# changelog

author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.4.0.pre2.3.el6
changelog:
  - Removed testing
   - mauve was outdated and
   - jtreg was icedtea relict
  - Updated  to icedtea 2.4.0.pre2, updated?
  - Added java -Xshare:dump to post (see 513605) fo jitarchs
  - Resolves: rhbz#911530


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.4.0.pre3.3.el6
changelog:
  - Updated  to icedtea 2.4.0.pre3, updated!
  - Rewritten patch3 java-1.7.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#911530


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.4.0.pre4.3.el6
changelog:
  - Updated  to icedtea 2.4.0.pre4, 
  - Rewritten (again) patch3 java-1.7.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#911530


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.51.1.11.6
changelog:
  - Updated to icedtea6 1.11.6
  - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch 
  - Access gnome bridge jar is forced to have 644 permissions
  - Resolves: rhbz#906708


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.53.1.11.6
changelog:
  - added patch8 revertTwoWrongSecurityPatches2013-02-06.patch
    to remove   6664509 and 7201064 from 1.11.6 tarball
  - Resolves: rhbz#906708


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.54.1.11.6
changelog:
  - removed patch8 revertTwoWrongSecurityPatches2013-02-06.patch
  - added patch8:   7201064.patch to be reverted
  - added patch9:   8005615.patch to fix the 6664509.patch
  - Resolves: rhbz#906708


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.34.1.11.8
changelog:
  - Updated to icedtea6 1.11.8
  - Removed patch9   7201064.patch
  - Removed patch10   8005615.patch
  - Removed  not-applied patch 6664509.patch
  - Removed mauve as deadly outdated and run on QA
    -  jtreg kept, useless, but working
  - Resolves: rhbz#911525


author: Rob Crittenden <rcritten@redhat.com> - 3.0.0-26.el6_4
changelog:
  - Significant decrease in migration performance. (#908308)
  - ipa-client-install failed to fall over to replica with master down (#909161)
  - During Migration - If Schema is unavailable migration fails (#908400)


author: Martin Kosek <mkosek@redhat.com> - 3.0.0-26.el6_4.2
changelog:
  - Missing LDAP schema attributeType and objectClass after upgrade (#916535)
  - ipa-adtrust-install and ipa-replica-conncheck may not parse krb5.conf
    correctly and crash (#917065)


author: Michal Novotny <minovotn@redhat.com> - qemu-kvm-0.12.1.2-2.355.el6_4.2
changelog:
  - kvm-e1000-Discard-packets-that-are-too-long-if-SBP-and-L.patch [bz#910841]
  - kvm-e1000-Discard-oversized-packets-based-on-SBP-LPE.patch [bz#910841]
  - Resolves: bz#910841
    (CVE-2012-6075  qemu (e1000 device driver): Buffer overflow when processing large packets when SBP and LPE flags are disabled [rhel-6.4.z])


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-4
changelog:
  - Address CVE-2011-4815 "DoS (excessive CPU use) via hash meet-in-the-middle
    attacks (oCERT-2011-003)"
    * ruby-1.8.7-p352-CVE-2011-4815.patch
  - Resolves: rhbz#768833


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-8
changelog:
  - Addresses entity expansion DoS vulnerability in REXML.
    * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch
  - Resolves: rhbz#915379


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-9
changelog:
  - Fix regression introduced by fix for entity expansion DOS vulnerability
    in REXML (https://bugs.ruby-lang.org/issues/7961)
    * ruby-2.0.0-add-missing-rexml-require.patch
  - Related: rhbz#915379


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-10
changelog:
  - $SAFE escaping vulnerability about Exception#to_s / NameError#to_s
    * ruby-1.8.7-p371-CVE-2012-4481.patch
    - Related: rhbz#915379


