# changelog

author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.61.rc1
changelog:
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.67.rc1
changelog:
  - Change EDNS flags only after successful query (#1416035)
  - Fix crash in ldap driver at bind-sdb stop (#1426626)


author: Jiri Vanek <jvanek@redhat.com> - 1.1-2
changelog:
  - package now "installs" also during pretrans, so pretrasn scripts can use it
  - pretrasn "install" is removed in postrans


author: Jiri Vanek <jvanek@redhat.com> - 1.2-1
changelog:
  - initial import to rhel6
  - commented out lua-posix
  - the work horse file changed to 644 (as it do not work without lua-posix)
  - Resolves: rhbz#1391735


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-22
changelog:
  - allow larger DH parameters length(#1230258)
  - don't check client PID in non-login auth sockets (#1281670)
  - messages containing a CP932 character were not shown in a search result (#1275233)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.0.9-22.1
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1752708)


author: Petr Stodulka <pstodulk@redhat.com> - 1.7.1-8
changelog:
  - fixes previous patch which add -f option for "git submodule add"
    which incorectly used unsupported option --ignore-missing for
    "git add --dry-run"
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1207253 #1368384


author: Jan Horak <jhorak@redhat.com> - 60.1.0-8
changelog:
  - Fixed homepage and bookmarks (rhbz#1606778)
  - Fixed missing file associations in RHEL6 (rhbz#1613565)


author: Jan Horak <jhorak@redhat.com> - 60.1.0-9
changelog:
  - Do not set user agent (rhbz#1608065)
  - GTK dialogs are localized now (rhbz#1619373)
  - JNLP association works again (rhbz#1607457)


author: Martin Osvald <mosvald@redhat.com> - 8.70-24.el6_10.2
changelog:
  - It was found that the fix for CVE-2018-16509 was not complete, the missing
    pieces added into ghostscript-CVE-2018-16509.patch


author: Tomas Mraz <tmraz@redhat.com> - 2.0.13-3
changelog:
  - drop s390 specific ifnarchs as all the previously missing dependencies
    are now there
  - split out gpgsm into a smime subpackage to reduce main package dependencies


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.13-4
changelog:
  - Explicitly BR libassuan-static in accordance with the Packaging
    Guidelines (libassuan-devel is still static-only).


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-3
changelog:
  - initialize small amount of secmem for list of algorithms in help (#598847)
    (necessary in the FIPS mode of libgcrypt)


author: Tomas Mraz <tmraz@redhat.com> - 2.0.14-5
changelog:
  - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation
  - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.14-8
changelog:
  - fix aborts and default algorithms when running in FIPS mode (#1078957, #966493)
  - add missing initialization of libgcrypt in gpgv
  - properly encode s2k iteration count in gpg-agent (#638635)


author: Peng Wu <pwu@redhat.com> - 4.2.1-15
changelog:
  - Apply icu.13634.integer.overflow.patch
  - Apply icu.20958.segv.mapper.patch
  - Resolves: rhbz#1809876


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - jsa files changed to 444 to pass rpm verification
  - Add reg-ex for filtering private libraries' provides/requires.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - Cleanup RH1566890 patch and differentiate from java-1.8.0-openjdk version.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.12
changelog:
  - Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
  - ABS_JAVA_HOME_DIR is no longer used in the latest tapsets
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.191-2.6.15.0
changelog:
  - Bump to 2.6.15 and u191b00.
  - Drop PR3608/RH1566890/CVE-2018-3639 patch now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.0
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.0
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.0
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-2.b11
changelog:
  - Fix a number of bad bug identifiers (PR3546 should be PR3578, PR3456 should be PR3546)
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.172-2.b11
changelog:
  - Remove build flags exemption for aarch64 now the platform is more mature and can bootstrap OpenJDK with these flags.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-0.b03
changelog:
  - Update to aarch64-jdk8u181-b03 and aarch64-shenandoah-jdk8u181-b03.
  - Remove AArch64 patch for PR3458/RH1540242 as applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-1.b04
changelog:
  - Mark bugs that have been pushed to 8u upstream and are scheduled for a release.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-2.b04
changelog:
  - Add "8206406, PR3610, RH1597825: StubCodeDesc constructor publishes partially-constructed objects on StubCodeDesc::_list"
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Update to aarch64-shenandoah-jdk8u192-b12.
  - Remove patches included upstream
    - PR3548/RH1540242
    - JDK-6260348/PR3066
    - JDK-8185723/PR3553
    - JDK-8186461/PR3557
    - JDK-8201509/PR3579
    - JDK-8205104/PR3539/RH1548475
    - JDK-8206406/PR3610/RH1597825
    - JDK-8201495/PR2415
  - Re-generate patches (mostly due to upstream build changes)
    - JDK-8073139/PR1758/RH1191652
    - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
    - JDK-8199936/PR3533
    - JDK-8199936/PR3591
    - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
    - PR3593 (due to JDK-8081202)
    - RH1566890/CVE-2018-3639 (due to JDK-8189170)
    - RH1649664 (due to JDK-8196516)
    - RH1649731
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-1
changelog:
  - Add 8160748 for AArch64 which is missing from upstream 8u version.
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-0
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
  - Update version logic to handle -shenandoah* tag suffix.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b09.
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Remove the 64-bit siphash test which fails to compile on x86-32 debug builds with gcc 4.4.7 in RHEL 6
  - Resolves: rhbz#1876665


