /etc/sysconfig for temps (rhbz#644273)


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-5
changelog:
  - fixed option parser problem (mark matches with mark options) (rhbz#725879)
    based on upstream commits:
      600f38db82548a683775fd89b6e136673e924097
      59e8114c6792242e80785f4461d5e663fb9a3d64
      d3b2e391e3b944581e20e216af76339cc87d0590
      2d68ae7ce6e40e3977ee11a57296cf76801ae320
      1dc27393b7ba401e6228a5ee2472a6eb72836c43
      1e128bd804b676ee91beca48312de9b251845d09
      fa503ad59f73d20d85f4cdf53324a01d2ad8591e


author: Thomas Woerner <twoerner@redhat.com> 1.4.7-5.1
changelog:
  - reverted upstream patches, because they are breaking the ABI (rhbz#725879)
  - created new patch based on upstream but without ABI break (rhbz#725879)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-23.el6_2.5
changelog:
  - virCommand: Properly handle POLLHUP (rhbz#783453)
  - virCommandProcessIO(): Make poll() usage more robust (rhbz#783453)
  - qemu: Fix seamless spice migration (rhbz#787620)
  - build: Don't require avahi during install (rhbz#790779)
  - qemu: Unlock monitor when connecting to dest qemu fails (rhbz#787620)
  - qemu: Introduce inactive PCI device list (rhbz#784785)


author: Daniel Veillard <veillard@redhat.com> - libvirt-0.9.4-23.el6_2.6
changelog:
  - fix a regression introduced in previous build when detaching devices
  - qemu: Honor the original properties of PCI device when detaching (rhbz#784785)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.3-0.1.pre1
changelog:
  - update to 2.2.3pre1, which you can still get from upstream
  - build with -fno-strict-aliasing to avoid problems triggered by strict aliasing
  - package the translations


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.3-0.3.pre1
changelog:
  - import Kees Cook's patch to fix accidental leakage of part of ./DB_CONFIG
    (#580192, CVE-2010-0826)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.3-0.4.pre1
changelog:
  - import patch to handle initgroups directly rather than forcing libc to
    use the enumeration interfaces, which could result in two threads calling
    initgroups() at the same time to both get a subset of the right answers
    (#705466)


author: Nalin Dahyabhai <nalin@redhat.com> - 2.2.3-0.4.pre1.1
changelog:
  - when the initgroups function needs to parse a group entry which contains a
    large list of users, reinitialize the buffer that we pass to the parsing
    function, which destroyed what we passed to it the previous time (#788668)


