- 1.5.2 (Fixes: CVE-2023-0676, CVE-2023-0677, CVE-2023-0678, CVE-2023-1211, CVE-2023-1212).

- 15.3 (Fixes CVE-2023-2454, CVE-2023-2455)

- 14.8 (Fixes CVE-2023-2454, CVE-2023-2455)

- 13.11 (Fixes CVE-2023-2454, CVE-2023-2455)

- 12.15 (Fixes CVE-2023-2454, CVE-2023-2455)

- 11.20 (Fixes CVE-2023-2454, CVE-2023-2455)

- 15.3 (Fixes CVE-2023-2454, CVE-2023-2455)

- 4.0.5
- Fixes:
    * CVE-2023-1994 GQUIC dissector crash.
    * CVE-2023-1993 LISP dissector large loop.
    * CVE-2023-1992 RPCoRDMA dissector crash.
    * CVE-2023-1161 ISO 15765 and ISO 10681 dissector crash.

- 2.17.6 (Fixes: CVE-2021-3905, CVE-2023-1668, CVE-2022-4337, CVE-2022-4338)

- 2.33.7 -> 2.33.8 (fixes: CVE-2023-25652, CVE-2023-25815, CVE-2023-29007).

- disabled CONFIG_USER_NS: CVE-2023-1281, CVE-2023-1829

- 1.10.3.
- switch to meson.
- Security fixes for CVE-2020-11721, CVE-2020-19668.

- Update to security release of Samba 4.16 with update libldb to 2.5.3:
  + ldb wildcard matching makes excessive allocations (Samba#15331).

- Security fixes (Samba#15270, Samba#15315):
  + CVE-2023-0922: The Samba AD DC administration tool, when operating against a
                   remote LDAP server, will by default send new or reset
                   passwords over a signed-only connection.
                   https://www.samba.org/samba/security/CVE-2023-0922.html

  + CVE-2023-0614: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919
                   Confidential attribute disclosure via LDAP filters was
                   insufficient and an attacker may be able to obtain
                   confidential BitLocker recovery keys from a Samba AD DC.
                   Installations with such secrets in their Samba AD should
                   assume they have been obtained and need replacing.
                   https://www.samba.org/samba/security/CVE-2023-0614.html

- 0.9.76 released (fixes: CVE-2023-27371)

- 1.1.4 (Fixes CVE-2023-27478)
- Change URL to new upstream project
- Use CMAKE

- Added patches from upstream git:
  + Avoid undefined behaviour with the ctype(3) functions
  + Fix --rev-server option
  + Fix possible SEGV when no servers defined
  + Set the default maximum DNS UDP packet size to 1232
    (fixes: CVE-2023-28450)
  + Fix DHCPv6 "use multicast" response which previously failed

- New version 3.2.18.
- Fixes for the following security vulnerabilities:
  + CVE-2023-23969 Potential denial-of-service via ``Accept-Language`` headers
  + CVE-2023-24580 Potential denial-of-service vulnerability in file uploads

- Updated to upstream version 3.9.16 (Closes: #45598) (Fixes: CVE-2022-37454).

- 1.14.4 (fixed CVE-2023-28100, CVE-2023-28101)

- New version 9.5.12
- This release fixes several security issues that has been recently discovered. Update is recommended!
- Security fixes:
 + CVE-2023-22722 : XSS on browse views
 + CVE-2023-22725 : XSS on external links
 + CVE-2023-23610 : Unauthorized access to data export
 + CVE-2022-41941 : Stored XSS inside Standard Interface Help Link href attribute

- 2.4.56 (Fixes: CVE-2023-25690, CVE-2023-27522)

- 0.103.8 (CVE-2023-20032, CVE-2023-20052)

- Patches from gnutls-3.7.9:
   + auth/rsa: side-step potential side-channel (fixes: CVE-2023-0361);
   + rsa: remove dead code.

- 8.1.15 -> 8.1.16 (Fixes: CVE-2023-0567, CVE-2023-0568, CVE-2023-0662)

- 8.0.27 -> 8.0.28 (Fixes: CVE-2023-0567, CVE-2023-0568, CVE-2023-0662)

- 8.2.2 -> 8.2.3 (Fixes: CVE-2023-0567, CVE-2023-0568, CVE-2023-0662)

- 9.16.36 -> 9.16.37 (fixes: CVE-2022-3094, CVE-2022-3736, CVE-2022-3924).