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.10.1.el6]
changelog:
  - [net] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close (Xin Long) [1646405]
  - [x86] kvm: Update cpuid properly when CR4.OSXAVE or CR4.PKE is changed (Wei Huang) [1425051]
  - [mm] mempolicy: migrate_to_node should only migrate to node (Rafael Aquini) [1577094]
  - [mm] vmscan: avoid possible deadlock caused by too_many_isolated() (Rafael Aquini) [1577094]
  - [fs] seqfile: always allow oom killer (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc instead of oom kill processes (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc allocation (Rodrigo Freire) [1632434]
  - [fs] proc/stat: convert to single_open_size() (Rodrigo Freire) [1632434]
  - [fs] seq_file: always clear m->count when we free m->buf (Rodrigo Freire) [1632434]
  - [fs] seq_file: single_open_size() new helper (Rodrigo Freire) [1632434]
  - [fs] stat: Use size_t for sizes instead of unsigned (Rodrigo Freire) [1632434]
  - [fs] proc: speed up /proc/stat handling (Rodrigo Freire) [1632434]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.11.1.el6]
changelog:
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1644401]
  - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593083] {CVE-2018-10902}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.12.1.el6]
changelog:
  - [x86] vDSO: Don't generate retpoline for indirect call (Waiman Long) [1638552]
  - [fs] cifs: fix reparse point/symlink breakage (Leif Sahlberg) [1636484]
  - [scsi] qla2xxx: Mask off Scope bits in retry delay (Himanshu Madhani) [1588133]
  - [net] tcp: make tcp_retransmit_timer a no-op on empty write queue (Paolo Abeni) [1585892]
  - [kernel] sched/sysctl: Check user input value of sysctl_sched_time_avg (Lauro Ramos Venancio) [1579128]
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] hugetlbfs: switch to inode_init_owner() (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] udf: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ubifs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ramfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext4: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext3: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext2: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] btrfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] vfs: Add inode uid,gid,mode init helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [s390] kernel: adapt to changed CPU vulnerabilities function prototypes (Hendrik Brueckner) [1625381]
  - [s390] detect etoken facility (Hendrik Brueckner) [1625381]
  - [s390] Correct register corruption in critical section cleanup (Hendrik Brueckner) [1625381]
  - [s390] remove indirect branch from do_softirq_own_stack (Hendrik Brueckner) [1625381]
  - [s390] move spectre sysfs attribute code (Hendrik Brueckner) [1625381]
  - [s390] kernel: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] ftrace: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] move expoline assembler macros to a header (Hendrik Brueckner) [1625381]
  - [s390] correct module section names for expoline code revert (Hendrik Brueckner) [1625381]
  - [x86] speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Oleksandr Natalenko) [1670328]
  - [perf] Fix a race between ring_buffer_detach() and ring_buffer_attach() (Jiri Olsa) [1589340]
  - [perf] Fix mmap() accounting hole (Jiri Olsa) [1627672]
  - [perf] Fix perf mmap bugs (Jiri Olsa) [1627672]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.14.2.el6]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.1.el6]
changelog:
  - [x86] x86/speculation: Don't print MDS_MSG_SMT message if mds_nosmt specified (Waiman Long) [1710081 1710517]
  - [x86] x86/spec_ctrl: Fix incorrect MDS handling in late microcode loading (Waiman Long) [1710081 1710517]
  - [x86] x86/speculation: Fix misuse of boot_cpu_has() with bug bits (Waiman Long) [1710121]
  - [x86] x86/speculation/mds: Fix documentation typo (Waiman Long) [1710517]
  - [documentation] Documentation: Correct the possible MDS sysfs values (Waiman Long) [1710517]
  - [x86] x86/mds: Add MDSUM variant to the MDS documentation (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Fix comment (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.2.el6]
changelog:
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.3.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.16.1.el6]
changelog:
  - [virt] xenbus: Fix memory leak on release (Vitaly Kuznetsov) [1661666]
  - [fs] dcache: fix locking around setting DCACHE_SHRINKING flag (Miklos Szeredi) [1672269]
  - [x86] KVM: SVM: Selective cr0 intercept (Wei Huang) [1655873]
  - [x86] KVM: SVM: Restore unconditional cr0 intercept under npt (Wei Huang) [1655873]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.17.1.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.1.el6]
changelog:
  - [virt] xenbus: don't look up transaction IDs for ordinary writes (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: don't BUG() on user mode induced condition (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: Add proper handling of XS_ERROR from Xenbus for transactions (Vitaly Kuznetsov) [1663262]
  - [fs] proc: restrict kernel stack dumps to root (Denys Vlasenko) [1638193] {CVE-2018-17972}
  - [crypto] salsa20 - fix blkcipher_walk API usage (Bruno Eduardo de Oliveira Meneguele) [1543984]
  - [mm] vmscan: do not loop on too_many_isolated for ever (Rafael Aquini) [1658254]
  - [x86] spec_ctrl: Don't report the use of retpoline on Skylake as vulnerable (Waiman Long) [1666102]
  - [mm] try harder to allocate vmemmap blocks (Rafael Aquini) [1591394]
  - [v4l] dvb: revert spectre v1 mitigation (Josh Poimboeuf) [1647975]
  - [fs] binfmt_misc.c: do not allow offset overflow (Bill O'Donnell) [1710149]
  - [x86] pti: Don't use PCID and INVPCID in x86-32 (Waiman Long) [1702782]
  - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664197] {CVE-2019-5489}
  - [x86] spec: Move retp_compiler() inline function to bugs.c (Waiman Long) [1722185]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.2.el6]
changelog:
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-747.el6]
changelog:
  - [fs] gfs2: Check for the end of metadata in trunc_dealloc (Robert S Peterson) [1559928]
  - [fs] gfs2: clear journal live bit in gfs2_log_flush (Robert S Peterson) [1559928]
  - [netdrv] vmxnet3: fix tx data ring copy for variable size (Neil Horman) [1530378]
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1559386]
  - [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1554631]
  - [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1554631]
  - [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1554630]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-748.el6]
changelog:
  - [mm] fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE (Bhupesh Sharma) [1494380]
  - [mm] brk: fix min_brk lower bound computation for COMPAT_BRK (Bhupesh Sharma) [1494380]
  - [mm] split ET_DYN ASLR from mmap ASLR (Bhupesh Sharma) [1494380]
  - [s390] redefine randomize_et_dyn for ELF_ET_DYN_BASE (Bhupesh Sharma) [1494380]
  - [mm] expose arch_mmap_rnd when available (Bhupesh Sharma) [1494380]
  - [s390] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [s390] mmap: randomize mmap base for bottom up direction (Bhupesh Sharma) [1494380]
  - [powerpc] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [x86] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: create Kconfig variable for PIE randomization (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: PIE: make PF_RANDOMIZE check comment more accurate (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: fix PIE execution with randomization disabled (Bhupesh Sharma) [1494380]
