# changelog

author: Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-8
changelog:
  - Resolves: rhbz#2134759 Untrusted Macros
  - Resolves: rhbz#2134757 Weak Master Keys
  - Resolves: rhbz#2134755 Static Initialization Vector
  - Resolves: rhbz#2134761 Macro URL arbitrary script execution


author: haomimi <haomimi@uniontech.com> - 1:7.1.8.1-8.0.1.03
changelog:
  - fix: fix menu display issue of arm architecture libreoffice related software (bugid:184789)
  - spec: modify aarch64 off serverconfig


author: Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11.0.1
changelog:
  - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-4
changelog:
  - Tighten cache protection against record from forwarders (CVE-2021-25220)
  - Include test of forwarders


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-5
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: yangxianzhao <yangxianzhao@uniontech.com> - 32:9.11.36-5.3
changelog:
  - fix: Delete other distribution identities in version(bugid:166379)
  - fix: delete empty link(bugid:123783)


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.151
changelog:
  - Revert "x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise"
  - Revert "x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area"
  - Revert "x86/hw_breakpoint: Add within_area() to check data breakpoints"
  - Revert "x86/hw_breakpoint: Prevent data breakpoints on direct GDT"
  - Revert "x86/mm: Randomize per-cpu entry area"


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.2
changelog:
  * Wed Jun 14 2023 daifan <daifan@uniontech.com> - 4.19.0-91.152.1
  - (CVE-2023-2985)fs: hfsplus: fix UAF issue in hfsplus_put_super
  - (CVE-2023-34256)ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.3
changelog:
  - UOS: Modify the CONFIG_SND_ALOOP configuration to Y
  - (CVE-2023-3161)fbcon: Check font dimension limits
  - (CVE-2023-3220)drm/msm/dpu: Add check for pstates
  - (CVE-2023-3358)HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - (CVE-2023-3090)ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - (CVE-2023-3338)Linux Kernel NULL Pointer Dereference in DECnet
  - (CVE-2023-3141)memstick: r592: Fix UAF bug in r592_remove due to race condition
  - (CVE-2023-3111)btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
  - (CVE-2023-3111-pre)btrfs: check return value of btrfs_commit_transaction in relocation
  - (CVE-2023-3268)relayfs: fix out-of-bounds access in relay_file_read
  - (CVE-2023-3268-pre)kernel/relay.c: fix read_pos error when multiple readers
  - (CVE-2023-35788)net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
  - (CVE-2023-35823)media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - (CVE-2023-35824)media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - (CVE-2023-35828)usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.4
changelog:
  - UOS:Zhaoxin:sata/xhci: disable 64bit dma support on some zhaoxin's sata/xhci controller
  - UOS: Compile st_gmac and IGB network card drivers to kernel modules
  - UOS: inspur: Fixing CS5280H legacy mode automatic reboot during shutdown
  - UOS: radeon:Refactoring submitted 1998e6355fa8 to add architectural distinction to the code introduced by Loongson
  - UOS: fix var compile error
  - UOS: Fix possible kernel panic on FT2000 when loading crct10dif-ce module
  - UOS: loongarch: Support for crash parsing kernel


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.5
changelog:
  - uos: Increased NR_CPUS to resolve hardware detection errors in loongarch [B211173]
  - uos: kabi: only run check_kabi.sh


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.6
changelog:
  - stable: {CVE-2023-20593} x86/cpu/amd: Add a Zenbleed fix
  - stable: x86/microcode/AMD: Add a @cpu parameter to the reloading functions
  - uos: kabi: update loongarch Module.kabi_loongarch64


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.7
changelog:
  - stable: {CVE-2023-34319} xen/netback: Fix buffer overrun triggered by unusual packet [T282039]
  - uos: qxl: adapt io map cache policy in arm64 for qxl
  - uos: qxl: Resolve qxl driver initialization failure issue