- Applied security fixes from upstream (Fixes: CVE-2022-23308, CVE-2022-29824,
  CVE-2022-40303, CVE-2022-40304).

- JBIG2Stream: Fix crash on broken file (CVE-2021-30860, CVE-2022-27337, CVE-2022-38784)

- 3.5.15 (fixes: CVE-2022-46285, CVE-2022-44617, CVE-2022-4883)

- cherry pick upstream fixes for CVE-2018-19876, CVE-2020-35492

- Fixed libssl knob.
- Fixed License tag.
- Added Vcs tag.
- Patch from upstream:
  + Fixed crash when st_info_list is NULL (fixes: CVE-2022-4121).

- Applied SUSE patches (fixed tiff-CVE-2022-2056, CVE-2022-2057, CVE-2022-2058,
  CVE-2022-2519, CVE-2022-2520, CVE-2022-2521, CVE-2022-3597, CVE-2022-3598,
  CVE-2022-3599, CVE-2022-3626, CVE-2022-3627, CVE-2022-3970 and
  CVE-2022-34526) (closes #44499).

- security (fixes: CVE-2022-36227)

- 4.4.2 (Fixes: CVE-2022-28487, CVE-2022-27942, CVE-2022-27940, CVE-2022-37047, CVE-2022-37049,
     CVE-2022-27939, CVE-2022-25484, CVE-2022-27941)

- New version.
- Fixed multiple client side input validation issues
  (CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319,
  CVE-2022-39320, CVE-2022-41877, CVE-2022-39347).

- 1.19.4 (Fixes: CVE-2022-42898)

- Backported upstream commit "mpz/inp_raw.c: Avoid bit size overflows"
  (thx Marco Bodrato) (fixes CVE-2021-43618).

- E2K:
  + added mcst patches, mostly as-is except:
    - 0003-Add-copy-optimizations.patch: partially obsolete
    - 0006-Add-bug-workaround.patch: obsolete for arch > e2kv2
    - 0010-Restore-DRI1-support.{add,mod}.patch: need more reverts
    - 0040-Fix-CVE-2018-14665.patch: applied elsewhere upstream
    and specifically, including:
    - 0010-restore-DRI1-support-for-e1c.patch
    - mga2 related patch from mcst#5155
  + warning-related ftbfs workarounds

- Fixes (CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,
  CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789,
  CVE-2022-40284)

- apply upstream commit a1f88e842e0216a5b4df1ab023caebe33c101395
  to fix CVE-2022-44638

- 7.4.32 -> 7.4.33 (Fixes: CVE-2022-31630, CVE-2022-37454)

- Applied security fixes (fixes CVE-2021-4217).

- security (fixes: CVE-2020-29260)

- Fixes patch CVE-2015-0557-security-traversal-dir (ALT #44143).

- 1.22.1 (Fixes: CVE-2022-41741, CVE-2022-41742)

- fixes CVE-2014-10401

- Add support LDAP add/mod operation to set/change password:
 + fix unable to join to active directory after KB5008380/CVE-2021-42287 with
   option '--ldap-passwd';
 + https://gitlab.freedesktop.org/realmd/adcli/-/issues/27
- Add support fall back to LDAPS if CLDAP ping was not successful
 + If the --use-ldaps option is used and there is no reply on the CLDAP 389/udp
   port adcli will try to send the request to the LDAPS port 636/tcp.
- Fix write SID before secret to Samba's db looks like 'net changesecretpw'
- Add passwd-user sub-command for (re)set a user password.
- Add dont-expire-password option for computer.

- New version (2.38.1) (fixes: CVE-2023-0563).

- CVE-2022-3140 kludge

- fixes CVE-2019-25051

- fixes CVE-2018-10195.

- fixes CVE-2021-4217

- 2.8.1 -> 2.11.0 (fixes: CVE-2022-24302).

- Updated to 4.4.3-P1 (fixes: CVE-2022-2928,CVE-2022-2929).

- E2K: apply mcst patches, including CVE-2018-6621 fix

- Fixes: CVE-2022-30550.

- Update to stable release 6.15 (Samba#15025, Samba#15026)
- mount.cifs: fix length check for ip option parsing (fixes: CVE-2022-27239)
- mount.cifs: fix verbose messages on option parsing (fixes: CVE-2022-29869)

- new version 1.37.2 (with rpmrb script)
- (T297571, CVE-2022-28201) (T297731, CVE-2022-28203)
- (T297754, CVE-2022-28204) (T297543, CVE-2022-28202)

- NMU (fixes: CVE-2021-4034).
- Applied upstream fix for a trivially exploitable local root vulnerability,
  see https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

- Secutiry update (fixed: CVE-2015-20107).
- Fixed Url field.