  - [acpi] acpica: Support calling _REG methods within ACPI interpreter (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI interpreter already entered (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI mutex held by this thread (Lenny Szubowicz) [1522849]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-749.el6]
changelog:
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1561788]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1561788]
  - [lib] seq: Add seq_buf_printf() (Mauricio Oliveira) [1561788]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1561786]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1557562 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1558845]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-750.el6]
changelog:
  - [fs] fuse: fix punching hole with unaligned end (Miklos Szeredi) [1387473] {CVE-2017-15121}
  - [documentation] kdump: fix documentation about panic_on_warn to match rhel6 (Pingfan Liu) [1555196]
  - [fs] Provide sane values for nlink (Leif Sahlberg) [1554342]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-751.el6]
changelog:
  - [md] dm thin: fix regression that caused discards to be disabled if passdown was (Mike Snitzer) [1569377]
  - [s390] configs: enable auto expoline support (Hendrik Brueckner) [1554959]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1554959]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1554959]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1554959]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1554959]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1554959]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1554959]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1554959]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1554959]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1554959]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1554959]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1554959]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1554959]
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1568241]
  - [net] sctp: verify size of a new chunk in _sctp_make_chunk() (Stefano Brivio) [1551908] {CVE-2018-5803}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-752.el6]
changelog:
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1572487]
  - [fs] fix WARNING in rmdir() (Miklos Szeredi) [1282117]
  - [net] sctp: label accepted/peeled off sockets (Marcelo Leitner) [1571357]
  - [net] security: export security_sk_clone (Marcelo Leitner) [1571357]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-753.el6]
changelog:
  - [x86] vm86-32: Properly set up vm86-32 stack for task switching (Waiman Long) [1572865]
  - [x86] spec_ctrl: Enable IBRS and RSB stuffing in 32-bit interrupts (Waiman Long) [1571362]
  - [x86] entry/32: Fix regressions in 32-bit debug exception (Waiman Long) [1571362]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.el6]
changelog:
  - [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581053] {CVE-2018-3639}
  - [x86] amd: Disable AMD SSBD mitigation in a VM (Waiman Long) [1580360]
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] kvm: Expose the RDS bit to the guest (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs/AMD: Add support to disable RDS on Fam(15, 16, 17)h if requested (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] invpcid: Enable 'noinvpcid' boot parameter for X86_32 (Waiman Long) [1560494]
  - [x86] dumpstack_32: Fix kernel panic in dump_trace (Waiman Long) [1577351]
  - [fs] gfs2: For fs_freeze, do a log flush and flush the ail1 list (Robert S Peterson) [1569148]
  - [net] dccp: check sk for closed state in dccp_sendmsg() (Stefano Brivio) [1576586] {CVE-2018-1130}
  - [net] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped (Stefano Brivio) [1576586] {CVE-2018-1130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.1.1.el6]
changelog:
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1574592]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1574592]
  - [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1574592]
  - [x86] microcode: Sanitize per-cpu microcode reloading interface (Prarit Bhargava) [1574592]
  - [x86] virt_spec_ctrl: Set correct host SSDB value for AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Fix missing void (Waiman Long) [1584356] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584356] {CVE-2018-3639}
  - [uapi] prctl: Add force disable speculation (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Show IBPB in the Spectre_v2 sysfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Check MSR_IA32_ARCH_CAPABILITIES for Meltdown vulnearability (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Fix kexec warning on debug kernel (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] kvm/fpu: Enable eager FPU restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] always enable eager FPU by default (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Load xsave pointer *after* initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix 32-bit signal frame handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always restore_xinit_state() when use_eager_cpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Rename drop_init_fpu() to fpu_reset_state() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix math_state_restore() race with kernel_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fold __drop_fpu() into its sole user (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse drop_init_fpu() in flush_thread() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce restore_init_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Document user_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always allow FPU in interrupt if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce per-cpu in_kernel_fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Check tsk_used_math() in kernel_fpu_end() for eager FPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change math_error() to use unlazy_fpu(), kill (now) unused save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Merge simd_math_error() into math_error() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't reset thread.fpu_counter (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Allow FPU to be used at interrupt time even with eagerfpu (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387.c: Initialize thread xstate only on CPU0 only once (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: fix kvm's usage of kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] rhel: initialize scattered CPUID features early (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: make eagerfpu= boot param tri-state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: enable eagerfpu by default for xsaveopt (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: decouple non-lazy/eager fpu restore from xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: use non-lazy fpu restore for processors supporting xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: remove unnecessary user_fpu_end() in save_xstate_sig() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop_fpu() before restoring new state from sigframe (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Unify signal handling code paths for x86 and x86_64 kernels (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop the fpu state during thread exit (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signals: ia32_signal.c: add __user casts to fix sparse warnings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Consolidate inline asm routines