- 4.1 security update (fix CVE-2011-4109 CVE-2011-4576 CVE-2011-4619
    CVE-2012-0884 CVE-2012-1165 CVE-2012-2110 CVE-2012-2333)

- 4.1 security update (fix CVE-2011-4599)

- 4.1 security update (fix cups-CVE-2011-2896)

- 4.1 security update (fix CVE-2011-2895)

- 4.1 security update (fix CVE-2011-1002)

- 4.1 security update (fix CVE-2010-1797 CVE-2010-2498 CVE-2010-2499 CVE-2010-2500
   CVE-2010-2519 CVE-2010-2520 CVE-2010-2527 CVE-2010-2805 CVE-2010-2806
   CVE-2010-2808 CVE-2010-3311 CVE-2010-3855 CVE-2011-0226 CVE-2011-3256
   CVE-2011-3439)

- CVE-2010-0296
  CVE-2011-1095
  CVE-2011-0536

- CVE-2008-0411

- CVE-2010-3089
  CVE-2011-0707

- CVE-2010-2065
  CVE-2011-0192
  CVE-2011-1167

- CVE-2009-2347
  CVE-2010-2065
  CVE-2011-0192

- CVE-2009-0692
  CVE-2011-0997
  CVE-2011-2748-2749

- CVE-2011-2192

- CVE-2009-2473

- CVE-2009-2473
  CVE-2009-2474

- CVE-2009-2905

- CVE-2009-3894

- CVE-2009-3560
  CVE-2009-3720

- CVE-2009-3546

- CVE-2010-1321
  CVE-2009-0846
  CVE-2007-5971
  CVE-2007-5901

- CVE-2006-3619
  CVE-2009-3736

- CVE-2009-3736

- CVE-2009-4022
  CVE-2010-0097
  CVE-2010-3762
  CVE-2011-4313

- CVE-2010-0426 sudo: sudoedit option can possibly allow for arbitrary code execution

- CVE-2010-0624

- fixed CVE-2010-0624

- fixed CVE-2009-3563

- Fixed CVE-2009-0217

- Fixed: CVE-2008-2711, CVE-2009-2666

- Fixed CVE-2009-2408
- Fixed CVE-2009-2409

- Security fixes:
  - CVE-2009-0755
  - CVE-2009-3603
  - CVE-2009-3604
  - CVE-2009-3608
  - CVE-2009-3609
  - CVE-2010-3702
  - CVE-2010-3704
- Don't package utils

- Apply xpdf-3.02pl3 security patch to fix:
  CVE-2009-0146, CVE-2009-0147, CVE-2009-0166, CVE-2009-0799,
  CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181,
  CVE-2009-1182, CVE-2009-1183, CVE-2009-1187, CVE-2009-1188.
- Apply xpdf-3.02pl4 security patch to fix:
  CVE-2009-3603, CVE-2009-3604, CVE-2009-3605, CVE-2009-3606,
  CVE-2009-3608, CVE-2009-3609.
- Security fixes: CVE-2010-3702, CVE-2010-3704.

- fixed CVE-2009-2414, CVE-2009-2416

- Fixed:
   + CVE-2008-3658
   + CVE-2008-3660
   + CVE-2008-5498
   + CVE-2008-5557
   + CVE-2009-0754

- fixed CVE-2009-0798

- fixed CVE-2009-2663

- Fixed CVE-2009-2411

- Fixed CVE-2007-1558
- Fixed CVE-2009-0642

- Fixed CVE-2009-0023
- Fixed CVE-2009-1955
- Fixed CVE-2009-1956

- fixed CVE-2008-4316

- fixed CVE-2007-2721
- fixed CVE-2008-3520

- fixed stack-based buffer overflow (CVE-2009-4274)
- fixed build
  + netpbm-10.35-alt-fix-overflow-destination-buffer.patch

- fix TFTP server vulnerabilities (CVE-2009-2957, CVE-2009-2958).

- Applied upstream fix for integer underflow bug (CVE-2010-0001).

- [SECURITY] fix CVE-2009-2692

- [SECURITY] fix CVE-2009-2692

- [SECURITY] fix CVE-2009-2692

- [SECURITY] fix CVE-2009-2692

- Security fixes:
  - CVE-2009-0146
  - CVE-2009-0147
  - CVE-2009-0166
  - CVE-2009-0799
  - CVE-2009-0800
  - CVE-2009-1179
  - CVE-2009-1180
  - CVE-2009-1181
  - CVE-2009-1182
  - CVE-2009-1183

- fixed CVE-2009-1185

- Fix CVE-2008-5824.

- Fix ffmpeg <r16846 Type conversion vulnerability (CVE-2009-0385).
- Fix CVE-2008-2132.

- Fix CVE-2008-5187.

- Fixes from 0.8.6-bugfix git branch.
- Fixes CVE-2008-4654, CVE-2008-4686, CVE-2008-3732, CVE-2008-3794.

- Fix CVE-2008-4309.