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-195.el6_4.2
changelog:
  - Allow cgred to use notify
  Resolves:#917966
  - Allow mount to transition to gluster
  Resolves:#917972


author: David Knox <dknox@redhat.com> 0:6.0.24-50
changelog:
  - Resolves: rhbz 882010 CVE-2012-3439 CVE-2012-5885 CVE-2012-5886 CVE-2012-5887
  - three DIGEST authentication issues
  - Resolves: rhbz 883692 CVE-2012-4534 Denial of service when using
  - SSL NIO sendfile
  - Resolves: rhbz 883705 CVE-2012-3546 Bypass of Realm security constraints


author: David Knox <dknox@redhat.com> 0:6.0.24-52
changelog:
  - Related: rhbz 882010 rhbz 883692 rhbz 883705
  - Javadoc generation did not work. Using targetrhel-6.4.Z-noarch-candidate
  - to avoid building on ppc64, ppc, and x390x.


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-12
changelog:
  - Resolves: Bug 910994 - PamConfig schema not updated during upgrade
  - Resolves: Bug 910995 - Valgrind reports memleak in modify_update_last_modified_attr
  - Resolves: Bug 910996 - DS returns error 20 when replacing values of a multi-valued attribute  (only when replication is enabled)
  - Resolves: Bug 911467 - DNA: use event queue for config update only at the start up
  - Resolves: Bug 911468 - Error messages encountered when using POSIX winsync
  - Resolves: Bug 911469 - dse.ldif is 0 length after server kill or machine kill
  - Resolves: Bug 911474 - Invalid chaining config triggers a disk full error and shutdown
  - Resolves: Bug 914305 - ns-slapd segfaults while trying to delete a tombstone entry
  - Resolves: Bug 913228 - unauthenticated denial of service vulnerability in handling of LDAPv3 control data


