- Backported upstream fix for Sourceware#15014 (CVE-2015-0235).

- applied the upstream provided patch to fix CVE-2013-2944
  (ECDSA signature vulnerability if openssl backend is loaded)

- CVE-2012-1182

- Backport to p5 branch (CVE-2010-3087 CVE-2010-2595 CVE-2011-0192 CVE-2011-1167)
- no libtiffxx subpackage

- Backport to p5 (fixes CVE-2011-1764)

- Backport to p5 (fixes CVE-2011-1720)

- Backport to p5 branch (fixes CVE-2011-1091)

- backport to p5 branch (fixes CVE-2010-4494)

- backport to p5 branch (fixed CVE-2010-3846)

- backport to p5 (new version with CVE-2010-2937 fix)
- disable services_discovery/libudev_plugin.so
- disable SDL_image support

- backport to p5 branch (fixed CVE-2009-2473)

- backport to p5 branch (fixed CVE-2010-3364)

- backport to p5 branch (fixed CVE-2010-3315)

- fix CVE-2010-3703

- CVE-2010-2962
- build af_packet as module

- Fixed CVE-2010-1192, CVE-2010-1194 (certificate validation flaws).
  Fix backported from 1.0.6

- Fixed CVE-2010-2480 - XSS via inadequate escaping (patch from ubuntu)
  + lib/mako/filters.py: use xml.sax.saxutils.escape instead of
  cgi.escape so we can escape single quotes.

- Updated to 1.0.6 (fixes CVE-2010-0405).

- imported security fixes from openSUSE 3.1.11a-84.5 package:
  + CVE-2007-6720:
    denial of service (crash) by loading multiple MOD files
    with different numbers of channels
  + CVE-2009-0179:
    denial of service (crash) by loading an XM file
  + CVE-2009-3995:
    arbitrary code execution via (1) crafted samples
    or (2) crafted instrument definitions in an Impulse Tracker file
  + CVE-2009-3996:
    arbitrary code execution via an Ultratracker file

- New version: CVE-2010-2799 fixed (closes #23839).

- backport to p5 branch (security fixes: CVE-2010-0212 and CVE-2010-0211)

- Updated to 1.2.44 (fixes: CVE-2010-1205, CVE-2010-2249).

- updated to fc 7.4
- CVE-2009-0033, CVE-2009-0580 (closes: 20311, 20314)
- su -s /bin/sh -c instead of su - (closes: #23073)

- fixed stack-based buffer overflow (CVE-2009-4274)
- fixed build
  + netpbm-10.35-alt-fix-overflow-destination-buffer.patch
  + netpbm-10.35-fix-gcc43.patch (backported fix)

- fix TFTP server vulnerabilities (CVE-2009-2957, CVE-2009-2958).

- Backported upstream fix for CVE-2010-0426 (a flaw in sudoedit could
  give a user with permission to run sudoedit the ability to run
  arbitrary commands).

- 1.24. Contains security fixes for CVE-2010-0292, CVE-2010-0293, CVE-2010-0294.

- 2.8.2
- CVE-2009-3297 (ALT #22834)

- new version (closes #18943)
- fixed CVE-2009-2446 from upstream (closes #20724)
- setup utf8 encoding instead of latin1 by default (closes #12390)
- include C99 aliasing violation patch from mythtv (closes #22452)
- removed username-length patch
- wait for mysqld shutdown (closes #22234)
- don't run initial setup mysql database if mysql.user table already exists

- Applied upstream fix for integer underflow bug (CVE-2010-0001).

- Fix String#ljust, String#rjust and String#center breakage after
  CVE-2009-4124 fix

- 2.0.5:
  + fix CVE-2008-5718
  + more bugfixes

- [SECURITY] Fix CVE-2009-1298 
- fixes in Samsung U200 driver. thx to mikhail@linux-rb.ru
- Add support  Samsung YP-CP3. Thx to vitty@altlinux.org

- Apply xpdf-3.02pl4 security patch to fix:
  CVE-2009-3603, CVE-2009-3604, CVE-2009-3605, CVE-2009-3606,
  CVE-2009-3608, CVE-2009-3609.

- NMU: security fix for CVE-2009-2368 (array index overflow) (ALT #20701)
  + thanks crux@ for heads-up

- 4.22.8
- fix connection to the Yahoo messanger protocol
- fix CVE-2008-4776

- Backported upstream fix for a remote DoS bug (CVE-2009-0696).

- fix build with gcc
- Add patch to prevent restriction bypass using OpenSSH's scp options -F
  and -o (CVE-2007-6415)

- server/dhcp.c (ack_lease): Imported fix for potential
  premature server termination (Christoph Biedl; CVE-2009-1892).

- Security fix (CVE-2009-2294) (Closes: 20680)

- 4.2.4p7
- fix for CVE-2009-1252 (closes: #20099)
- fix for CVE-2009-0159 (closes: #19779)

- Security fix: eggdrop remote crash vulnerability (incomplete patch for
  CVE-2007-2807) (Closes: #20067)

- [15.7a] (closes: #19952)
 + CVE-2009-0148

- new release
- s-t-b moved to sbindir (Closes: 17516)
- security fix: CVE-2008-4311

- NMU: 0.8.7
- Security fixes:
  + CVE-2009-1438 (Closes: 19694)
  + PATinst() Buffer Overflow Vulnerability (Closes: 19824)
- removed obosolete post{,un}_ldconfig

- Fix CVE-2008-5824.

- Updated to 2.6.22. Security fixes:
  + CVE-2008-4810
  + CVE-2008-4811

- applied patches against CVE-2008-2149, CVE-2008-3908 (fix bug #15678)

- Fix CVE-2008-5187.

- new version 2.5.0b1 (with rpmrb script)
- due CVE-2007-5934 (fix bug #16173)

- Fix CVE-2008-2109.

- ac20050924p1: security fixes for CVE-2006-4335, CVE-2006-4337,
  CVE-2006-4338 (DoS, system access)
- removed patch1, patch2, patch4, patch5 (didn't apply)