for saving/restoring fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signal: Cleanup ifdefs and is_ia32, is_x32 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu/xsave: Keep __user annotation in casts (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] debug: Add KERN_<LEVEL> to bare printks, convert printks to pr_<level> (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] extable: Remove open-coded exception table entries in arch/x86/include/asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Split up <asm/i387.h> into exported and internal interfaces (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Uninline the generic FP helpers that we expose to kernel modules (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: (DON'T ACTUALLY) support lazy restore of FPU state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: use 'restore_fpu_checking()' directly in task switching code (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix up some fpu_counter confusion (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: re-introduce FPU state preloading at context switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU flag from thread_info to task_struct (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move AMD K7/K8 fpu fxsave/fxrstor workaround from save to restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: do not preload FPU state at task switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: don't ever touch TS_USEDFPU directly, use helper functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU clearing out of __save_init_fpu and into callers (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix x86-64 preemption-unsafe user stack save/restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: math_state_restore() isn't called from asm (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fix potentially dangerous trailing '; ' in #defined values/expressions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Fix FPU exception handling on non-SSE systems (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Fix common misspellings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: Initialize fpu state in preemptible context (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Rewrite fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove PSHUFB_XMM5_* macros (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove unnecessary ifdefs from i387 code. (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Simplify constraints for fxsave/fxtstor (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Fix cs value in convert_from_fxsr() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Disable preemption when using TS_USEDFPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge __save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge tolerant_fwait() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Disable xsave in i387 emulation mode (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make xstate_enable_boot_cpu() __init, protect on CPU 0 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Add __init attribute to setup_xstate_features() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make init_xstate_buf static (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Check cpuid level for XSTATE_CPUID (0x0d) (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Introduce xstate enable functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Do not include asm/i387.h in asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Avoid unnecessary __clear_user() and xrstor in signal handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Cleanup return codes in check_for_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Separate fpu and xsave initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Move boot cpu initialization to xsave_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: change save_i387_xstate() to rely on unlazy_fpu()" (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: shift clear_used_math() from save_i387_xstate() to handle_signal()" (Paolo Bonzini) [1589047] {CVE-2018-3665}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.2.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1596113] {CVE-2018-10872}
  - [fs] gfs2: Flush delayed work earlier in gfs2_inode_lookup (Andreas Grunbacher) [1506281]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576757] {CVE-2018-10675}
  - [mm] Fix NULL pointer dereference in dequeue_hwpoisoned_huge_page() (Larry Woodman) [1381653]
  - [fs] NFSv4.1: Fix up replays of interrupted requests (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Simplify struct nfs4_sequence_args too (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Label each entry in the session slot tables with its slot number (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Shrink struct nfs4_sequence_res by moving the session pointer (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: nfs4_alloc_slots doesn't need zeroing (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: clean up nfs4_recall_slot to use nfs4_alloc_slots (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Fix a NFSv4.1 session initialisation regression (Benjamin Coddington) [1553423]
  - [scsi] ipr: Fix sync scsi scan (Gustavo Duarte) [1572310]
  - [scsi] ipr: Wait to do async scan until scsi host is initialized (Gustavo Duarte) [1572310]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.19.1.el6]
changelog:
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1732107]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1728931]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.20.1.el6]
changelog:
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.21.1.el6]
changelog:
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712858] {CVE-2019-11810}
  - [net] net: Set sk_prot_creator when copying sockets to the right proto (Andrea Claudi) [1657117] {CVE-2018-9568}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.1.el6]
changelog:
  - [net] ip: Don't leak head fragment on queue timeout (Stefano Brivio) [1752536]
  - [vhost] vhost_net: fix possible infinite loop (Eugenio Perez) [1702941]
  - [vhost] vhost: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: use packet weight for rx handler, too (Eugenio Perez) [1702941]
  - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Eugenio Perez) [1702941]
  - [x86] x86/pti: Fix incorrect global bit setting with PTI on (Waiman Long) [1645724]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Rafael Aquini) [1560787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.2.el6]
changelog:
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.25.1.el6]
changelog:
  - [kvm] KVM: VMX: Set VMENTER_L1D_FLUSH_NOT_REQUIRED if !X86_BUG_L1TF (Waiman Long) [1733760]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746799] {CVE-2019-14821}
  - [virt] KVM: MMIO: Lock coalesced device when checking for available entry (Bandan Das) [1746799] {CVE-2019-14821}
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1749512]
  - [security] KEYS: prevent creating a different user's keyrings (David Howells) [1537371]
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Denys Vlasenko) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.26.1.el6]
changelog:
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1764544]
  - [drm] vmwgfx: refuse to hibernate if we have any resources v2 (Kenneth Yin) [1748195]
  - [fs] CIFS: avoid using MID 0xFFFF (Leif Sahlberg) [1739948]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.27.1.el6]
changelog:
  - [mm] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() (Waiman Long) [1785321]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.28.1.el6]