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.10
changelog:
  - uos: fix CVE-2022-40982 patch kabi problem [T282039]
  - anolis: virtio_blk: fix the discard_granularity and discard_alignment queue limits
  - anolis: virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
  - anolis: ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline
  - anolis: ext4: reduce computation of overhead during resize
  - anolis: erofs: fix misbehavior of unsupported chunk format check
  - anolis: iomap: Support inline data with block size < page size
  - anolis: iomap: support reading inline data from non-zero pos
  - anolis: iomap: Don't create iomap_page objects for inline files
  - anolis: selinux: fix race condition when computing ocontext SIDs
  - anolis: isolcpus: Affine unbound kernel threads to housekeeping cpus
  - anolis: kthread: Switch to cpu_possible_mask
  - Merge changes from topic "merge-anolis-419-27-update" into 1060a-152-lts
  - Merge "anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()"" into 1060a-152-lts
  - Merge "anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command" into 1060a-152-lts
  - Merge "stable: {CVE-2023-35001} netfilter: nf_tables: prevent OOB access in nft_byteorder_eval [T282039]" into 1060a-152-lts
  - Merge "euler: {CVE-2023-3117} netfilter: nf_tables: unbind non-anonymous set if rule construction fails [T282039]" into 1060a-152-lts
  - Merge "euler: {CVE-2023-3117} netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain [T282039]" into 1060a-152-lts
  - Merge "euler: {CVE-2023-3117} netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3212} gfs2: Don't deref jdesc in evict [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-1206} tcp: Reduce chance of collisions in inet6_hashfn(). [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3609} net/sched: cls_u32: Fix reference counter leak leading to overflow [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3611} net/sched: sch_qfq: account for stab overhead in qfq_enqueue [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3776} net/sched: cls_fw: Fix improper refcount update leads to use-after-free [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4128} net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4128} net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4132} media: usb: siano: Fix warning due to null work_func_t function pointer [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4132} media: usb: siano: Fix use after free bugs caused by do_submit_urb [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-40283} Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb [T282039]" into 1060a-152-lts
  - stable: {CVE-2022-40982} Documentation/x86: Fix backwards on/off logic about YMM support [T282039]
  - stable: {CVE-2022-40982} x86/xen: Fix secondary processors' FPU initialization [T282039]
  - stable: {CVE-2022-40982} KVM: Add GDS_NO support to KVM [T282039]
  - stable: {CVE-2022-40982} x86/speculation: Add Kconfig option for GDS [T282039]
  - stable: {CVE-2022-40982} x86/speculation: Add force option to GDS mitigation [T282039]
  - stable: {CVE-2022-40982} x86/speculation: Add Gather Data Sampling mitigation [T282039]
  - stable: {CVE-2022-40982} x86/fpu: Move FPU initialization into arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} x86/fpu: Mark init functions __init [T282039]
  - stable: {CVE-2022-40982} x86/fpu: Remove cpuinfo argument from init functions [T282039]
  - stable: {CVE-2022-40982} init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} init: Invoke arch_cpu_finalize_init() earlier [T282039]
  - stable: {CVE-2022-40982} init: Remove check_bugs() leftovers [T282039]
  - stable: {CVE-2022-40982} um/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} sparc/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} sh/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} mips/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} m68k/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} ia64/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} ARM: cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} x86/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} init: Provide arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2023-35001} netfilter: nf_tables: prevent OOB access in nft_byteorder_eval [T282039]
  - euler: {CVE-2023-3117} netfilter: nf_tables: unbind non-anonymous set if rule construction fails [T282039]
  - euler: {CVE-2023-3117} netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain [T282039]
  - euler: {CVE-2023-3117} netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE [T282039]
  - stable: {CVE-2023-3212} gfs2: Don't deref jdesc in evict [T282039]
  - stable: {CVE-2023-1206} tcp: Reduce chance of collisions in inet6_hashfn(). [T282039]
  - stable: {CVE-2023-3609} net/sched: cls_u32: Fix reference counter leak leading to overflow [T282039]
  - stable: {CVE-2023-3611} net/sched: sch_qfq: account for stab overhead in qfq_enqueue [T282039]
  - stable: {CVE-2023-3776} net/sched: cls_fw: Fix improper refcount update leads to use-after-free [T282039]
  - anolis: {CVE-2023-1077} sched/rt: pick_next_rt_entity(): check list_entry
  - anolis: virtio_net: suppress cpu stall when free_unused_bufs
  - anolis: virtio_net: split free_unused_bufs()
  - anolis: ovl: enable RCU'd ->get_acl()
  - stable: {CVE-2023-4128} net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free [T282039]
  - stable: {CVE-2023-4128} net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free [T282039]
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()"
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs"
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command
  - stable: {CVE-2023-4132} media: usb: siano: Fix warning due to null work_func_t function pointer [T282039]
  - stable: {CVE-2023-4132} media: usb: siano: Fix use after free bugs caused by do_submit_urb [T282039]
  - stable: {CVE-2023-40283} Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb [T282039]
  - loongarch: pci: irq: Add early_param pci_irq_limit to limit pci irq numbers [B209739]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.11
changelog:
  - uos: refresh loongarch kabi
  - stable: {CVE-2022-45886} media: dvb-core: Fix use-after-free due on race condition at dvb_net [T282039]
  - stable: {CVE-2022-45887} media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() [T282039]
  - stable: {CVE-2022-45919} media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 [T282039]
  - stable: {CVE-2023-3772} xfrm: add NULL check in xfrm_update_ae_params [T282039]
  - UOS: kabi: fix files_struct broken [T286681]
  - fix: UOS: disable short task method on loongson to improve performance [T286681]
  - fix: UOS: use find_idlest_group old path on loongson to improve 1c performance [T286681]
  - fix: UOS: solve loongson syscall __fget error [T286681]
  - LoongArch:fixed some error fo loongson_syscall [T286681]
  - LoongArch: Introduce optimize syscall for loongarch [T286681]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.12
changelog:
  - uos: add uharden app net manager module uhdappnm
  - uos: net: Fixed the txgbe compilation warning issue [T290527]
  - uos: net: Fixed the ngbe compilation error issue [T290527]
  - mainline: dma-direct: Force unencrypted DMA under SME for certain DMA masks
  - mainline: ext4: Fix rec_len verify error
  - uos: livepatch: support new style symbol format
  - uos: net: Update txgbe driver to 1.3.4 [T290527]
  - uos: net: Update ngbevf driver to 1.2.1 [T290527]
  - uos: net: Update ngbe driver to 1.2.5 [T290527]
  - uos: refresh loongarch kabi


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.13
changelog:
  - uos: enable CONFIG_OCFS2_FS
  - stable: {CVE-2023-4921} net: sched: sch_qfq: Fix UAF in qfq_dequeue() [T287071]
  - stable: {CVE-2023-4623} net/sched: sch_hfsc: Ensure inner classes have fsc curve [T287071]
  - stable: {CVE-2023-42755} net/sched: Retire rsvp classifier [T287071]
  - stable: {CVE-2023-42752} igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU [T287071]
  - stable: {CVE-2023-4207} net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free [T287071]


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.143
changelog:
  - UOS: loongarch/config: enable CONFIG_PARAVIRT
  - fbdev: ls2k500 sfb add module device table to enable module auto load.
  - fbdev: ls2k500 sfb add set par to support resolution setup.
  - Adds parsing compatibility for screen info guid.
  - fbdev: ls2k500sfb gpio irq handler stop all cpus to wait pcie training done.
  - LoongArch:LSVZ: implement the paravirt qspinlock call
  - drm/loongson: do not load loongson drm driver if ls2k500 bmc been found.
  - pci/quirk.c: Add limit for mrrs of 7A2000
  - Revert "LoongArch: Not using GCC stackrealign feature"
  - net: mucse: Update Mucse's network card device driver
  - LoongArch: nokaslr added to builtin cmdline
  - Revert "LoongArch: use generic irq migration"
  - LoongArch: Enable KASLR
  - LoongArch: Add the same binary implementation of kdump
  - irqchip/loongarch: Improve extioi code for guest cpu
  - LoongArch: Fix cpuhotplug on master core
  - xhci: Fix usb device probability miss
  - loongarch/kvm: ls7a add iocsrw emulation
  - fbdev: ls2k500 sfb add gpio request fail process.
  - LoongArch: kdump: Reimplement crashkernel=YM
  - LoongArch: Backport upstream kexec/kdump feature
  - LoongArch: export symbol invalid_pud_table
  - LoongArch: fix pm callback function error
  - LoongArch: Fix enable_gpe_wakeup() function error
  - irqchip: irq-loongson-liointc: fix some registers not be saved during S3
  - LoongArch: Make spinlock_test not dependent on Debug_FS
  - Revert "LoongArch: Introduce optimize syscall for loongarch"
  - Revert "LoongArch:fixed some error fo loongson_syscall"
  - Revert "LoongArch:Fix the bug of ls_dup copying invalid file descriptors"
  - Revert "UOS: Fix the warning message of ls_get_file"
  - Revert "UOS: kabi: fix kabi break by 759f47d3506ci"
  - scsi: lpfc: Add the FLOGI cmd to the list of commands which are allowed to retry
  - Revert "KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe"
  - Revert "compiler.h: Raise minimum version of GCC to 5.1 for arm64"