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.1.1.el6]
changelog:
  - [netdrv] mlx4: Set number of msix vectors under SRIOV mode to firmware defaults (Michal Schmidt) [911663 904726]
  - [netdrv] mlx4: Fix bridged vSwitch configuration for non SRIOV mode (Michal Schmidt) [910998 903644]
  - [net] rtnetlink: Fix IFLA_EXT_MASK definition (regression) (Thomas Graf) [909815 903220]
  - [x86] msr: Add capabilities check (Nikola Pajkovsky) [908698 908699] {CVE-2013-0268}
  - [x86] msr: Remove incorrect, duplicated code in the MSR driver (Nikola Pajkovsky) [908698 908699] {CVE-2013-0268}
  - [virt] xen: don't assume ds is usable in xen_iret for 32-bit PVOPS (Andrew Jones) [906310 906311] {CVE-2013-0228}
  - [kernel] cputime: Avoid multiplication overflow on utime scaling (Stanislaw Gruszka) [908794 862758]
  - [net] sunrpc: When changing the queue priority, ensure that we change the owner (Steve Dickson) [910370 902965]
  - [net] sunrpc: Ensure we release the socket write lock if the rpc_task exits early (Steve Dickson) [910370 902965]
  - [fs] nfs: Ensure that we free the rpc_task after read and write cleanups are done (Steve Dickson) [910370 902965]
  - [net] sunrpc: Ensure that we free the rpc_task after cleanups are done (Steve Dickson) [910370 902965]
  - [net] sunrpc: Don't allow low priority tasks to pre-empt higher priority ones (Steve Dickson) [910370 902965]
  - [fs] nfs: Add sequence_priviliged_ops for nfs4_proc_sequence() (Steve Dickson) [910370 902965]
  - [fs] nfs: The NFSv4.0 client must send RENEW calls if it holds a delegation (Steve Dickson) [910370 902965]
  - [fs] nfs: nfs4_proc_renew should be declared static (Steve Dickson) [910370 902965]
  - [fs] nfs: nfs4_locku_done must release the sequence id (Steve Dickson) [910370 902965]
  - [fs] nfs: We must release the sequence id when we fail to get a session slot (Steve Dickson) [910370 902965]
  - [fs] nfs: Add debugging messages to NFSv4's CLOSE procedure (Steve Dickson) [910370 902965]
  - [net] sunrpc: Clear the connect flag when socket state is TCP_CLOSE_WAIT (Steve Dickson) [910370 902965]
  - [fs] nfs: cleanup DS stateid error handling (Steve Dickson) [910370 902965]
  - [fs] nfs: handle DS stateid errors (Steve Dickson) [910370 902965]
  - [fs] nfs: Fix potential races in xprt_lock_write_next() (Steve Dickson) [910370 902965]
  - [fs] nfs: Ensure correct locking when accessing the 'lock_states' list (Steve Dickson) [910370 902965]
  - [fs] nfs: Fix the handling of NFS4ERR_SEQ_MISORDERED errors (Steve Dickson) [910370 902965]
  - [netdrv] be2net: fix unconditionally returning IRQ_HANDLED in INTx (Ivan Vecera) [910373 909464]
  - [netdrv] be2net: fix INTx ISR for interrupt behaviour on BE2 (Ivan Vecera) [910373 909464]
  - [netdrv] be2net: fix a possible events_get() race on BE2 (Ivan Vecera) [910373 909464]
  - [fs] gfs2: Get a block reservation before resizing a file (Robert S Peterson) [908398 875753]
  - [net] ipv6: do not create neighbor entries for local delivery (Jiri Pirko) [909159 896020]
  - [net] bonding: check for assigned mac before adopting the slaves mac address (Veaceslav Falico) [908737 905126]
  - [fs] nfs: nfs4_xdr_enc_layout{commit, return} must return status (Steve Dickson) [908733 907227]
  - [fs] set s_type before destroy_super in sget() (Eric Sandeen) [909813 904982]
  - [scsi] ses: Avoid kernel panic when lun 0 is not mapped (Ewan Milne) [908739 886867]
  - [block] avoid divide-by-zero with zero discard granularity (Mike Snitzer) [911000 901705]
  - [block] discard granularity might not be power of 2 (Mike Snitzer) [911000 901705]
  - [netdrv] tg3: Fix crc errors on jumbo frame receive (Ivan Vecera) [909816 895336]
  - [netdrv] igb: set E1000_IMS_TS interrupt bit in igb_irq_enable (Stefan Assmann) [909818 871795]
  - [pci] intel-iommu: Prevent devices with RMRRs from being placed into SI Domain (Tony Camuso) [908744 678451]
  - [scsi] sd: Reshuffle init_sd to avoid crash (Ewan Milne) [911655 888417]
  - [mm] add numa node symlink for cpu devices in sysfs (Neil Horman) [909814 878708]


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-10.1
changelog:
  - incorporate upstream patch to fix a NULL pointer dereference when the client
    supplies an otherwise-normal-looking PKINIT request (CVE-2013-1415, #917909)
  - add patch to avoid dereferencing a NULL pointer in the KDC when handling a
    draft9 PKINIT request (#917909, CVE-2012-1016)


author: Ian Kent <ikent@redhat.com> - 5.0.5-74.el6_4
changelog:
  - bz921147 - autofs mount failures when mounting multiple nfs mounts at
    the same time
    - use numeric protocol ids instead of protoent structs.
  - Resolves: rhbz#921147


author: Ian Kent <ikent@redhat.com> - 5.0.5-74.el6_4
changelog:
  - bz921147 - autofs mount failures when mounting multiple nfs mounts
    at the same time
    - correct patch name in spec file.
  - Related: rhbz#921147


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82.2
changelog:
  - Resolves: rhbz#914671 - pwd_expiration_warning has wrong default for
                            Kerberos
  - Fix the NVR


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82.3
changelog:
  - Fix pwd_expiration_warning=0
  - Resolves: rhbz#914671 - pwd_expiration_warning has wrong default for
                            Kerberos


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82.4
changelog:
  - Resolves: rhbz#911298 - sssd: simple access provider flaw prevents intended
                             ACL use when client to an AD provider