changelog:
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1795404]
  - [isdn] mISDN: enforce CAP_NET_RAW for raw sockets (Andrea Claudi) [1779473] {CVE-2019-17055}
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778625] {CVE-2019-17133}
  - [netdrv] bonding: speed/duplex update at NETDEV_UP event (Patrick Talbert) [1772779]
  - [netdrv] bonding: make speed, duplex setting consistent with link state (Patrick Talbert) [1772779]
  - [netdrv] bonding: simplify / unify event handling code for 3ad mode (Patrick Talbert) [1772779]
  - [netdrv] bonding: unify all places where actor-oper key needs to be updated (Patrick Talbert) [1772779]
  - [netdrv] bonding: simple code refactor (Patrick Talbert) [1772779]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.29.1.el6]
changelog:
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775226] {CVE-2019-17666}
  - [x86] mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB (Denys Vlasenko) [1485759]
  - binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: Use generic PIE randomization (Denys Vlasenko) [1485759]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.1.el6]
changelog:
  - [infiniband] ib/iser: Rewrite bounce buffer code path (Don Dutile) [1585312]
  - [sound] alsa: pcm: prevent UAF in snd_pcm_info (CVE-2017-0861) (Jaroslav Kysela) [1565188] {CVE-2017-0861}
  - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550176] {CVE-2018-7566}
  - [sound] alsa: seq: Fix use-after-free at creating a port (Jaroslav Kysela) [1503383] {CVE-2017-15265}
  - [sound] alsa: seq: Make ioctls race-free (Jaroslav Kysela) [1537452] {CVE-2018-1000004}
  - [mm] reduce total RAM held in per-CPU pvecs by flushing them on compound/THP page arrival (Larry Woodman) [1575819]
  - [usb] acm: fix the computation of the number of data bits (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner, part 2 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] kvm/vmx: Remove barrier_nospec() in slot_largepage_idx() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kvm] Remove memory alias support (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] posix-timers: Protect posix clock array access against speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [ipc] sysvipc/sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.2.el6]
changelog:
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.3.el6]
changelog:
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.4.el6]
changelog:
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.5.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.1.el6]
changelog:
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827226] {CVE-2020-10711}
  - [netdrv] bonding: don't set slave->link in bond_update_speed_duplex() (Patrick Talbert) [1828604]
  - [security] KEYS: prevent KEYCTL_READ on negative key (Patrick Talbert) [1498368] {CVE-2017-12192}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.2.el6]
changelog:
  - x86/speculation: Provide SRBDS late microcode loading support (Waiman Long)
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.31.1.el6]
changelog:
  - [x86] x86/speculation: Provide SRBDS late microcode loading support (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Patrick Talbert) [1841819]
  - [mm] mm: migration: add migrate_entry_wait_huge() (Waiman Long) [1839653]
  - [powerpc] powerpc/book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Update Spectre v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make stf barrier PPC_BOOK3S_64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Gustavo Duarte) [1796810]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enhance the information in cpu_show_spectre_v1() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Use barrier_nospec in syscall entry (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enable barrier_nospec based on firmware settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Patch barrier_nospec in modules (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for ori barrier_nospec patching (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add barrier_nospec (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Add helper to check if offset is within relative branch range (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Have patch_instruction detect faults (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Introduce asm-prototypes.h (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Move local setup.h declarations to arch includes (Gustavo Duarte) [1796810]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.32.1.el6]
changelog:
  - [wireless] libertas: make lbs_ibss_join_existing() return error code on rates overflow (Jarod Wilson) [1776569]
  - [wireless] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held (Jarod Wilson) [1776569]
  - [wireless] libertas: Fix two buffer overflows at parsing bss descriptor (Jarod Wilson) [1776569]
  - [security] keys: Protect request_key() against a type with no match function (Patrick Talbert) [1433220] {CVE-2017-2647}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.34.1.el6]
changelog:
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705003]
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705003]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.4.1.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.5.1.el6]
changelog:
  - [s390] dasd: fix IO error for newly defined devices (Hendrik Brueckner) [1574448]
  - [s390] dasd: fix failing path verification (Hendrik Brueckner) [1581684]
  - [s390] qeth: on channel error, reject further cmd requests (Hendrik Brueckner) [1562009]
  - [s390] qdio: fix access to uninitialized qdio_q fields (Hendrik Brueckner) [1581685]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1585299]
  - [x86] Add host_initiated check in reading MSR_AMD64_VIRT_SPEC_CTRL (Wei Huang) [1608576]
  - [x86] KVM: pass host_initiated to functions that read MSRs (Wei Huang) [1608576]
  - [fs] gfs2: Special-case rindex for gfs2_grow (Robert S Peterson) [1384184]
  - [fs] Revert "[fs] gfs2: Special case the rindex in gfs2_write_alloc_required()" (Robert S Peterson) [1384184]
  - [net] ip: process in-order fragments efficiently (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: add helpers to process in-order fragments faster. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: use rb trees for IP frag queue. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: discard IPv4 datagrams with overlapping segments. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: modify skb_rbtree_purge to return the truesize of all purged skbs. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: speed up skb_rbtree_purge() (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] skbuff: Rename RHEL6 version of skb_tree_purge() to skb_tree_purge_sk() (Stefano Brivio) [1613925] {CVE-2018-5391}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.1.el6]
changelog:
  - [x86] set __max_smt_threads for 1 core systems (Prarit Bhargava) [1623255]
  - [md] dm rq: fix a race condition in rq_completed() (Ming Lei) [1574568]
  - [scsi] scsi_transport_fc: Hold queue lock while calling blk_run_queue_async() (Ming Lei) [1574568]
  - [block] Avoid scheduling delayed work on a dead queue (Ming Lei) [1574568]
  - [block] Avoid that request_fn is invoked on a dead queue (Ming Lei) [1574568]
  - [block] Let blk_drain_queue() caller obtain the queue lock (Ming Lei) [1574568]
  - [block] Rename queue dead flag (Ming Lei) [1574568]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.2.el6]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-754.6.3.el6]
changelog:
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]