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.144
changelog:
  - (CVE-2023-1670)xirc2ps_cs: Fix use after free bug in xirc2ps_detach
  - (CVE-2022-4744)tun: avoid double free in tun_free_netdev
  - (CVE-2023-1855)hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
  - (CVE-2023-1513)kvm: initialize all of the kvm_debugregs structure before sending it to userspace
  - UOS: blk: Adjust blk_done_softirq to align the high version
  - block: mark flush request as IDLE when it is really finished
  - blk-mq: mark flush request as IDLE in flush_end_io()


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.145
changelog:
  - Revert "UOS: kabi: fix broken by 5ca4f93f48db"
  - UOS: lock tuned 
  - UOS: config: enable SCHED_CLUSTER
  - UOS: zhaoxin: rename topology_cluster_id to topology_zx_cluster_id
  - UOS: sched: Add cluster scheduler level for x86
  - UOS: sched: Add cluster scheduler level in core and related Kconfig for ARM64
  - UOS: topology: Represent clusters of CPUs within a die
  - UOS: sched: short execution cycle process optimization
  - UOS: fix: the impact of UTS audit function on performance degradation when selinux is not enabled.
  - Merge "vfio/mdev: Add iommu related member in mdev_device" into linux-next
  - UOS: kabi: fix broken by -
  - vfio/mdev: Add iommu related member in mdev_device
  - Zhaoxin: update patch version banner v4.0.10
  - Zhaoxin: tcp: add a missing nf_reset_ct() in 3WHS handling
  - Zhaoxin: net: add skb_defer_max sysctl
  - Zhaoxin: net: use napi_consume_skb() in skb_defer_free_flush()
  - Zhaoxin: net: fix possible race in skb_attempt_defer_free()
  - Zhaoxin: net: call skb_defer_free_flush() before each napi_poll()
  - Zhaoxin: tcp: drop skb dst in tcp_rcv_established()
  - Zhaoxin: net: make sure net_rx_action() calls skb_defer_free_flush()
  - Zhaoxin: net: generalize skb freeing deferral to per-cpu lists
  - Zhaoxin: Fix streaming DMA writes disorder issue for Zhaoxin's KH-40000 platform v2
  - Zhoaxin: update Zhaoxin I2C Linux driver to v1.3.0
  - Zhaoxin: sched/topology: fix the issue groups don't span domain->span for NUMA diameter > 2
  - UOS: loonarch: enable CONFIG_ECRYPT_FS for encryptfs filesystem
  - Merge changes from topics "2304.4.0", "merge_euler-2304.3.0" into linux-next
  - KVM: nVMX: add missing consistency checks for CR0 and CR4
  - net/sched: Retire tcindex classifier
  - Documentation/hw-vuln: Fix rST warning
  - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions
  - KVM: x86: Mitigate the cross-thread return address predictions bug
  - x86/speculation: Identify processors vulnerable to SMT RSB predictions
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
  - Merge "UOS: locking/osq_lock: Fix wrong input type" into linux-next
  - UOS: loongarch/config: enable CONFIG_CRASH_DUMP
  - LoongArch: Limite pci device irq number to 32
  - UOS: locking/osq_lock: Fix wrong input type
  - nbd: remove the call to set_blocksize
  - nbd: Fix use-after-free in pid_show
  - UOS:config: enable CONFIG_ECRYPT_FS for encryptfs filesystem
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
  - bpf: add missing header file include
  - uaccess: Add speculation barrier to copy_from_user()
  - x86/mm: Fix use of uninitialized buffer in sme_enable()
  - ext4: fail ext4_iget if special inode unallocated
  - ext4: zero i_disksize when initializing the bootloader inode
  - irqdomain: Drop bogus fwspec-mapping error handling
  - irqdomain: Fix disassociation race
  - irqdomain: Fix association race
  - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
  - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
  - x86/bugs: Reset speculation control settings on init
  - timers: Prevent union confusion from unexpected restart_syscall()
  - crypto: rsa-pkcs1pad - Use akcipher_request_complete
  - crypto: seqiv - Handle EBUSY correctly
  - ACPI: battery: Fix missing NUL-termination with large strings
  - ACPICA: nsrepair: handle cases without a return value correctly
  - genirq: Fix the return type of kstat_cpu_irqs_sum()
  - ACPI: NFIT: fix a potential deadlock during NFIT teardown
  - alarmtimer: Prevent starvation by small intervals and SIG_IGN
  - ring-buffer: Fix race while reader and writer are on the same page
  - md: fix kabi broken in struct mddev
  - md: use interruptible apis in idle/frozen_sync_thread
  - md: wake up 'resync_wait' at last in md_reap_sync_thread()
  - md: refactor idle/frozen_sync_thread()
  - md: add a mutex to synchronize idle and frozen in action_store()
  - md: refactor action_store() for 'idle' and 'frozen'
  - md: fix soft lockup in status_resync
  - md: don't update recovery_cp when curr_resync is ACTIVE
  - md: Ensure resync is reported after it starts
  - md: Use enum for overloaded magic numbers used by mddev->curr_resync
  - loop: Add parm check in loop_control_ioctl
  - block/wbt: enable wbt after switching cfq to other schedulers
  - sched/fair: Sanitize vruntime of entity being migrated
  - sched/fair: sanitize vruntime of entity being placed
  - Revert "sched: Reinit task's vruntime if a task sleep over 200 days"
  - btrfs: fix race between quota disable and quota assign ioctls
  - ext4: Fix i_disksize exceeding i_size problem in paritally written case
  - ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev'
  - ext4: Fix reusing stale buffer heads from last failed mounting
  - ext4: fix race between writepages and remount
  - ftrace: Fix invalid address access in lookup_rec() when index is 0
  - scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
  - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
  - cgroup/cpuset: Change cpuset_rwsem and hotplug lock order
  - net/sched: tcindex: search key must be 16 bits
  - net/sched: tcindex: update imperfect hash filters respecting rcu
  - ext4: make sure fs error flag setted before clear journal error
  - ext4: commit super block if fs record error when journal record without error
  - tty: fix out-of-bounds access in tty_driver_lookup_tty()
  - kernel: Initialize cpumask before parsing
  - softirq: Don't try waking ksoftirqd before it has been spawned
  - act_mirred: use the backlog for nested calls to mirred ingress
  - net/sched: act_mirred: refactor the handle of xmit
  - net: sched: don't expose action qstats to skb_tc_reinsert()
  - net: sched: protect against stack overflow in TC act_mirred
  - net: sched: refactor reinsert action
  - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
  - ext4: fix another off-by-one fsmap error on 1k block filesystems
  - mm: memcontrol: fix cannot alloc the maximum memcg ID
  - Merge "UOS:loongarch config add CONFIG_HINIC" into linux-next
  - Merge "staging: TCM: add GMJS(Nationz Tech) TCM driver." into linux-next
  - Merge "UOS:x86_64 add CONFIG_DRM_SMI and CONFIG_DRM_SMI_HDMI" into linux-next
  - UOS:loongarch config add CONFIG_HINIC
  - staging: TCM: add GMJS(Nationz Tech) TCM driver.
  - UOS:x86_64 add CONFIG_DRM_SMI and CONFIG_DRM_SMI_HDMI