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-220.5.1.el6]
changelog:
  - [net] igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Jiri Pirko) [772870 772871] {CVE-2012-0207}
  - [fs] xfs: validate acl count (Eric Sandeen) [773282 773283] {CVE-2012-0038}
  - [fs] Fix sendfile write-side file position (Steven Whitehouse) [771870 770023]
  - [virt] kvm: x86: fix missing checks in syscall emulation (Marcelo Tosatti) [773390 773391] {CVE-2012-0045}
  - [virt] kvm: x86: extend "struct x86_emulate_ops" with "get_cpuid" (Marcelo Tosatti) [773390 773391] {CVE-2012-0045}
  - [fs] nfs: when attempting to open a directory, fall back on normal lookup (Jeff Layton) [771981 755380]
  - [kernel] crypto: ghash - Avoid null pointer dereference if no key is set (Jiri Benc) [749481 749482] {CVE-2011-4081}
  - [fs] jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan) [753344 693981] {CVE-2011-4132}
  - [net] fix unsafe pointer access in sendmmsg (Jiri Benc) [761668 760798] {CVE-2011-4594}
  - [scsi] increase qla2xxx firmware ready time-out (Mark Goodwin) [781971 731917]
  - [perf] powerpc: Handle events that raise an exception without overflowing (Steve Best) [767917 755737] {CVE-2011-4611}
  - [sched] x86: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [781974 765720]
  - [virt] x86: Prevent starting PIT timers in the absence of irqchip support (Marcelo Tosatti) [769634 769550] {CVE-2011-4622}
  - [virt] vmxnet3: revert hw features change (Neil Horman) [761536 759613]
  - [netdrv] qlge: fix size of external list for TX address descriptors (Steve Best) [783226 772237]
  - [netdrv] e1000e: Avoid wrong check on TX hang (Dean Nelson) [768916 751087]
  - [virt] KVM: Device assignment permission checks (Alex Williamson) [756092 756093] {CVE-2011-4347}
  - [virt] KVM: Remove ability to assign a device without iommu support (Alex Williamson) [756092 756093] {CVE-2011-4347}
  - [virt] kvm: device-assignment: revert Disable the option to skip iommu setup (Alex Williamson) [756092 756093] {CVE-2011-4347}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-220.6.1.el6]
changelog:
  - [scsi] qla2xxx: Module parameter to control use of async or sync port login (Chad Dupuis) [788003 769007]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-220.7.1.el6]
changelog:
  - [netdrv] tg3: Fix single-vector MSI-X code (John Feeney) [787162 703555]
  - [mm] export remove_from_page_cache() to modules (Jerome Marchand) [772687 751419]
  - [block] cfq-iosched: fix cfq_cic_link() race confition (Vivek Goyal) [786022 765673]
  - [fs] cifs: lower default wsize when unix extensions are not used (Jeff Layton) [789058 773705]
  - [net] svcrpc: fix double-free on shutdown of nfsd after changing pool mode (J. Bruce Fields) [787580 753030]
  - [net] svcrpc: avoid memory-corruption on pool shutdown (J. Bruce Fields) [787580 753030]
  - [net] svcrpc: destroy server sockets all at once (J. Bruce Fields) [787580 753030]
  - [net] svcrpc: simplify svc_close_all (J. Bruce Fields) [787580 753030]
  - [net] svcrpc: fix list-corrupting race on nfsd shutdown (J. Bruce Fields) [787580 753030]
  - [fs] xfs: Fix missing xfs_iunlock() on error recovery path in xfs_readlink() (Carlos Maiolino) [749161 694702] {CVE-2011-4077}
  - [fs] xfs: Fix memory corruption in xfs_readlink (Carlos Maiolino) [749161 694702] {CVE-2011-4077}
  - [x86] hpet: Disable per-cpu hpet timer if ARAT is supported (Prarit Bhargava) [772884 750201]
  - [x86] Improve TSC calibration using a delayed workqueue (Prarit Bhargava) [772884 750201]
  - [kernel] clocksource: Add clocksource_register_hz/khz interface (Prarit Bhargava) [772884 750201]
  - [kernel] clocksource: Provide a generic mult/shift factor calculation (Prarit Bhargava) [772884 750201]
  - [block] cfq-iosched: fix a kbuild regression (Vivek Goyal) [769208 705698]
  - [block] cfq-iosched: rethink seeky detection for SSDs (Vivek Goyal) [769208 705698]
  - [block] cfq-iosched: rework seeky detection (Vivek Goyal) [769208 705698]
  - [block] cfq-iosched: don't regard requests with long distance as close (Vivek Goyal) [769208 705698]


author: Petr Lautrbach <plautrba@redhat.com> 9.03.22-1
changelog:
  - init.d/functions: fix mishandled argument to fstab-decode (#682879)
  - network-functions: fix check for unmanaged devices (#670154)


author: Petr Lautrbach <plautrba@redhat.com> 9.03.24-1
changelog:
  - add support for sysctl.d (#680527)
  - log network messages via syslog (#653630, #672202)
  - document NM_CONTROLLED (#692123)
  - don't explictly disallow IPv6 aliases (#692240)
  - make sure the bond exists when we bring up the slaves. (#694501)
  - properly add and remove arp_ip_target's (#675079)
  - load static arp entries from ethers file (#696788)
  - fix logic error in rc.sysinit (#698520, <jlau@redhat.com>)
  - handle IPADDRx correctly for static addresses (#700184)
  - don't match filesystem types in hostnames (#703210, <jmueller@data-tronics.com>)
  - check for VLAN interfaces is being slave first (#703475)
  - override NETMASK from PREFIX where specified (#705367, <mpoole@redhat.com>)
  - allow multiple ETHTOOL_OPTS option types (#692410, #693583)
  - don't mount gfs2 in netfs (#689593)
  - fix pid file usage for IPv6. (#729292, <daveg@dgit.ndo.co.uk>)


author: Petr Lautrbach <plautrba@redhat.com> 9.03.26-1
changelog:
  - add 'emergency' mode (#681357)
  - kexec - free reservation memory only for crashkernel=auto (#734987)