author: Stephan Wiesand <stephan wiesand desy de> 1.6.17-234.SLx
changelog:
  - update to release 1.6.17 (security release)
  - install service unit files with mode 644, not 755 (rt.central.org #132662)


author: Stephan Wiesand <stephan wiesand desy de> 1.6.20-256.SLx
changelog:
  - update to security release 1.6.20
  - added RemainAfterExit=true in afs.service, to fix the case where only
    kernel threads remain after the client has started


author: Stephan Wiesand <stephan wiesand desy de> 1.6.23-289.SLx
changelog:
  - update to release 1.6.23 (security release)
  - addresses OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, OPENAFS-SA-2018-003


author: Stephan Wiesand <stephan wiesand desy de> 1.6.24-290.SLx
changelog:
  - update to release 1.6.24 (security release)
  - addresses OPENAFS-SA-2019-001, OPENAFS-SA-2019-002, OPENAFS-SA-2019-003
  - fix build on EL 6.10


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-36
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1454804


author: Tomas Hozza <thozza@redhat.com> - 1.6.16-7.1
changelog:
  - port the rhel-7 package version to rhel-6
  - enabled ECDSA due to Unbound
  - Fix issue in DSA algorithm (#1077799)


author: Richard Hughes <rhughes@redhat.com> - 0.6.21-5
changelog:
  - Update to version 0.6.21 fixing many bugs and CVEs
  - Remove upstreamed patches
  - Resolves: #839916


author: Kamil Dudka <kdudka@redhat.com> - 1.4.2-3.el6_10.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-63
changelog:
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64
changelog:
  - cpu: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64.el6_10.1
changelog:
  - cpu_x86: Do not cache microcode version (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.25
changelog:
  - Update Intel CPU microcode to microcode-20200520 release (#1839193):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.26
changelog:
  - Update Intel CPU microcode to microcode-20200602 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795353, #1795357, #1827186):
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.29
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826590):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.30
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.31
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893243, #1893238):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode (in microcode.dat)
      at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      microcode.dat) at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode (in microcode.dat)
      at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode (in
      microcode.dat) at revision 0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      microcode-06-4e-03.dat) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      microcode-06-55-04.dat) from revision 0x2006906 up to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      microcode-06-5e-03.dat) from revision 0xdc up to 0xe2;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      (in microcode.dat) from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode (in microcode.dat)
      from revision 0x1000157 up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode (in microcode.dat)
      from revision 0x4002f01 up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode (in
      microcode.dat) from revision 0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode (in microcode.dat) from
      revision 0x38 up to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode (in microcode.dat)
      from revision 0x16 up to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode (in microcode.dat)
      from revision 0x16 up to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode (in microcode.dat)
      from revision 0x78 up to 0xa0;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in microcode.dat)
      from revision 0xd6 up to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      microcode.dat) from revision 0xd6 up to 0xde;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode (in microcode.dat)
      from revision 0xca up to 0xe0.


author: Petr Pisar <ppisar@redhat.com> - 2.0.4-12
changelog:
  - Fix CVE-2011-2767 (arbitrary Perl code execution in the context of the user
    account via a user-owned .htaccess) (bug #1626272)


author: Jan Pacner <jpacner@redhat.com> - 5:1.5.20-5.20091214hg736b6a
changelog:
  - Resolves: #1083524 (segmentation fault when sending an e-mail from a command
    line)
  - Resolves: #750929 (SIGSEGV Crash while parsing certificates file)
  - Resolves: #690409 (mutt crash; seg fault in mx_update_context)
  - Resolves: #674271 (SIGSEGV when browsing pop account)


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.20-8.20091214hg736b6a
changelog:
  - Resolves #1196787 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1212646 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200920 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269361 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297891 - Rebase RHEL 6.8 to NSPR 4.11 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Rebase to NSS 3.36.0 BETA
  - Remove upstreamed nss-is-token-present-race.patch
  - Revert the upstream changes that default to sql database


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Use the correct tarball of NSS 3.36 release
  - Ignore EncryptDeriveTest which only works with newer nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-5
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-9
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.26.0
  - Remove upstreamed patch for CVE-2016-1950
  - Remove p-disable-md5-590364-reversed.patch for bug 1335915


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-4
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1788447


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-122
changelog:
  - Allow to use ibmca crypto hardware (#1397547)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (1405374)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-49
changelog:
  - fix php-soap fails to connect to HTTPS web service sporadically
    as stream_socket_enable_crypto() uses NONBLOCK #1283153


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server mode
    (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 1.10: https://gist.github.com/stevebeattie/0eb190004e10ba0926ad8782f89676ad
    Resolves #1557140


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-4
changelog:
  - Fix and enable tests (%check).
  - Backport a change which makes tests exit with nonzero status when they fail.
  - Add a fix for upstream tests for CVE-2018-7750 (broken in previous).


author: Marek Kasik <mkasik@redhat.com> - 2.3-3
changelog:
  - Add -fno-strict-aliasing to pass "Testsuite regressions" test
  - Make docs subpackage "noarch"
  - Resolves: #605103


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.0-2
changelog:
  - Remove bundled directories altogether, requests are smart enough
    to import system modules, fixes a problem with updating requests
    from 2.3.0
  Resolves: rhbz#1212145


author: Charalampos Stratakis <cstratak@redhat.com> - 2.6.0-4
changelog:
  - Ensure that urllib3.connection module is imported only once so connections
    to HTTPS servers that require SNI support do not fail
  Resolves: rhbz#1382682


author: Lumír Balhar <lbalhar@redhat.com> - 8.2.0-7
changelog:
  - Fix CVE-2020-10108 HTTP request smuggling when presented with two Content-Length headers
  Resolves: rhbz#1813439
  - Remove useless macros definitions