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.146
changelog:
  - UOS: revert the debugfs modify  in  stmmac_main.c for  phytimu D2000 support
  - Merge "ext4: fix a possible ABBA deadlock due to busy PA" into linux-next
  - Merge "ext4: discard preallocations before releasing group lock" into linux-next
  - Merge "blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()" into linux-next
  - Merge "blk-wbt: call rq_qos_add() after wb_normal is initialized" into linux-next
  - ext4: fix a possible ABBA deadlock due to busy PA
  - ext4: discard preallocations before releasing group lock
  - blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
  - UOS: fix 'struct task_struct' kabi changed
  - blk-wbt: call rq_qos_add() after wb_normal is initialized
  - UOS: optimization for stream
  - UOS: optimize short cycle process solution
  - UOS: modify pipe read/write
  - UOS: modify syscall for ARM64
  - UOS: fix ltp cpuhotplug stuck
  - Phytium: add dwmac-phytium support for d2000
  - UOS:net/phy: update Motorcomm Phy driver to 2.2.10068
  - Zhaoxin: update patch version banner v4.0.11
  - UOS: Zhaoxin: config:enable Zhaoxin i2c/sata/random/cputemp/sm3/sm4
  - Zhaoxin: Update coherent DMA writes disorder issue fix patch
  - UOS: kabi: fix broken by 5ca4f93f48db -- 2
  - UOS: kabi: fix broken by 6a5e5d2007e3
  - UOS: open CONFIG_SCHED_DEBUG config on loongarch


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.147
changelog:
  - (CVE-2023-2248)net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
  - (CVE-2023-2194)i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
  - (CVE-2023-1989)Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
  - (CVE-2023-30772)power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
  - UOS: improve stream performance
  - Merge "UOS: fix ltp cpuset_hotlog bug" into linux-next
  - stmmac: debugfs entry name is not be changed when udev rename device name.
  - UOS: fix ltp cpuset_hotlog bug