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-18.el6_4.1
changelog:
  - xen: Resolve resource leak with 'cpuset' (rhbz#908836)
  - schema: Make the cpuset type reusable across schema files (rhbz#908836)
  - schemas: Add schemas for more CPU topology information in the caps XML (rhbz#908836)
  - conf: Split out NUMA topology formatting to simplify access to data (rhbz#908836)
  - capabilities: Switch CPU data in NUMA topology to a struct (rhbz#908836)
  - capabilities: Add additional data to the NUMA topology info (rhbz#908836)
  - test: Add support for thread and core information for the test driver (rhbz#908836)
  - xen: Initialize variable before using (rhbz#908836)
  - xen: Actually fix the uninitialized variable (rhbz#908836)
  - spice: Properly reserve tlsPort when no port specified (rhbz#913624)
  - qemu_agent: Ignore expected EOFs (rhbz#915344)
  - qemu: Nicer error message if live disk snapshot unsupported (rhbz#915363)
  - qemu: Destroy domain on decompression binary error (rhbz#915347)
  - qemu: Run lzop with '--ignore-warn' (rhbz#915347)
  - Don't ignore return value of qemuProcessKill (rhbz#915353)
  - Fix race condition when destroying guests (rhbz#915353)
  - Log warning if storage magic matches, but version does not (rhbz#915354)
  - Add lots of debugging to storage file probing code (rhbz#915354)
  - Fix probing of QED file format (rhbz#915354)
  - util: Add virendian.h macros (rhbz#915354)
  - util: Use new virendian.h macros (rhbz#915354)
  - storage: Rearrange functions (rhbz#915354)
  - storage: Prepare for refactoring (rhbz#915354)
  - storage: Refactor metadata lookup (rhbz#915354)
  - storage: Don't follow backing chain symlinks too eagerly (rhbz#915354)
  - storage: Test backing chain traversal (rhbz#915354)
  - qemu: Check backing chains even when cgroup is omitted (rhbz#915349)
  - python: Fix bindings for virDomainSnapshotGet{Domain,Connect} (rhbz#915348)
  - qemu: Add checking in helpers for sgio setting (rhbz#919504)
  - qemu: Merge qemuCheckSharedDisk into qemuAddSharedDisk (rhbz#919504)
  - qemu: Record names of domain which uses the shared disk in hash table (rhbz#919504)
  - qemu: Update shared disk table when reconnecting qemu process (rhbz#919504)
  - qemu: Move the shared disk adding and sgio setting prior to attaching (rhbz#919504)
  - qemu: Remove the shared disk entry if the operation is ejecting or updating (rhbz#919504)
  - qemu: Fix the memory leak (rhbz#919504)
  - Fix crash changing CDROM media (rhbz#919504)
  - qemu: Avoid NULL dereference in qemuSharedDiskEntryFree (rhbz#919504)
  - qemu: Do not set unpriv_sgio if neither supported nor requested (rhbz#917063)
  - Use size_t instead of int for virDomainDefPtr struct (rhbz#915352)
  - util: Add VIR_(APPEND|INSERT|DELETE)_ELEMENT (rhbz#915352)
  - qemu: Fix QMP detection of QXL graphics (rhbz#915352)
  - qemu: Add qemu vga devices caps and one cap to mark them usable (rhbz#915352)
  - conf: Add optional attribte primary to video <model> element (rhbz#915352)
  - qemu: Use newer -device video device in qemu commandline (rhbz#915352)
  - tests: Add one -device video device testcase (rhbz#915352)
  - qemu: Detect VGA_QXL capability correctly (rhbz#915352)
  - qemu: Support ram bar size for qxl devices (rhbz#915352)
  - conf: Don't leak 'primary' video property on error (rhbz#915352)
  - storage: lvm: Don't overwrite lvcreate errors (rhbz#918754)
  - storage: lvm: Lvcreate fails with allocation=0, don't do that (rhbz#918754)
  - storage: Cleanup logical volume creation code (rhbz#918754)
  - docs: Clarify semantics of sparse storage volumes (rhbz#918754)
  - storage: Fix memory leak with regfree(reg) call. (rhbz#922095)
  - storage: Resource resource leak using 'tmp_vols' (rhbz#922095)
  - interface: Resolve resource leak wth 'tmp_iface_objs' (rhbz#922095)
  - locking: Resolve resource leaks on non error path (rhbz#922095)
  - selinux: Resolve resource leak using the default disk label (rhbz#922095)
  - storage: Resolve resource leaks with cmd processing (rhbz#922095)
  - domain_conf: Resolve resource leaks found by Valgrind (rhbz#922095)
  - qemu_command: Resolve resource leaks found by Valgrind (rhbz#922095)
  - storage: Need to add virCommandFree() (rhbz#922095)