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.498.el6
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1392520]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1392520]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1392520]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1392520]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1392520]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1392520]
  - kvm-PATCH-1-4-e1000-pre-initialize-RAH-RAL-registers.patch [bz#1300626]
  - kvm-net-update-nic-info-during-device-reset.patch [bz#1300626]
  - kvm-net-e1000-update-network-information-when-macaddr-is.patch [bz#1300626]
  - kvm-net-rtl8139-update-network-information-when-macaddr-.patch [bz#1300626]
  - Resolves: bz#1300626
    (e1000/rtl8139: qemu mac address can not be changed via set the hardware address in guest)
  - Resolves: bz#1392520
    ([RHEL6.9] KVM guest shuts itself down after 128th reboot)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.499.el6
changelog:
  - kvm-rename-qemu_aio_context-to-match-upstream.patch [bz#876993]
  - kvm-block-stop-relying-on-io_flush-in-bdrv_drain_all.patch [bz#876993]
  - kvm-block-add-bdrv_drain.patch [bz#876993]
  - kvm-block-avoid-very-long-pauses-at-the-end-of-mirroring.patch [bz#876993]
  - Resolves: bz#876993
    (qemu-kvm: vm's become non-responsive during migrate disk load from 2 domains to a 3ed)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.500.el6
changelog:
  - kvm-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Disable-086.patch [bz#1405882]
  - kvm-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-iotests-Use-_img_info.patch [bz#1405882]
  - Resolves: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.501.el6
changelog:
  - kvm-Revert-iotests-Use-_img_info.patch [bz#1405882]
  - kvm-Revert-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-Revert-iotests-Disable-086.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-Revert-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-Revert-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-net-check-packet-payload-length.patch [bz#1398214]
  - Resolves: bz#1398214
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-6.9])
  - Reverts: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.502.el6
changelog:
  - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop.patch [bz#1418231 bz#1419417]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418231 bz#1419417]
  - Resolves: bz#1418231
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])
  - Resolves: bz#1419417
    (CVE-2017-2615 qemu-kvm-rhev: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420487 bz#1420489]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420487 bz#1420489]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420487 bz#1420489]
  - Resolves: bz#1420487
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])
  - Resolves: bz#1420489
    (EMBARGOED CVE-2017-2620 qemu-kvm-rhev: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.504.el6
changelog:
  - kvm-vns-tls-don-t-use-depricated-gnutls-functions.patch [bz#1428750]
  - kvm-vnc-apply-display-size-limits.patch [bz#1430616 bz#1430617]
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1443448 bz#1443450]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1443448 bz#1443450 bz#1447542 bz#1447545]
  - kvm-cirrus-avoid-write-only-variables.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-PUTPIXEL-macro.patch [bz#1444378 bz#1444380]
  - Resolves: bz#1428750
    (Fails to build in brew)
  - Resolves: bz#1430616
    (CVE-2017-2633 qemu-kvm: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1430617
    (CVE-2017-2633 qemu-kvm-rhev: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1443448
    (CVE-2017-7718 qemu-kvm: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1443450
    (CVE-2017-7718 qemu-kvm-rhev: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1444378
    (CVE-2017-7980 qemu-kvm: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1444380
    (CVE-2017-7980 qemu-kvm-rhev: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1447542
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])
  - Resolves: bz#1447545
    (CVE-2016-9603 qemu-kvm-rhev: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.505.el6
changelog:
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501298]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1486641]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534692]
  - Resolves: bz#1486641
    (CVE-2017-13672 qemu-kvm-rhev: Qemu: vga: OOB read access during display update [rhel-6.10])
  - Resolves: bz#1501298
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-6.10])
  - Resolves: bz#1525939
    (CVE-2017-5715 qemu-kvm: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1528024
    (CVE-2017-5715 qemu-kvm-rhev: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1534692
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-6.10])
  - Resolves: bz#1549152
    (qemu-kvm-rhev: remove unused patch file [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6
changelog:
  - kvm-vga-add-share_surface-flag.patch [bz#1553674]
  - kvm-vga-add-sanity-checks.patch [bz#1553674]
  - Resolves: bz#1553674
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.1
changelog:
  - qemu-kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574074]
  - qemu-kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1574074]
  - qemu-kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1574074]
  - Resolves: bz#1574074
    (CVE-2018-3639 qemu-kvm: hw: cpu: speculative store bypass [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.3
changelog:
  - kvm-target-i386-define-md-clear-bit.patch [bz#1698996]
  - Resolves: bz#1698996
    (CVE-2018-12130 qemu-kvm: hardware: MFBDS)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.4
changelog:
  - kvm-target-i386-Sanitize-the-XSAVE-related-feature-bits.patch [bz#1673779]
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1689790]
  - Resolves: bz#1673779
    (RHEL8 VM's do not install on RHEL6 KVM hypervisor)
  - Resolves: bz#1689790
    (CVE-2019-9824 qemu-kvm: QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.5
changelog:
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669066]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669066]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669066]
  - kvm-qxl-check-release-info-object.patch [bz#1712728]
  - kvm-net-Use-iov-helper-functions.patch [bz#1636415]
  - kvm-net-increase-buffer-size-to-accommodate-Jumbo-frame-.patch [bz#1636415]
  - kvm-net-ignore-packet-size-greater-than-INT_MAX.patch [bz#1636415]
  - kvm-net-drop-too-large-packet-early.patch [bz#1636415]
  - kvm-PATCH-slirp-fix-buffer-overrun.patch [bz#1586251]
  - kvm-Fix-build-from-previous-commit.patch [bz#1586251]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586251]
  - kvm-slirp-Convert-mbufs-to-use-g_malloc-and-g_free.patch [bz#1586251]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586251]
  - kvm-pcnet-fix-possible-buffer-overflow.patch [bz#1636774]
  - Resolves: bz#1586251
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-6.10.z])
  - Resolves: bz#1636415
    (CVE-2018-10839 qemu-kvm: Qemu: ne2000: integer overflow leads to buffer overflow issue [rhel-6])
  - Resolves: bz#1636774
    (CVE-2018-17962 qemu-kvm: Qemu: pcnet: integer overflow leads to buffer overflow [rhel-6])
  - Resolves: bz#1669066
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-6.10.z])
  - Resolves: bz#1712728
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.6
changelog:
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734747]
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749731]
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791558]
  - Resolves: bz#1734747
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-6.10.z])
  - Resolves: bz#1749731
    (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-6])
  - Resolves: bz#1791558
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-6.10.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.7
changelog:
  - kvm-slirp-disable-tcp_emu.patch [bz#1791680]
  - kvm-slirp-add-slirp_fmt-helpers.patch [bz#1798966]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798966]
  - Resolves: bz#1791680
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-6])
  - Resolves: bz#1798966
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.8
changelog:
  - kvm-qemu-kvm-QEMU-usb-check-RNDIS-message-length.patch [bz#1869684]
  - kvm-qemu-kvm-QEMU-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869684]
  - Resolves: bz#1869684
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-6.10.z])


author: Troy Dawson <dawson@fnal.gov> 6-2.sl6.3
changelog:
  - Fixed more minor typo's
  - de-DE translation provided by Christoph Galuschka
  - ja-JP translation provided by Tomoya Inoue
  - fr-FR translation provided by Manuel Wolfshant and Fabian Arrotin


author: Troy Dawson <dawson@fnal.gov> 6-2.sl6.4
changelog:
  - Fixed index.html page that was not localized.
  - Set "border: none" on the SL banner.
  - sv-SE translation provided by Alexander Lindqvist


author: Troy Dawson <dawson@fnal.gov> 6-2.sl6.5
changelog:
  - es-ES translation provided by Joseph Marrero
  - hu-HU translation provided by Laszlo Dvornik
  - ru-RU translation provided by Linux Ink