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.150
changelog:
  * Fri May 12 2023 lihongbin <lihongbin@uniontech.com> - 4.19.0-91.149
  - Merge "Revert "UOS: consider smt domain in short task solution"" into linux-next
  - Revert "UOS: consider smt domain in short task solution"
  - Merge "UOS: consider smt domain in short task solution" into linux-next
  - Merge "vfio/type1: Handle different mdev isolation type" into linux-next
  - Merge "vfio/type1: Add domain at(de)taching group helpers" into linux-next
  - Merge "iommu/vt-d: Return ID associated with an auxiliary domain" into linux-next
  - Merge "iommu/vt-d: Aux-domain specific domain attach/detach" into linux-next
  - Merge "iommu/vt-d: Move common code out of iommu_attch_device()" into linux-next
  - Merge "iommu/vt-d: Add per-device IOMMU feature ops entries" into linux-next
  - Merge "iommu/vt-d: Make intel_iommu_enable_pasid() more generic" into linux-next
  - Merge "iommu: Add APIs for multiple domains per device" into linux-next
  - Merge "iommu/vt-d: Remove misleading "domain 0" test from domain_exit()" into linux-next
  - Merge "iommu/vt-d: Remove unused dmar_remove_one_dev_info() argument" into linux-next
  - Merge "iommu/vt-d: Remove unnecessary local variable initializations" into linux-next
  - Merge "iommu/vt-d: Use dev_printk() when possible" into linux-next
  - Merge "iommu: Use dev_printk() when possible" into linux-next
  - Merge "iommu/vt-d: Remove deferred invalidation" into linux-next
  - Merge "iommu/vt-d: Shared virtual address in scalable mode" into linux-next
  - Merge "iommu/vt-d: Add first level page table interface" into linux-next
  - Merge "iommu/vt-d: Setup context and enable RID2PASID support" into linux-next
  - Merge "iommu/vt-d: Pass pasid table to context mapping" into linux-next
  - Merge "iommu/vt-d: Setup pasid entry for RID2PASID support" into linux-next
  - Merge "iommu/vt-d: Add second level page table interface" into linux-next
  - Merge "iommu/vt-d: Reserve a domain id for FL and PT modes" into linux-next
  - Merge "iommu/vt-d: Add 256-bit invalidation descriptor support" into linux-next
  - Merge "iommu/vt-d: Move page table helpers into header" into linux-next
  - Merge "iommu/vt-d: Manage scalalble mode PASID tables" into linux-next
  - Merge "iommu/vt-d: Enumerate the scalable mode capability" into linux-next
  - Merge "iommu/vtd: Cleanup dma_remapping.h header" into linux-next
  - Merge "iommu/vt-d: Add debugfs support to show context internals" into linux-next
  - Merge "iommu/vt-d: Add debugfs support for Interrupt remapping" into linux-next
  - Merge "iommu/vt-d: Add debugfs support to show register contents" into linux-next
  - Merge "iommu/vt-d: Enable base Intel IOMMU debugfs support" into linux-next
  - Merge "iommu/vt-d: Update register definitions to VT-d 3.0 specification" into linux-next
  - Merge "iommu/vt-d: Relocate struct/function declarations to its header files" into linux-next
  - UOS: consider smt domain in short task solution
  - xfs: fix an ABBA deadlock in xfs_rename
  - xfs: Fix deadlock between AGI and AGF when target_ip exists in xfs_rename()
  - xfs: don't account extra agfl blocks as available
  - xfs: preserve default grace interval during quotacheck
  - xfs: don't take a spinlock unconditionally in the DIO fastpath
  - xfs: show the proper user quota options
  - parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled
  - pci_iounmap'2: Electric Boogaloo: try to make sense of it all
  - anolis: nfsd: remove nfsd_reply_cache_shutdown() in nfsd_exit_net
  - drm/nouveau/mmu: add more general vmm free/node handling functions
  - l2tp: Serialize access to sk_user_data with sk_callback_lock
  - net: sched: fix race condition in qdisc_graft()
  - memcg: enable accounting of ipc resources
  - anolis: x86/kasan: Map shadow for percpu pages on demand
  - anolis: x86/kasan: Add helpers to align shadow addresses up and down
  - x86/mm: Randomize per-cpu entry area
  - x86/hw_breakpoint: Prevent data breakpoints on direct GDT
  - x86/hw_breakpoint: Add within_area() to check data breakpoints
  - x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries
  - nvme: ensure subsystem reset is single threaded
  - nvme: Wait for reset state when required
  - nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled
  - PCI/ASPM: Add pcie_aspm_enabled()
  - nvme-pci: use host managed power state for suspend
  - nvme: introduce nvme_sync_io_queues
  - nvme: include admin_q sync with nvme_sync_queues
  - nvme-pci: Sync queues on reset
  - nvme: export get and set features
  - nvme: Prevent resets during paused controller state
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually
  - anolis: kbuild: fix error remind bug for libelf check
  - vfio/type1: Handle different mdev isolation type
  - vfio/type1: Add domain at(de)taching group helpers
  - iommu/vt-d: Return ID associated with an auxiliary domain
  - iommu/vt-d: Aux-domain specific domain attach/detach
  - iommu/vt-d: Move common code out of iommu_attch_device()
  - iommu/vt-d: Add per-device IOMMU feature ops entries
  - iommu/vt-d: Make intel_iommu_enable_pasid() more generic
  - iommu: Add APIs for multiple domains per device
  - iommu/vt-d: Remove misleading "domain 0" test from domain_exit()
  - iommu/vt-d: Remove unused dmar_remove_one_dev_info() argument
  - iommu/vt-d: Remove unnecessary local variable initializations
  - iommu/vt-d: Use dev_printk() when possible
  - iommu: Use dev_printk() when possible
  - iommu/vt-d: Remove deferred invalidation
  - iommu/vt-d: Shared virtual address in scalable mode
  - iommu/vt-d: Add first level page table interface
  - iommu/vt-d: Setup context and enable RID2PASID support
  - iommu/vt-d: Pass pasid table to context mapping
  - iommu/vt-d: Setup pasid entry for RID2PASID support
  - iommu/vt-d: Add second level page table interface
  - iommu/vt-d: Reserve a domain id for FL and PT modes
  - iommu/vt-d: Add 256-bit invalidation descriptor support
  - iommu/vt-d: Move page table helpers into header
  - iommu/vt-d: Manage scalalble mode PASID tables
  - iommu/vt-d: Enumerate the scalable mode capability
  - iommu/vtd: Cleanup dma_remapping.h header
  - iommu/vt-d: Add debugfs support to show context internals
  - iommu/vt-d: Add debugfs support for Interrupt remapping
  - iommu/vt-d: Add debugfs support to show register contents
  - iommu/vt-d: Enable base Intel IOMMU debugfs support
  - iommu/vt-d: Update register definitions to VT-d 3.0 specification
  - iommu/vt-d: Relocate struct/function declarations to its header files
  - RDMA/core: Refactor rdma_bind_addr
  - Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb()
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
  - verify_pefile: relax wrapper length check
  - udp6: fix potential access to stale information
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
  - ftrace: Mark get_lock_parent_ip() __always_inline
  - perf/core: Fix the same task check in perf_event_set_output
  - net: don't let netpoll invoke NAPI if in xmit context
  - icmp: guard against too small mtu
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
  - dm stats: check for and propagate alloc_percpu failure
  - dm thin: fix deadlock when swapping to thin device
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - scsi: dpt_i2o: Remove obsolete driver
  - md: extend disks_mutex coverage
  - md: use msleep() in md_notify_reboot()
  - md: fix double free of mddev->private in autorun_array()
  - bonding: Fix memory leak when changing bond type to Ethernet
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition
  - ext4: only update i_reserved_data_blocks on successful block allocation
  - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
  - sctp: leave the err path free in sctp_stream_init to sctp_stream_free
  - audit: fix a memleak caused by auditing load module
  - tcp: restrict net.ipv4.tcp_app_win
  - x86/speculation: Allow enabling STIBP with legacy IBRS
  - iommu/arm-smmu-v3: Fix UAF when handle evt during iommu group removing
  - ipvlan: Modify the value of ipvlan modes
  - UOS: Add flags for Fisherman algo


author: xinghe <xinghe2@h-partners.com> - 1.16.1-7
changelog:
  - Type:cves
  - CVE:CVE-2023-31130 CVE-2023-31124 CVE-2023-31147
  - SUG:NA
  - DESC:fix CVE-2023-31130 CVE-2023-31124 CVE-2023-31147


author: Rongwei Wang <rongwei.wang@linux.alibaba.com> - 2.28-225.0.4.6
changelog:
  - elf: Properly align PT_LOAD segments
  - Sync loongarch64 code to lnd.35. (lixing@loongson.cn)
  - Add patch for gb18030-2022 from upstream bug#30243 (fundawang@yeah.net)