author: Than Ngo <than@redhat.com> - 1:4.6.2-26
changelog:
  - Resolves: CVE-2013-0254, QSharedMemory class created shared memory segments with insecure permissions


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-130
changelog:
  - Resolves: #915692 - CVE-2012-5526 (newline injection due to improper CRLF
    escaping in Set-Cookie and P3P headers)
  - Resolves: #915692 - CVE-2012-6329 (possible arbitrary code execution via
    Locale::Maketext)
  - Resolves: #915692 - CVE-2013-1667 (DoS in rehashing code)


author: Petr Machata <pmachata@redhat.com> - 1.41.0-16
changelog:
  - Fix a GCC warning for looser throw specifier in
    boost::exception_ptr::~exception_ptr.
    (boost-1.41.0-exception_ptr.patch)


author: Ondrej Vasik <ovasik@redhat.com> - 8.4-19.1
changelog:
  - revert to polling for unknown filesystems, update
    known fs for tail and stat based on coreutils-8.21 (#924711)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-18.el6_4.3
changelog:
  - util: Retry NLM_F_REQUEST with different values of IFLA_EXT_MASK (rhbz#928881)
  - security_manager: Don't manipulate domain XML in virDomainDefGetSecurityLabelDef (rhbz#928879)
  - security: Don't add seclabel of type none if there's already a seclabel (rhbz#928879)
  - libvirt_private.syms: Correctly export seclabel APIs (rhbz#928879)
  - security_manager.c: Append seclabel iff generated (rhbz#928879)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-13
changelog:
  - Resolves: Bug 929114 - cleanAllRUV task fails to cleanup config upon completion (ticket 623)
  - Resolves: Bug 929111 - Coverity issue 13091
  - Resolves: Bug 929196 - Deadlock in DNA plug-in (ticket 634)
  - Resolves: Bug 929107 - ns-slapd crashes sporadically with segmentation fault in libslapd.so (ticket 627)
  - Resolves: Bug 929115 - crash in aci evaluation (ticket 628)
  - Resolves: Bug 923240 - unintended information exposure when anonymous access is set to rootdse (ticket 47308)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-14
changelog:
  - Resolves: Bug 929107 - ns-slapd crashes sporadically with segmentation fault in libslapd.so (ticket 627)
  - Resolves: Bug 929114 - cleanAllRUV task fails to cleanup config upon completion (ticket 623)


author: Nalin Dahyabhai <nalin@redhat.com> 1.10.3-10.2
changelog:
  - incorporate upstream patch to fix a NULL pointer dereference while processing
    certain TGS requests (CVE-2013-1416, #950342)


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.9-2.3.8.1.el6
changelog:
  - Added and applied patch 116 - patch 116 rh905128-non_block_ciphers.patch
  - Added and applied patch 117 - patch 117 java-1.7.0-openjdk-nss-multiplePKCS11libraryInitialisationNnonCritical.patch
   - to enable handleStartupErrors = ignoreMultipleInitialisation in icedtea 2.3
  - Restorered removed nss support
  - Fixed java-1.7.0-openjdk-nss-config-{1,2} patches to be valid for icedtea 2.3.x
  - enable_nss switch to 0 - disabled
  - Resolves: rhbz#950380