author: Ade Lee <alee@redhat.com> 9.0.3-12
changelog:
  - Resolves #689909 - Dogtag installation under IPA takes too much
    time - remove the inefficient sleeps, r2097


author: Ade Lee <alee@redhat.com> 9.0.3-13
changelog:
  - Resolves #698796: Race conditions during IPA installation, r2103 (alee)
  - Resolves #708075 - Clone installation does not work over NAT, r2104 (alee)
  - Resolves #726785 - If replication fails while setting up a clone it 
    will wait forever, r2106 (alee)
  - Resolves #691076 - pkiremove removes the registry entry for all instances
    on a machine, r2112 (mharmsen)
  - Resolves #693835 - /var/log/tomcat6/catalina.out owned by pkiuser, r2118
    (mharmsen)
  - Resolves #729126 - Increase default validity from 6mo to 2yrs in IPA
    profile, r2125 (awnuk)
  - Resolves #728651 - CS8 64 bit pkicreate script uses wrong library name
    for, r2126 (mharmsen)
  - Resolves #700522 - pki tomcat6 instances currently running unconfined,
    r2128 (alee)


author: Ade Lee <alee@redhat.com> 9.0.3-14
changelog:
  - Resolves #700522 - pki tomcat6 instances currently running unconfined, 
    allow server to come up when selinux disabled, r2149


author: Ade Lee <alee@redhat.com> 9.0.3-21
changelog:
  - Resolves #771790 - sslget does not work after FEDORA-2011-17400 update,
    breaking FreeIPA install (fixed in Git repo)


author: Peter Hutterer <peter.hutterer@redhat.com> 1.10.4-6.2
changelog:
  - Add patches to change the screen crossing behaviour for multiple
    ScreenRecs (#783505)
  - remove the xorg.conf.man page from our .gitignore - we need to patch it
    now and it's part of the upstream distribution


author: Peter Hutterer <peter.hutterer@redhat.com> 1.10.4-6.3
changelog:
  - xserver-1.10.4-dix-when-rescaling-from-master-rescale-from-desktop-.patch:
    fix rescaling from master to slave if the pointer (#783505)


author: Martin Sivak <msivak@redhat.com> - 3.9-18
changelog:
  - Fix a segfault when overrides line was incomplete
    Resolves: rhbz#673100
  - Added backports directory to depmod search path
    Resolves: rhbz#761511


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.1.2-6
changelog:
  - Resolves: #556398
  - Directly included relevant patches, scripts and man pages from Debian
  - Removed rpath
  - rpmlint is silent now


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.1.2-6.1
changelog:
  - Fixed CVE-2010-2642, CVE-2011-0433, CVE-2011-0764, CVE-2011-1552, CVE-2011-1553, CVE-2011-1554
    Resolves: rhbz#772900


author: Tom Lane <tgl@redhat.com> 2:1.2.46-1
changelog:
  - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,
    CVE-2011-2691, CVE-2011-2692
  Resolves: #721305


author: Rex Dieter <rdieter@fedoraproject.org> - 4.0-2
changelog:
  - %files: track files closer, esp lib sonames
  - %build: drop --disable-doxygen, add --disable-static, add %{?_smp_mflags}


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.32-1
changelog:
  Resolves: 642722
  Resolves: 642724
  Resolves: 646718
  Resolves: 628879
  Resolves: 621790
  Resolves: 668785
  Resolves: 658253
  Resolves: 658121


author: Avesh Agarwal <avagarwa@redhat.com> - 2.6.32-7
changelog:
  Resolves: #737973
  Resolves: #737975
  Resolves: #737976
  Resolves: #738385
  Resolves: #742632
  Resolves: #742070


author: Jeff Garzik <jgarzik@redhat.com> - 2-6
changelog:
  - Resolves: bz#576678
  - increase version number of rng-utils that we obsolete
  - use global rather than define, for sbindir (Fedora pkg review)
  - improve BuildRoot (Fedora pkg review)


author: David Howells <dhowells@rehdat.com> - 2-7
changelog:
  - Resolves: bz#597221
  - Fix some compiler warnings thus dealing with the SEGV
  - Make do_loop() correctly interpret the result of iter->xread()


author: Jay Fenlason <fenlason@redhat.com> - 2-9
changelog:
  - Add patch from James M. Leddy <james.leddy@redhat.com> to add
    an option to ignore FIPS failures.
    Resolves: bz#733452


