# changelog

author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
- Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
- Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
- Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
- Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 0:7.0.76-16.tuxcare.els3
changelog:
- CVE-2025-24813: fix path equivalence vulnerability leading to remote code
  execution and information disclosure


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
- Rebase to tzdata-2022d
  - Palestine's DST transition will be on October 29, 2022,
    not October 28, 2022.
  - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
- Rebase to tzdata-2022e
  - Jordan and Syria cancelled the DST transition planned
    for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
- Rebase to tzdata-2022f
  - Mexico will stop observing DST except near the US border.
  - Chihuahua moved to -06 year round starting on 2022-10-30.
  - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
- Rebase to tzdata-2022g
  - The northern edge of the Mexican state of Chihuahua will
    change time zone to agree with nearby US locations on
    2022-11-30.
  - Added a new Zone America/Ciudad_Juarez that splits from
    America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
- Rebase to tzdata-2023a
  - Egypt reintroduced DST, from April through October.
  - Morocco springs forward April 23, not April 30.
  - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
- Rebase to tzdata-2023d
  - Include time zone changes for Ittoqqortoormiit, Greenland
    and Vostok, Antarctica.
  - Update the expiration date for the leap-seconds.list file.
    No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
- Rebase to tzdata-2024a
  - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
  - Palestine will spring forward a week later than previously
    predicted.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2025b-1.tuxcare.els1
changelog:
- Upgrade to tzdata-2025b
  - New zone for Aysén Region in Chile which moves from -04/-03 to -03.
  - Paraguay adopted permanent -03 starting spring 2024.
  - Improve pre-1991 data for the Philippines.
  - Etc/Unknown is now reserved.
  - Improve historical data for Mexico, Mongolia, and Portugal.
  - System V names are now obsolescent.
  - The main data form now uses %z.
  - The code now conforms to RFC 8536 for early timestamps.
  - Support POSIX.1-2024, which removes asctime_r and ctime_r.
  - Assume POSIX.2-1992 or later for shell scripts.
  - SUPPORT_C89 now defaults to 1.
- Include leap-seconds.list in tzdata install.


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
- Rebase to 1.6.6
- Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
- Enable ipsecmod support


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
- Do not search for DNSSEC info when domain-insecure is set
  for stub zone (#1678550)
- Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
- Fix amplifying an incoming query into a large number of queries directed to a target
- Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: Nikita Maliutin <nmaliutin@cloudlinux.com> - 1.6.6-5.tuxcare.els1
changelog:
- CVE-2023-50387: enhanced DNS resolver performance and stability by optimizing
  the handling of DNSSEC responses, reducing the potential for resource exhaustion


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1.6.6-5.tuxcare.els3
changelog:
- CVE-2023-50868: avoid availabiluty of the remote attackers to cause a
  denial of service using DNSSEC


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
- Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
  Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
- Added patch for build option "-Werror=format-security"
- Added support of non-unicode non-latin charset
- Fix print of non-ascii filenames
- Fix troubles with symlinks for archives with many files
  Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
- rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
- make linking flags configurable from the specc file
- set linking flags to use relro hardening
  Related: #1531116


author: Jakub Martisko <jamartis@redhat.com> - 6.0-23
changelog:
- Disable the zipbomb detection patches
- There were too many false positives for now, will reenable this later with an option to opt-out
- Resolves: rhbz#2020318


author: Jakub Martisko <jamartis@redhat.com> - 6.0-24
changelog:
- Reenable the zipbomb detection patches
- Add environment variable that disables the zipbomb detection
- Resolves: rhbz#2020318


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
- 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
- 1267826 - Include c++11 syntax highlighting in vim
- 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
- 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
- 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> 2:7.4.629-8.tuxcare.els1
changelog:
- CVE-2023-0054: check the return value of vim_regsub()
- CVE-2023-0049: avoid going over the NUL at the end
- CVE-2023-0288: prevent the cursor from moving to line zero
- CVE-2023-0433: check for not going over the end of the line
- CVE-2023-2610: limit the text length to MAXCOL
- CVE-2023-4750: check buffer is valid before accessing it
- CVE-2023-4733: verify oldwin pointer after reset_VIsual()
- CVE-2023-4751: stop Visual mode when using :ball
- CVE-2023-5344: add NULL at end of buffer
- CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
- Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
- Run internal test suite during build (#1295846)
- Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
- Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
- Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
- CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
  CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
  CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
- CVE fix for: CVE-2023-6377, CVE-2023-6478
  Resolves: https://issues.redhat.com/browse/RHEL-18416
  Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
- CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
  CVE-2024-0408 and CVE-2024-0409
  Resolves: https://issues.redhat.com/browse/RHEL-21205
  Resolves: https://issues.redhat.com/browse/RHEL-20578
  Resolves: https://issues.redhat.com/browse/RHEL-20426
  Resolves: https://issues.redhat.com/browse/RHEL-20437
  Resolves: https://issues.redhat.com/browse/RHEL-21192
  Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
- CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
  CVE-2024-31083
  Resolves: https://issues.redhat.com/browse/RHEL-31003
  Resolves: https://issues.redhat.com/browse/RHEL-30989
  Resolves: https://issues.redhat.com/browse/RHEL-30973
- Add util-linux as a dependency of Xvfb
- Fix compilation error on i686


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.20.4-99.tuxcare.els1
changelog:
- CVE-2025-26594: refuse to free the root cursor and keep its ref
- CVE-2025-26595: fix buffer overflow in XkbVModMaskText()
- CVE-2025-26596: xkb: fix computation of XkbSizeKeySyms
- CVE-2025-26597: xkb: fix buffer overflow in XkbChangeTypesOfKey()
- CVE-2025-26598: Xi: Fix barrier device search
- CVE-2025-26599: always initialize the border clip in compAllocPixmap()
- CVE-2025-26600: dix: Dequeue pending events on frozen device on removal
- CVE-2025-26601: postpone actual changes in SyncChangeAlarmAttributes()