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: lichao <lichaod@uniontech.com> - 4.17.5-2.0.1.02
changelog:
  - cve: CVE-2022-2127 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968 CVE-2023-42669 CVE-2023-4091 CVE-2023-3961


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-46
changelog:
  - 2074684 - lp to a remote server takes a long time
  - 2074736 - CUPS is too chatty about "Removing document files." in debug mode


author: xingwei <xingwei14@h-partners.com> - 7.71.1-23.up3
changelog:
  - Type:cves
  - CVE:CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538
  - SUG:NA
  - DESC:fix CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538


author: yuxiaojun <yuxiaojun@uniontech.com> - 5.5.90-1.03
changelog:
  - fix: When root is disabled after creating an administrator account, the problem of being unable to enter the system through the graphical interface(bugid:203337)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-5.el8
changelog:
  - edk2-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch [bz#1892318]
  - edk2-redhat-add-OVMF-binary-that-will-support-SEV-ES.patch [bz#1956837]
  - Resolves: bz#1892318
    (edk2: possible heap corruption with LzmaUefiDecompressGetInfo [rhel-8])
  - Resolves: bz#1956837
    (Additional build of edk2 without SMM (dual build / sub-package) for SEV-ES)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-1
changelog:
  - Rebase to edk2-stable202105 [bz#1938238]
  - Resolves: bz#1938238
    ((edk2-rebase-rhel-8.5) - rebase edk2 to edk2-stable202105 for RHEL-8.5)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-2
changelog:
  - edk2-NetworkPkg-IScsiDxe-wrap-IScsiCHAP-source-files-to-8.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-simplify-ISCSI_CHAP_AUTH_DATA.In.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-ISCSI_CHAP_AUTH_DATA.Ou.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-library-class-dependenc.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-potential-integer-overflow-i.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-assert-that-IScsiBinToHex-always.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-reformat-IScsiHexToBin-leading-c.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-hex-parsing.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-buffer-overflo.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-check-IScsiHexToBin-return-value.patch [bz#1956408]
  - Resolves: bz#1956408
    (edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe [rhel-8.5.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-3
changelog:
  - edk2-MdeModulePkg-PartitionDxe-Ignore-PMBR-BootIndicator-.patch [bz#1988762]
  - Resolves: bz#1988762
    (edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-1.el8
changelog:
  - Rebase to latest upstream release [bz#2018386]
  - Resolves: bz#2018386
    ([rebase] update edk2 to nov '21 release (edk2-stable202111xx))


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-2
changelog:
  - edk2-OvmfPkg-AmdSev-SecretPei-Mark-SEV-launch-secret-area.patch [bz#2112307]
  - Resolves: bz#2112307
    (Mark SEV launch secret area as reserved)


author: Camilla Conte <cconte@redhat.com> - 20220126gitbb1bba3d77-3
changelog:
  - Bumping OpenSSL version [bz# 2074834]
  - Resolves: bz# 2074834
    (edk2: sync openssl sources with rhel openssl rpm)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-4
changelog:
  - edk2-openssl-update.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - Resolves: bz#2164531
    (CVE-2023-0286 edk2: openssl: X.400 address type confusion in X.509 GeneralName [rhel-8])
  - Resolves: bz#2164543
    (CVE-2022-4304 edk2: openssl: timing attack in RSA Decryption implementation [rhel-8])
  - Resolves: bz#2164558
    (CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-8])
  - Resolves: bz#2164581
    (CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-5
changelog:
  - edk2-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch [bz#1861743]
  - Resolves: bz#1861743
    (CVE-2019-14560 edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-6
changelog:
  - edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch [bz#2150267]
  - Resolves: bz#2150267
    (ovmf must consider max cpu count not boot cpu count for apic mode [rhel-8])


author: Jacek Migacz <jmigacz@redhat.com> - 1:26.1-10
changelog:
  - Fix etags local command injection vulnerability (#2175189)
  - Fix htmlfontify.el command injection vulnerability (#2175178)
  - Fix ob-latex.el command injection vulnerability (#2180587)


author: maqi <maqi@uniontech.com> - 102.12.0-1.02
changelog:
  - spec: define rhel_minor_version 3 for uelc20 dist.
  - spec: requires uos-indexhtml.
  - spec: fix bookmark icon in English env:comment cp command.
  - arch: exclude loongarch.
  - rebrand: modify distribution.ini.
  - rebrand: rename centos js file to uos.
  - rebrand: Welcome page 'https://www.chinauos.com/home' in js file.


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-2
changelog:
  - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
  - resolve CVE-2021-43813 grafana: directory traversal vulnerability for *.md files


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-1
changelog:
  - update to 7.5.15 tagged upstream community sources, see CHANGELOG
  - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources
  - resolve CVE-2022-21702 grafana: XSS vulnerability in data source handling
  - resolve CVE-2022-21703 grafana: CSRF vulnerability can lead to privilege escalation
  - resolve CVE-2022-21713 grafana: IDOR vulnerability can lead to information disclosure
  - resolve CVE-2021-23648 sanitize-url: XSS
  - resolve CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
  - declare Node.js dependencies of subpackages
  - make vendor and webpack tarballs reproducible


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
changelog:
  - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
  - resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
  - resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-4
changelog:
  - resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in
  - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
  - resolve CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
  - resolve CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
  - run integration tests in check phase
  - update FIPS patch with latest changes in Go packaging


author: zhangxianting <zhangxianting@uniontech.com> 7.5.15-4.01
changelog:
  - cve: CVE-2022-2880 CVE-2022-27664 CVE-2022-39229 CVE-2022-41715
  - arch: support loongarch64
  - spec: Use cn proxy for go build


author: Sam Feifer <sfeifer@redhat.com> 7.5.15-5
changelog:
  - resolve RHEL-13284
  - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
  - testing is turned off due to test failures caused by testing date mismatch


