# changelog

author: Travis Kendrick <pouar@pouar.net> - 0.6.0-3
changelog:
  - wrong directory for ctest
  - LICENSE not needed in -devel
  - fix "spurious-executable-perm"
  - rpmbuild does the cleaning for us, so 'rm -rf %{buildroot}' isn't needed


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
  - prevent curl --rate-limit from hanging on file URLs (#1281969)
  - fix NTLM password overflow via integer overflow (CVE-2018-14618)
  - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
  - backport options to force TLS 1.3 in curl and libcurl (#1672639)
  - prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Petr Stodulka <pstodulk@redhat.com> - 1.8.3.1-13
changelog:
  - fall back to Basic auth if Negotiate fails
    Resolves: #1490998
  - handle request-pull when multiple tags point to the same commit
    Resolves: #1192146


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
  - Backport fix for CVE-2018-11235
  - Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-15
changelog:
  - move instaweb to separate git-instaweb subpackage.
  	Resolves: #1213059
  - move gnome-keyring to a separate git-gnome-keyring subpackage.
  	Resolves: #1284081


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-16
changelog:
  - Remove EL-5 settings and old Fedora conditionals.
    Taken from fedora commits 903d8f35ed8ae16bece8ae8033f3d3926cc97595 and
    2c6eff99d7b50b87e8a1fe2e4a0489dfd90659b8.
  - Fix builds using '--without docs'
  - Change git-instaweb default from lighttpd(not available in rhel7) to
    apache2.
  - Add requires for git-{instaweb,gnome-keyring} to pull them, when
    installing git-all.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-17
changelog:
  - Correctly return an error from fsck on encountering a .gitmodules symlink.
    This was broken in the debian 2.1.x backport and found by covscan.
    Fix the test to catch this.
  - Correct a typo in changelog.


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
  - Fix httpd modules path to be independent from system architecture.
  Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
  Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
  - Fix CVE-2018-17456: arbitrary code execution via .gitmodules
    Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Fabiano Fidêncio <fidencio@redhat.com> - 2.7.1-5
changelog:
  - Bump http-parser release number to avoid people pulling EPEL package instead
    of RHEL package
    Resolves: rhbz#1479471


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-6
changelog:
  - Resolves: rhbz#1666381 - CVE-2018-12121 http-parser: nodejs: Denial of
                             Service with large HTTP headers [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-7
changelog:
  - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                             allowed for spaces inside Content-Length header
                             values [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-8
changelog:
  - Backport needed test fixes
  - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-7]


author: Sergio Corrreia <scorreia@redhat.com> - 2.7.1-8.1
changelog:
  - Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
                             smuggling using malformed Transfer-Encoding header


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 3.5.1-1
changelog:
  - New upstream release
  - Updated nopprof patch to match new release
  - Fixed a few bogus changelog entries


author: Tim Powers <timp@redhat.com>
changelog:
  - changelog started
  - general cleanups, changed prefix to /usr, added manpage to files section
  - including in Powertools


author: pjp <pjp@fedoraproject.org> - r128-1
changelog:
  - lz4cli sparse file support
  - Restored lz4hc compression ratio
  - lz4 cli supports long commands
  - Introduced lz4-static sub package BZ#1208203


author: pjp <pjp@fedoraproject.org> - r129-1
changelog:
  - New LZ4_compress_fast() API.
  - New LZ4 CLI improved performance with multiple files.
  - Other bug fix and documentation updates.


author: pjp <pjp@fedoraproject.org> - r130-1
changelog:
  - Fixed: incompatibility sparse mode vs console.
  - Fixed: LZ4IO exits too early when frame crc not present.
  - Fixed: incompatibility sparse mode vs append mode.
  - Performance fix: big compression speed boost for clang(+30%).


author: pjp <pjp@fedoraproject.org> - r131-1
changelog:
  - New: Dos/DJGPP target #114.
  - Added: Example using lz4frame library #118.
  - Changed: liblz4.a no longer compiled with -fPIC by default.


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.12.2-1
changelog:
  - update to upstream release 1.12.2
  - Resolves: #1468584 - (CVE-2017-7529) CVE-2017-7529 nginx: Integer
    overflow in nginx range filter module leading to memory disclosure


author: Remi Collet <remi@remirepo.net> - 5.5.38-4
changelog:
  - fix #73189: Memcpy negative size parameter php_resolve_path
  - fix #72581: previous property undefined in Exception after deserialization
  - fix #73147: Use After Free in unserialize
    CVE-2016-9137
  - fix #73190: memcpy negative parameter _bc_new_num_ex
  - fix #73150: missing NULL check in dom_document_save_html
  - fix #73284: heap overflow in php_ereg_replace function
  - fix #73073: CachingIterator null dereference when convert to string
  - fix #73218: add mitigation for ICU int overflow
  - fix #73208: integer overflow in imap_8bit caused heap corruption
  - fix #73082: string length overflow in mb_encode_* function
  - fix #73174: heap overflow in php_pcre_replace_impl
  - fix #73275: crash in openssl_encrypt function
  - fix #73293: NULL pointer dereference in SimpleXMLElement::asXML
  - fix #73240: Write out of bounds at number_format
  - fix #73017: memory corruption in wordwrap function


author: Remi Collet <remi@remirepo.net> - 5.5.38-5
changelog:
  - fix #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
  - fix #73144: Use-after-free in ArrayObject Deserialization
  - fix #73356: crash in bzcompress function
  - fix #73331: NULL Pointer Deref. in WDDX Packet Deserialization with PDORow
    CVE-2016-9934


author: Remi Collet <remi@remirepo.net> - 5.5.38-7
changelog:
  - fix #73737: FPE when parsing a tag format
    CVE-2016-10158
  - fix #73764: int overflows in phar
    CVE-2016-10159
  - fix #73768: Memory corruption when loading hostile phar
    CVE-2016-10160
  - fix #69090: check cached files permissions


author: Remi Collet <remi@remirepo.net> - 5.5.38-8
changelog:
  - fix #73549: Use after free when stream is passed to imagepng
  - fix #75981: stack-buffer-overflow while parsing HTTP response


author: Remi Collet <remi@remirepo.net> - 5.5.38-10
changelog:
  - Fix #77231 Segfault when using convert.quoted-printable-encode filter
  - Fix #77020 null pointer dereference in imap_mail
    CVE-2018-19935
  - Fix #77153 imap_open allows to run arbitrary shell commands via
    mailbox parameter
    CVE-2018-19158


author: Remi Collet <remi@remirepo.net> - 5.5.38-11
changelog:
  - Fix #77242 heap out of bounds read in xmlrpc_decode
  - Fix #77380 Global out of bounds read in xmlrpc base64 code