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.19-2.3.8.2.el6
changelog:
  - Added latest Fedora spec changes
  - Bumped release
  - Removed patch2 java-1.7.0-openjdk-java-access-bridge-idlj.patch (unapplied)
  - zlib in BuildReq restricted for  1.2.3-7 or higher
   - see https://bugzilla.redhat.com/show_bug.cgi?id=904231
  - Removed a -icedtea tag from the version
    - package have less and less connections to icedtea7
  - Added gcc-c++ build dependence. Sometimes caused troubles during rpm -bb
  - Added (Build)Requires for fontconfig and xorg-x11-fonts-Type1
    - see https://bugzilla.redhat.com/show_bug.cgi?id=721033 for details
  - Removed all fonconfig files. Fonts are now handled differently in JDK 
    and those files are redundant. This is going to be usptreamed.
    - see https://bugzilla.redhat.com/show_bug.cgi?id=902227 for details
  - logging.properties marked as config(noreplace)
    - see https://bugzilla.redhat.com/show_bug.cgi?id=679180 for details
  - classes.jsa marked as ghost on full path
    - see https://bugzilla.redhat.com/show_bug.cgi?id=918172 for details
  - nss.cfg was marked as config(noreplace)
  - Add symlink to default soundfont (see 541466)
  - Resolves: rhbz#950380


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.9-2.3.9.0.el6
changelog:
  - updated to IcedTea  2.3.9 with latest security patches
  - buildver sync to b19
  - rewritten java-1.7.0-openjdk-java-access-bridge-security.patch
  - Resolves: rhbz#950380


author: Jiri Vanek <jvanek@redhat.com - 1.7.0.19-2.3.9.1.el6
changelog:
  - updated to updated IcedTea  2.3.9 with fix to one of security fixes
    -  fixed font glyph offset
  - Resolves: rhbz#950380


author: Jiri Vanek <jvanek@redhat.com> 1.2.3-0
changelog:
  - Updated to latest ustream release of 1.2 branch - 1.2.3
   - Security Updates
    - CVE-2013-1927, RH884705 - fixed gifar vulnerability
    - CVE-2013-1926, RH916774: Class-loader incorrectly shared for applets with same relative-path.
   - Common
    - PR1161: X509VariableTrustManager does not work correctly with OpenJDK7
   - Plugin
    - PR1157: Applets can hang browser after fatal exception
  - Removed upstreamed patch 0- icedtea-web-PR1161.patch
  - Resolves: rhbz#949094


author: Jiri Vanek <jvanek@redhat.com> 1.2.3-1
changelog:
  - fixed postun - removal of alternatives for plugin restricted to 
    (correct) removal process only
  - fixed date in changelog previous entry
  - Resolves: rhbz#949094


author: Jiri Vanek <jvanek@redhat.com> 1.2.3-2
changelog:
  - Added (temporally!) posttrans forcing creation of symlinks
    - should be removed next release
  - Resolves: rhbz#949094


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-18.el6_4.4
changelog:
  - rpc: Fix client crash when server drops connection (rhbz#950601)
  - storage: Fix volume cloning for logical volume. (rhbz#950604)
  - qemu: Allow migration over IPv6 (rhbz#950597)
  - qemu: Set IPv6 migration capability when dump-guest-core is present (rhbz#950597)
  - remote: Don't call NULL closeFreeCallback (rhbz#950599)
  - libvirt: Increase connection reference count for callbacks (rhbz#950599)
  - virsh: Unregister the connection close notifier upon termination (rhbz#950599)
  - virsh: Move cmdConnect from virsh-host.c to virsh.c (rhbz#950599)
  - virsh: Register and unregister the close callback also in cmdConnect (rhbz#950599)
  - rpc: Fix connection close callback race condition and memory corruption/crash (rhbz#950599)
  - tests: Fix qemumonitorjsontest deadlock when the machine is under load (rhbz#951235)
  - Avoid use of free'd memory in auto destroy callback (rhbz#951073)
  - Fix crash in QEMU auto-destroy with transient guests (rhbz#951073)