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-7
changelog:
  - resolve RHEL-12649
  - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
  - testing is turned off due to test failures caused by testing date mismatch


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.04-36
changelog:
  - Type:CVE
  - CVE:CVE-2023-4692 CVE-2023-4693
  - SUG:NA
  - DESC:fs/ntfs: Make code more readable
         fs/ntfs: Fix an OOB read when parsing a volume label
         fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
         fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes
         fs/ntfs: Fix an OOB read when reading data from the resident $DATA attribute
         fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for the $MFT file


author: zhangxianting <zhangxianting@uniontech.com> - 1:2.04-36.up7.12
changelog:
  - fix: fix bug when repeat execute grub-switch-to-blscfg.in to create /boot/loader/entries/(bugid:186045)


author: zhangxianting <zhangxianting@uniontech.com> - 1:2.04-36.up7.14
changelog:
  - fix: patch to fix bug when repeat execute grub-switch-to-blscfg.in to create /boot/loader/entries/(bugid:186045)


author: Jarod Wilson <jarod@redhat.com> - 20220713-109.gitdfa29317
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include even newer qed firmware update (rhbz 2040269)


author: Jarod Wilson <jarod@redhat.com> - 20220726-110.git150864a4
changelog:
  - Omit unused password-protected vxge firmware files from package (rhbz 2108051)
  - Pick up latest AMD GPU firmwares


author: Lucas Zampieri <lzampier@redhat.com> - 20221102-111.git8bb75626
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amdgpu firmware update to fix certain "multiple monitor scenarios" (rhbz 2130707)


author: Lucas Zampieri <lzampier@redhat.com> - 20230111-112.gita1ad1d5b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi33 dGPU firmware (rhbz 2047480)
  - Navi31 dGPU firmware (rhbz 2047483)


author: Lucas Zampieri <lzampier@redhat.com> - 20230217-113.git83f1d778
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Qualcomm Wi-Fi - Disconnecting power cable during suspend wakes up the laptop (rhbz 2169012)


author: Patrick Talbert <ptalbert@redhat.com> - 20230404-114.git2e92a49f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Intel QAT Update - firmware for QAT (rhbz 2030316)


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Zoltan Fridrich <zfridric@redhat.com> - 2.48-2
changelog:
  - rebase to 2.48
    resolves: rhbz#2032813
  - fix ambient capabilities for non-root users
    resolves: rhbz#1950187


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
  - Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1935339 virtual_private setting is missing in the default config


author: Daiki Ueno <dueno@redhat.com> - 4.4-1
changelog:
  - Resolves: rhbz#1958968 Rebase libreswan to 4.4
  - Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers


author: Daiki Ueno <dueno@redhat.com> - 4.5-1
changelog:
  - Resolves: rhbz#2017352 Rebase libreswan to 4.5
  - Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets


author: Daiki Ueno <dueno@redhat.com> - 4.9-1
changelog:
  - Resolves: rhbz#2128672 Rebase libreswan to 4.9
  - Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary


author: Daiki Ueno <dueno@redhat.com> - 4.9-2
changelog:
  - Fix CVE-2023-23009: remote DoS via crafted TS payload with an
    incorrect selector length (rhbz#2186127)


author: Sahana Prasad <sahana@redhat.com> - 4.9-3
changelog:
  - Fix CVE-2023-30570: Malicious IKEv1 Aggressive Mode packets can crash
    libreswan
  - Resolves: rhbz#2187179


author: maqi <maqi@uniontech.com> - 4.9-3.01
changelog:
  - rebrand: add rebrand-to-uos.patch
  - spec: Set value for DEFAULT_DNSSEC_ROOTKEY_FILE to solve build error


author: Matej Mužila <mmuzila@redhat.com> 4.4.0-2
changelog:
  - Update to version 4.4.0
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1354
    CVE-2022-1355


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 0:1.5.22-2.0.1
changelog:
  - Fix glibc2.32 build issue for better compatible with both glibc2.28 and glibc2.32
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 and gcc8 build


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-5
changelog:
  - FIPS 140-3 changes
  -  Reject Small RSA keys, 1024 bit keys are marked as FIP OK when verifying, reject
     signature keys by policy
  -  Allow applications to retrigger selftests on demand.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-8
changelog:
  - Update fips default for pk12util to AES rather than TDES
  - Fix bug in pkcs12 files with null passwords


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-10
changelog:
  - Fix QA found failures:
  -  remove extra '+' from sslpolicy.txt file causing test error values
  -  only use GRND_RANDOM if the kernel is in FIPS mode.


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-2.el8
changelog:
  - ovt-Fix-a-memory-leak-reported-by-a-partner-from-their-C.patch [bz#1935807]
  - Resolves: bz#1935807
    ([ESXi][RHEL-8.5][open-vm-tools] Coverity detected an important defect in open-vm-tools-11.2.5 rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.3.0-1.el8
changelog:
  - Rebase to open-vm-tools 11.3.0 [bz#1974468]
  - Resolves: bz#1974468
    ([ESXi][RHEL8]Open-vm-tools release 11.3.0 has been released - please rebase)