author: Jeff Garzik <jgarzik@redhat.com> - 2-13
changelog:
  - Resolves: bz#754752
  - Add post/preun calls to chkconfig, during rpm install/removal
  - Remove unused rotate, resume steps from init script


author: Nalin Dahyabhai <nalin@redhat.com> 0.7.5-6
changelog:
  - backport patches from 0.7.10 to interpret more types of errors as indicators
    that we need to ask a different server (#692817) and from 0.7.12 to not
    get stuck while cleaning up SSL/TLS encrypted connections


author: Nalin Dahyabhai <nalin@redhat.com> 0.7.5-8
changelog:
  - switch to only munging the contents of /etc/nslcd.conf on the very first
    install (#706454)
  - make sure that we have enough space to parse any valid GID value when
    parsing a user's primary GID (#716822,#720230)
  - tweak the default "validnames" setting to also allow shorter and shorter
    names to pass muster (#706860)


author: Nalin Dahyabhai <nalin@redhat.com> 0.7.5-9
changelog:
  - include backported enhancement to take URIs in the form "dns:DOMAIN" in
    addition to the already-implemented "dns" (#730309)


author: Nalin Dahyabhai <nalin@redhat.com> 0.7.5-10
changelog:
  - update the validnames changes to the self-tests so that their expectations
    match the modified defaults (#737496)


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-11
changelog:
  - do not overflow big UID values, use explicit base when converting UIDs
    and GIDs to integer types (#741362)


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-14
changelog:
  - run the config file upgrade in %posttrans to avoid problems on multilib
    (#706454)
  - convert UID to long long on all arches to catch negative values (#741362)


author: Marek Grac <mgrac@redhat.com> - 3.1.5-7
changelog:
  - fence_rhevm needs to change "UP" status to "up" state 
      as the REST-API has changed
    Resolves: rhbz#731166


author: Marek Grac <mgrac@redhat.com> - 3.1.5-9
changelog:
  - fence_ipmilan exposes user password on verbose mod
    Resolves: rhbz#732372
  - fence_ipmilan should honor ipmilan's -L option (privileges)
    Resolves: rhbz#726571


author: Marek Grac <mgrac@redhat.com> - 3.1.5-10
changelog:
  - fence_kdump: Newly detected Coverity defect (null dereference)
    Resolves: rhbz#734429
  - fence_scsi: fix scsi unfencing to allow simultaneous unfences
    Resolves: rhbz#738384


author: Marek Grac <mgrac@redhat.com> - 3.1.5-10.1
changelog:
  - fence_rhevm: Incorrect power status detected when VM status is not up/down
    Resolves: rhbz#785816


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.10-43
changelog:
  - 630019 set correct (f)pie build flags
  - 615104 fix double echo in initscript
  - 589099 Wrong file permissions for atd configuration
  - Resolves: rhbz#630019, rhbz#615104, rhbz#589099


author: Matthew Barnes <mbarnes@redhat.com> - 2.28.1-7
changelog:
  - Translation updates for Red Hat Supported Languages (RH bug #575674).
  - This also includes the fix for the or_IN crasher (RH bug #578094).


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-10
changelog:
  - updated 'delloem setled' command to indicate SES status and drive
    activities for a PCI-e SSD (#727314)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-10
changelog:
  - added -Y option for ipmitool to hide Kg key from cmdline (#698647)
  - added 'channel setkg' command to set Kg encryption key on remote machine
    (#726390)


author: Jan Safranek <jsafrane@redhat.com> - 1.8.11-11
changelog:
  - fixed delloem powermonitor on bigendian systems (#731718)
  - fixed memory leak in Serial-over-Lan module (#731977)


author: Ondrej Vasik <ovasik@redhat.com> - 4.2.4-51
changelog:
  - check malloc success (#473488)
  - fix few compiler warnings, free malloc memory before exit
  - new URL


author: Johnny Hughes <johnny@centos.org> - 1.28.1-3.el6_0.5.1.centos
changelog:
  - rebuild due to environment issue (centos bug #5281)
  - only change is to the release string (no changes to the binaries)


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.5-0.1.rc4
changelog:
  - Update to 0.5.0rc4 which works with the new pysqlite
  - And update test cases to work with the new pysqlite