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.4.1.el6]
changelog:
  - [fs] NLM: Ensure that we resend all pending blocking locks after a reclaim (Steve Dickson) [921150 913704]
  - [fs] xfs: remove log force from xfs_buf_cond_lock() (Brian Foster) [921961 896224]
  - [fs] xfs: recheck buffer pinned status after push trylock failure (Brian Foster) [921961 896224]
  - [fs] nfs: Ensure that we check lock exclusive/shared type against open modes (Dave Wysochanski) [920268 916324]
  - [powerpc] pseries: Fix partition migration hang in stop_topology_update (Steve Best) [921963 910597]
  - [infiniband] qib: correction for faulty sparse warning correction (Jay Fenlason) [922154 901701]
  - [usb] io_ti: Fix NULL dereference in chase_port() (Nikola Pajkovsky) [916198 916200] {CVE-2013-1774}
  - [net] bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Nikola Pajkovsky) [914690 914691] {CVE-2013-0349}
  - [char] tty: set_termios/set_termiox should not return -EINTR (Oleg Nesterov) [921145 904907]
  - [netdrv] ehea: fix VLAN support (Steve Best) [921535 911359]
  - [net] xfrm_user: return error pointer instead of NULL (Thomas Graf) [919388 919389] {CVE-2013-1826}
  - [net] dccp: check ccid before NULL poiter dereference (Weiping Pan) [919187 919188] {CVE-2013-1827}
  - [mm] tmpfs: fix use-after-free of mempolicy object (Nikola Pajkovsky) [915714 915715] {CVE-2013-1767}
  - [fs] fuse: set page_descs length in fuse_buffered_write() (Brian Foster) [916957 915135]
  - [fs] vfs: fix pointer dereference validation in d_validate (Carlos Maiolino) [915583 876600]
  - [fs] cifs: after upcalling for krb5 creds, invalidate key rather than revoking it (Niels de Vos) [912452 885899]
  - [fs] cifs: tmp_key_invalidate() should not set key->expiry to 0 (Niels de Vos) [912452 885899]
  - [block] disable discard request merge temporarily (Mike Snitzer) [911475 907844]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.5.1.el6]
changelog:
  - [fs] xfs: use maximum schedule timeout when ail is empty (Brian Foster) [921958 883905]
  - [net] xfrm_user: fix info leak in copy_to_user_tmpl() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_policy() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_state() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_auth() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] atm: fix info leak in getsockopt(SO_ATMPVC) (Thomas Graf) [922386 922387] {CVE-2012-6546}
  - [net] atm: fix info leak via getsockname() (Thomas Graf) [922386 922387] {CVE-2012-6546}
  - [fs] nls: improve UTF8 -> UTF16 string conversion routine (Nikola Pajkovsky) [916118 916119] {CVE-2013-1773}
  - [fs] fat: Fix stat->f_namelen (Nikola Pajkovsky) [916118 916119] {CVE-2013-1773}
  - [netdrv] tun: fix ioctl() based info leaks (Thomas Graf) [922350 922351] {CVE-2012-6547}
  - [virt] x86: Add a check to catch Xen emulation of Hyper-V (Andrew Jones) [923204 918239]
  - [fs] cifs: fix expand_dfs_referral (Sachin Prabhu) [923098 902492]
  - [fs] cifs: factor smb_vol allocation out of cifs_setup_volume_info (Sachin Prabhu) [923098 902492]
  - [fs] cifs: have cifs_cleanup_volume_info not take a double pointer (Sachin Prabhu) [923098 902492]
  - [fs] nfs: Dont allow NFS silly-renamed files to be deleted, no signal (Dave Wysochanski) [920266 905095]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.6.1.el6]
changelog:
  - [virt] kvm: accept unaligned MSR_KVM_SYSTEM_TIME writes (Petr Matousek) [917020 917021] {CVE-2013-1796}
  - [char] tty: hold lock across tty buffer finding and buffer filling (Prarit Bhargava) [928686 901780]
  - [net] tcp: fix for zero packets_in_flight was too broad (Thomas Graf) [927309 920794]
  - [net] tcp: frto should not set snd_cwnd to 0 (Thomas Graf) [927309 920794]
  - [net] tcp: fix an infinite loop in tcp_slow_start() (Thomas Graf) [927309 920794]
  - [net] tcp: fix ABC in tcp_slow_start() (Thomas Graf) [927309 920794]
  - [netdrv] ehea: avoid accessing a NULL vgrp (Steve Best) [921535 911359]
  - [net] sunrpc: Get rid of the redundant xprt->shutdown bit field (J. Bruce Fields) [915579 893584]
  - [virt] kvm: do not #GP on unaligned MSR_KVM_SYSTEM_TIME write (Gleb Natapov) [917020 917021] {CVE-2013-1796}
  - [drm] i915: bounds check execbuffer relocation count (Nikola Pajkovsky) [920523 920525] {CVE-2013-0913}
  - [x86] irq: add quirk for broken interrupt remapping on 55XX chipsets (Neil Horman) [911267 887006]
  - [kvm] Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (Gleb Natapov) [917024 917025] {CVE-2013-1797}
  - [kvm] Fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (Gleb Natapov) [917020 917021] {CVE-2013-1796}
  - [kvm] Fix bounds checking in ioapic indirect register reads (Gleb Natapov) [917030 917032] {CVE-2013-1798}
  - [kvm] x86: release kvmclock page on reset (Gleb Natapov) [917024 917025] {CVE-2013-1797}
  - [security] keys: Fix race with concurrent install_user_keyrings() (David Howells) [916681 913258] {CVE-2013-1792}
  - [virt] hv_balloon: Make adjustments to the pressure report (Jason Wang) [909156 902232]