- CVE-2008-4552 fixed

- Rebuild for 4.1
- Security fix: CVE-2008-3714 (AWStats URL Cross-Site Scripting Vulnerability)

- CVE-2008-3651 and CVE-2008-3652 patches from RedHat package
  ipsec-tools-0.6.5-9.3:
  + for DoS through various memory leaks (rh#456660, rh#458846)
- other patches from RH

- CVE-2008-1801
- CVE-2008-1802
- CVE-2008-1803

- CVE-2008-1669: add rcu_read_lock()  to fs/locks.c and fix fcntl store/load
- CVE-2008-1375: Race condition in the directory notification subsystem (dnotify)
- CVE-2008-1294: does not check when a user attempts to set RLIMIT_CPU to 0
- update to std-smp-alt12.M40.1

- New version 0.64
  -- fix buffer overflow in image fills (CVE-2008-1928)
  -- multiple improvements in image converting code
  -- several other bug fixes and improvements, see Changes for details

- move to 2.2.9
- fixed CVE-2007-6714 (thanks to mike@)

- 2.8.16 -> 2.8.17+cvs20070108
- fix for buffer overflow in sqlite_decode_binary (CVE-2007-1888)
- split package sqlite-doc, renamed sqlite-devel to libsqlite-devel

- fix CVE-2008-0888

- 5.0.51a.
- Security fixes:
  + CVE-2008-0226, CVE-2008-0227 (Three vulnerabilities in yaSSL versions 1.7.5
    that could lead to a server crash or execution of unauthorized code.)
  + ALTER VIEW retained the original DEFINER value, even when altered by
    another user, which could allow that user to gain the access rights of the
    view (MySQL #29908).
- Add glibc-locales to -server deps (ALT #13909 #14731).
- Make links to mysqld_safe for backwards compatibility (ALT #14863).
- Update html documentation to 10265 revsion.

- 2.6.19. Security fixes:
  + CVE-2008-1066 (Smarty "regex_replace" Modifier Template Security Bypass)

- 2.2.8
- Adding SECURITY to upstream:
  + CVE-2007-6421 (cve.mitre.org)
  + CVE-2007-6422 (cve.mitre.org)
  + CVE-2007-6388 (cve.mitre.org)
  + CVE-2007-5000 (cve.mitre.org)
  + CVE-2008-0005 (cve.mitre.org)
- Fix #14601: less-than-optimal examples in con/sites-available.
  (Thanks Mikhail Gusarov <dottedmag altlinux org>)
  + update apache2-2.2.6-alt-configs-0.1.patch to
    apache2-2.2.8-alt-configs-0.2.patch
- Updating patchs for 2.2.6:
  + apache2-2.2.6-alt-debian.conf-0.1.patch to
    apache2-2.2.8-alt-debian.conf-0.1.patch
  + apache2-2.2.6-alt-default_https.conf.in-0.1.patch to
    apache2-2.2.8-alt-default_https.conf.in-0.1.patch
  + apache2-2.2.6-alt-cgi-0.1.patch to
    apache2-2.2.8-alt-cgi-0.1.patch

- 1.4.4: fixes CVE-2008-0806 (insecure tmpfile handling, see also
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466382)

- Buffer overflow fix in RLE decompression (CVE-2008-0544).

- Security-related changes:
  + CVE-2008-0600: splice: fix user pointer access in get_iovec_page_array()
  + check iovec buffers in __bio_map_user_iov() (fixes issue with SG_IO)
  + guard against attempts to call get_user_pages() for 0 pages

- 8.4.17 released
- CVE-2006-4484 fixed

- Updated to new version 4.8, fixes CVE-2007-6415 problem
- Change source URL to SourceForge

- Security fix: CVE-2007-6122

- 2.5.23.
- Removed cvs-CVE-2006-5969 patch (obsolete).
- Enabled HTML documentation build (new in 2.5.22); added HTML docs to the
  fvwm-base package.
- Added alt-configure-datarootdir patch: fake datarootdir for autoconf-2.59
  (temporary build fix while autoconf >= 2.60 is not available).
- Added alt-htmldoc patch: fix HTML documentation build and installation.
- Updated BuildRequires.

- Fixed CVE-2007-4460 (SA26536):
  Insecure temporary file privilege escalation.

- Updated to 3.9.7 (fixes CVE-2007-3798: BGP dissector integer overflow).

- Updated to 1.4.2.3 (fixes CVE-2007-1558).

- Fixed integer overflow check (CVE-2007-1536), reported by Colin Percival.

- 1.3.4:
  + Security fix - remote DoS - malformed GRE packets can terminate PPTP
  connections (CVE-2007-0244)
  + Fix two release critical packet reordering bugs
  + Some other (see NEWS)
- Add dirty hack for fix wtmp work on x86_64 (re-Closes: #9817)
- Update default options.pptpd

- ac20050924p1: security fixes for CVE-2006-4335, CVE-2006-4337,
  CVE-2006-4338 (DoS, system access)
- removed patch1, patch2, patch4, patch5 (didn't apply)

- Security fix: CVE-2007-0619.
- Update URL.

- Updated to 4.1.4 (fixes CVE-2005-2974 and CVE-2005-3350 but
  the code remains far from clean yet).