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-2
changelog:
  - Add -Wl,-z,relro to the linker flags in order to fix a rpmdiff
    error. These flags used to be provided indirectly by openssl, and after
    openssl stopped exporting them, they were added by
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch
    which was dropped during the rebase
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-3
changelog:
  - Add -Wl,-z,now as well to the link flags.  This flag was present in
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch, and
    pkgwrangler still complains about:
    File /usr/lib/libspice-client-glib-2.0.so.8.5.0 lost GNU_RELRO security
    protection on i686
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-4
changelog:
  - Fix smartcard issues after VM restart (virsh destroy/virsh start)
    Resolves: rhbz#1205171
  - Remove obsolete patches
    Related: rhbz#1185434


author: Fabiano Fidêncio <fidencio@redhat.com> 0.26-5
changelog:
  - Connecting to VM changes its resolution
    Resolves: rhbz#1242605
  - Cannot enable display 1 when it was disabled in previous session
    Resolves: rhbz#1247920
  - Windows needs to send complete monitors_config message to client
    Resolves: rhbz#1265361
  - Add Client capability for windows monitor_config messsage
    Resolves: rhbz#1265359
  - High Resolution Multi-Monitor Windows Guest freeze
    Resolves: rhbz#1247749
  - Drop isoc packages on low bandwith
    Resolves: rhbz#1276707


author: Pavel Grunt <pgrunt@redhat.com> 0.26-8
changelog:
  - Make grab session related
    Resolves: rhbz#1330652
  - Improve messages in usb redirection dialog
    Resolves: rhbz#1298772
  - Use proxy only when needed
    Resolves: rhbz#1306311


author: Victor Toso <victortoso@redhat.com> 0.14.0-12
changelog:
  - Do not allow file-transfer on locked session
    Resolves: rhbz#1323630
  - Do not allow file-transfer on login screen
    Resolves: rhbz#1323640


author: Michal Sekletar <msekleta@redhat.com> 1:0.17-48
changelog:
  - reuse utmp entries correctly
  - break out from infinite loop if we tried to bind to non-existing address (#772912)
  - mitigate possibility of self-deadlock while updating utmp or wtmp (#832059)


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-112
changelog:
  - Resolves: rhbz#1806803 CVE-2020-1938 tomcat6: tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-115
changelog:
  - Resolves: CVE-2020-9484 tomcat6: tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-4
changelog:
  - Brazil moved the start of DST from the first Sunday in November
    to the third Sunday in November.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-27.1
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-28.1
changelog:
  - Fix unbound-1.4.20-amplifying-an-incoming-query.patch patch so it won't produce compiler warnings
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-29.1
changelog:
  - Fix segfault in unbound-1.4.20-amplifying-an-incoming-query.patch
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Hans de Goede <hdegoede@redhat.com> - 0.4.3-1
changelog:
  - Update to upstream 0.4.3 release
  - Don't crash on devices in unconfigured state
  - Resolves: rhbz#808758
  - Significantly speed up reset handling
  - Resolves: rhbz#808730


author: Hans de Goede <hdegoede@redhat.com> - 0.5.1-1
changelog:
  - Update to upstream 0.5.1 release
  - Resolves: rhbz#842356
  - Remove bulk packets time out, this fixes various devices not working
  - Resolves: rhbz#834560
  - Add support to libusbredirparser for state serialization
  - Resolves: rhbz#842316
  - Drop isochronous packets when the network is too slow to keep up
  - Resolves: rhbz#855737


author: Hans de Goede <hdegoede@redhat.com> - 0.5.1-2
changelog:
  - Add upstream patch to fix usbredirparser headerlen bug when talking to
    the standalone usbredirserver
  - Resolves: rhbz#1085318
  - Add upstream patch with do-not-reset-device-blacklist
  - Extend blacklist with 2798:0001
  - Resolves: rhbz#1115917


author: Victor Toso <victortoso@redhat.com> - 0.5.1-3
changelog:
  - Add downstream patch which includes a new callback for usbredir
    clients in order to drop isoc packets if client buffer is too big
  - Add downstream patch defining USBREDIR_VERSION so applications can
    test against which version they are building
  - Resolves: rhbz#1290749


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-5.2
changelog:
  - 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline
  - fix spec warnings about expanding macros


author: Michel Dänzer <mdaenzer@redhat.com> - 1.17.4-18
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872388), CVE-2020-14346 (#1872392),
    CVE-2020-14361 (#1872399), CVE-2020-14362 (#1872406)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: xorg-x11-server.ini
  -->  Config file for automated patch script
  - Added Source: xorg-x11-server-SPEC-remove-TUV.patch
  -->  Redirect support requests to SL


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-33
changelog:
  - Fix yum-security manpage.
  - Resolves: bug#865694
  - Resolves: bug#1208155
  - Add libxml2-python to Requires for repo-rss.
  - Resolves: bug#1155093
  - yumdownloader: fix description of --archlist in the manpage.
  - Resolves: bug#1165661
  - Add missing options to reposync manpage.
  - Resolves: bug#1189033
  - Exclude dups from the list of security updates.
  - Resolves: bug#1209212
  - yum-config-manager: update config file specified using -c option.
  - Resolves: bug#1225753
  - yum-config-manager: require \* syntax to disable all repos.
  - Resolves: bug#1225754
  - Remove -v from repoquery man page.
  - Resolves: bug#1285748


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-34
changelog:
  - Fix 'updateinfo list available' logic and make 'updates' the default.
  - Resolves: bug#1144887
  - Fix updateinfo to exclude wrong arch updates.
  - Resolves: bug#1191313


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-36
changelog:
  - Fix performance issue when excluding dups from the list of security updates.
  - Related: bug#1209212


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-38
changelog:
  - Fix count of applicable security updates.
  - Resolves: bug#1347813
  - auto-update-debuginfo: fix check for repos in opts.
  - Resolves: bug#1293982
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1313574
  - repoquery: fix --pkgnarrow=installed.
  - Resolves: bug#1280453


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-39
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1272025
  - Update yum-verify man page.
  - Related: bug#1347813