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.58.1.11.10
changelog:
  - Updated to icedtea6 1.11.10
  - rewritten java-1.6.0-openjdk-java-access-bridge-security.patch
  - excluded aarch64.patch
    - by patch 8 -  removingOfAarch64.patch.patch
  - Resolves: rhbz#950386


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.59.1.11.11
changelog:
  - Updated to icedtea6 1.11.11 - fixed xalan/xerxes privledges
  - removed patch 8 -  removingOfAarch64.patch.patch - fixed upstream
  - Resolves: rhbz#950386


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.60.1.11.11
changelog:
  - added and applied (temporally) one more patch to xalan/xerces privileges
   - patch9 jaxp-backport-factoryfinder.patch
  - will be upstreamed
  - Resolves: rhbz#950386


author: Jiri Vanek <jvanek@redhat.com> - 1:1.6.0.0-1.61.1.11.11
changelog:
  - added and applied (temporally) patch10   fixToFontSecurityFix.patch.
   - fixing regression in fonts introduced by one security patch.
  - Resolves: rhbz#950386


author: Tom Lane <tgl@redhat.com> 5.1.66-1
changelog:
  - Update to 5.1.66, for assorted upstream bugfixes including
    CVEs announced in July and October 2012
  Resolves: #871814


author: Tom Lane <tgl@redhat.com> 5.1.67-1
changelog:
  - Update to 5.1.67, for assorted upstream bugfixes including
    CVEs announced in January 2013
  Resolves: #901381


author: Tom Lane <tgl@redhat.com> 5.1.69-1
changelog:
  - Update to 5.1.69, for assorted upstream bugfixes including
    CVEs announced in April 2013
  Resolves: #953084


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.2-82.6
changelog:
  - Resolves: #950874: Simple access control always denies uppercased users
                       in case insensitive domain