author: Miroslav Rezanian <mrezanin@redhat.com> - 11.3.5-1
changelog:
  - Rebase to open-vm-tools 11.3.5 [bz#2008244]
  - Resolves: bz#2008244
    ([ESXi][RHEL8]Open-vm-tools release 11.3.5 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.0.0-1
changelog:
  - Rebase to open-vm-tools 12.0.0 [bz#2061189]
  - Resolves: bz#2061189
    ([ESXi][RHEL8]Open-vm-tools release 12.0.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.0.5-1
changelog:
  - Rebase to open-vm-tools 12.0.5 [bz#2090273]
  - Resolves: bz#2090273
    ([ESXi][RHEL8]Open-vm-tools release 12.0.5 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.0.5-2
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119284]
  - Resolves: bz#2119284
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.0-1
changelog:
  - Rebase to open-vm-tools 12.1.0
  - Resolves: bz#2121196
    ([ESXi][RHEL8]Open-vm-tools release 12.1.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.5-1
changelog:
  - Rebase to open-vm-tools 12.1.5 [bz#2150188]
  - Resolves: bz#2150188
    (ESXi][RHEL8]Open-vm-tools release 12.1.5 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.1.5-2
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2217083]
  - Resolves: bz#2217083
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-8.8.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.1.5-3
changelog:
  - ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [RHEL-3073]
  - Resolves: RHEL-3073
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8.8.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.0-1
changelog:
  - Rebase to open-vm-tools 12.2.0 [bz#2177068]
  - Resolves: bz#2177068
    ([ESXi][RHEL8]open-vm-tools version 12.2.0 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.2.0-3
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2215563]
  - Resolves: bz#2215563
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-1
changelog:
  - Rebase to open-vm-tools 12.2.5 [bz#2214861]
  - Resolves: bz#2214861
    ([ESXi][RHEL8]open-vm-tools version 12.2.5 has been released - please rebase)
  - Resolves: bz#2216415
    ([ESXi][RHEL8] URL in service unit files are started from http instead of https)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-2.el8_9
changelog:
  - ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [bz#2236543]
  - Resolves: bz#2236543
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 12.2.5-3.el8_9
changelog:
  - ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [RHEL-2447]
  - Resolves: RHEL-2447
    ([RHEL8.9][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-3.1
changelog:
  - ovt-Don-t-accept-tokens-with-unrelated-certs.patch [RHEL-14648]
  - ovt-File-descriptor-vulnerability-in-the-open-vm-tools-v.patch [RHEL-14682]
  - Resolves: RHEL-14648
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-8.9.0])
  - Resolves: RHEL-14682
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-8.9.0])


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-5
changelog:
  - Avoid potential crash because of missing list terminator (#2196234)
  - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardos_have_verifyrc_package (#2211093)
  - Backport upstream changes regarding to reader removal (#2097048)


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: zhangbinchen <zhangbinchen@openanolis.org> - 3.6.8-51.0.1.1
changelog:
  - Add Anolis platform cherry-pick [9a96461]
  - Support Loongarch for python3
  - Fix testcase fails on loongarch64


author: lichao <lichaod@uniontech.com> - 3.6.8-51.0.1.2
changelog:
  - spec: change redhat-rpm-config to uos-rpm-config
  - rebrand: add uos platform
  - feat: add sm3 support


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  - CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  - Resolves: rhbz#1649153
  - Resolves: rhbz#1700824
  - Resolves: rhbz#1702473
  - Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  - Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  - Resolves: rhbz#1962856


author: Marek Kasik <mkasik@redhat.com> - 0.66.0-25
changelog:
  - Check whether input is RGB in PSOutputDev::checkPageSlice()
  - also when using "-optimizecolorspace" flag
  - Resolves: #1697576


author: zhangkea <zhangkea@uniontech.com> - 3.4.0-10.02
changelog:
  - fix cve CVE-2019-19450 
  - Do not evaluate unichar element
  - Replace an invalid char with a correct one (rpminspect)
  - Resolves: RHEL-7008


author: Michal Sekletár <msekleta@redhat.com> - 11.7.3-2
changelog:
  - sysstat's buildsystem doesn't really use LDFLAGS, we have to merge CFLAGS and LDFLAGS to get binaries with full RELRO (#1624177)


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: psimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: maqi <maqi@unintech.com> - 9:20200406-26.01
changelog:
  - spec: Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - spec: anolis texlive add loongarch64(Yaxuan Liu)


author: maqi <maqi@uniontech.com> - 102.12.0-1.02
changelog:
  - debrand: debrand from centos
  - arch:no build loongarch64
  - arch: add support mips64el
  - add Patch10010:0001-ChengJieOS-add-cflags.patch for build error.
  - add Patch10011:0001-add-mips64el-for-libffi.patch
  - add Patch10012:0001-add-n32.S-for-MIPS.patch
  - rebrand: rename js file and update vendor
  - rebrand: add zh_CN name on thunderbird.desktop
  - spec: define rhel_minor_version 3 for uelc20 dist
  - spec: modify RPM_BUILD_ROOT for uos build.


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-7
changelog:
  - Related: #2173874 Tomcat installs older java even though newer java is installed
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-10
changelog:
  - Resolves: #2210630 CVE-2023-28709 tomcat
  - Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Remove JDK subpackges which are unused


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-5.1
changelog:
  - Resolves: RHEL-12542 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Update source to include the CVE fixes
  - Update patch command


author: maqi <maqi@uniontech.com> - 2.38.5-1.0.1.4
changelog:
  - Add patch: 0001-Resolved-EGL_WAYLAND_BUFFER_WL-undefined.patch
  - fix: delete empty link(bugid:123783)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.0.1.7
changelog:
  - Add patch for CVE-2023-28204
    Resolves: #2209744
  - Add patch for CVE-2023-32373
    Resolves: #2209727


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.5-1
changelog:
  - Upgrade to 2.40.5. Also, disable JIT
    Resolves: #2176269
    Resolves: #2185742
    Resolves: #2209728
    Resolves: #2209745
    Resolves: #2218649
    Resolves: #2218651
    Resolves: #2224611


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2108156, rhbz#2108161


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-11
changelog:
  - CVE fix for: CVE-2022-4283 (#2151799), CVE-2022-46340 (#2151774),
    CVE-2022-46341 (#2151779), CVE-2022-46342 (#2151784),
    CVE-2022-46343 (#2151789), CVE-2022-46344 (#2151794)


author: zhangshaoning <zhangshaoning@uniontech.com> - 1.20.11-17.01
changelog:
  - update: xorg-x11-server-1.20.11-17.el8.src.rpm and sync patch
  - fix: workaround to resolve crash while changing resolution ratio(bugid:163293)(zhaoshuang)
  - feat: transplant deepin patch(liweigang)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-2
changelog:
  - CVE fix for: CVE-2021-4008 (#2038066), CVE-2021-4009 (#2038068),
    CVE-2021-4010 (#2038071), CVE-2021-4011 (#2038073)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-6
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2110442, rhbz#2110437


author: Peter Hutterer <peter.hutterer@redhat.com> - 21.1.3-8
changelog:
  - CVE fix for: CVE-2022-4283 (#2151802), CVE-2022-46340 (#2151777),
    CVE-2022-46341 (#2151782), CVE-2022-46342 (#2151785),
    CVE-2022-46343 (#2151792), CVE-2022-46344 (#2151795)