- Updated to 4.16.4 (fixes: CVE-2022-32278).

- New version (Closes: 42217)
- Security fixes:
  + CVE-2022-0547: possible authentication bypass if multiple
    authentication plugins tries to do deferred authentication
- Fix build with new python3-module-docutils

- Version bump
- Many bugfixes, including security, including:
  Fixes: CVE-2022-24106, CVE-2022-27135

- Autobuild version bump to 6.1.7
- Fixes: CVE-2022-30333

- 2.5.0 (fixed CVE-2013-4289, CVE-2013-4290, CVE-2019-6988, 
  CVE-2018-20846, CVE-2018-16376, CVE-2021-29338)

- Backported upstream security fixes (fixes CVE-2019-6111, CVE-2019-6109).

- new version 1.41 (Fixes: CVE-2022-23096, CVE-2022-23097, CVE-2022-23098)

- Updated to 2.4.3 (with multiple security fixes).
- Fixes:
  + CVE-2021-45960 issues with left shift by >= 29 places in function storeAtts that
    can lead to realloc misbehavior;
  + CVE-2021-46143 Integer overflow on variable m_groupSize in function doProlog;
  + CVE-2022-22822 Integer overflows near memory allocation in function addBinding;
  + CVE-2022-22823 Integer overflows near memory allocation in function build_model;
  + CVE-2022-22824 Integer overflows near memory allocation in function defineAttribute;
  + CVE-2022-22825 Integer overflows near memory allocation in function lookup;
  + CVE-2022-22826 Integer overflows near memory allocation in function nextScaffoldPart;
  + CVE-2022-22827 Integer overflows near memory allocation in function storeAtts.

- new version 1.0.13 (Fixes: CVE-2021-43612)
- migrate /var/run -> /run

- 2.1.37 -> 2.1.38 (fixes for CVE-2021-44227).

- New version
- Security fixes:
  + CVE-2021-41099: buffer overflow with non-default configuration
  + CVE-2021-32762: buffer overflow issue in redis-cli and redis-sentinel
  + CVE-2021-32687: buffer overflow with non-default configuration
  + CVE-2021-32675: Denial Of Service when processing RESP request payloads
  + CVE-2021-32672: random heap reading issue with Lua Debugger
  + CVE-2021-32628: buffer overflow with non-default configuration
  + CVE-2021-32627: buffer overflow with non-default configuration
  + CVE-2021-32626: Lua scripts may result with Heap buffer overflow
  + CVE-2021-32761: integer overflow in BITFIELD on 32-bit versions

- Applied SUSE combchar.diff to prevent DoS via crafted UTF-8 character
  sequence (fixes CVE-2021-26937).

- 0.2.5 (fixed CVE-2021-39358)

- 2.0 (fixed CVE-2021-3403, CVE-2021-3404)

- fix build, apply patches from upstream
- .service: use /run instead of /var/run
- CVE-2021-32749

- (Fixes: CVE-2021-3781)

- 3.2.8 (fixes: CVE-2021-33582)

- new version
- security (fixes: CVE-2021-3634)

- 1.2.18
- Fixes:
  + CVE-2020-35701 SQL Injection was possible due to incorrect validation order
  + CVE-2020-14424 Lack of escaping on file input fields can lead to XSS exposure under midwinter theme

- New version.
- Upstream:
  + CVE-2021-28091: Fix signature checking on unsigned response with multiple assertions.
  + configure.ac: Disable java bindings.

- applied debian patchset (fixed CVE-2018-13440, CVE-2018-17095)
- made flac support optional (enabled by default)
- made %check verbose
- enabled documentation
- fixed License tag

- new version (1.3.0) with rpmgs script
- CVE-2020-9382, CVE-2020-35625

- 4.15
- Fixes:
  + CVE-2020-25097 HTTP Request Smuggling.
  + CVE-2021-28651 Denial of Service in URN processing.
  + CVE-2021-28652 Denial of Service issue in Cache Manager.
  + CVE-2021-28662 Denial of Service in HTTP Response Processing.
  + CVE-2021-31806 Improper input validation in HTTP Range header.
  + CVE-2021-31807 Incorrect memory management may lead to DoS.
  + CVE-2021-31808 An integer overflow may lead to a DoS.
  + CVE-2021-33620 Denial of Service in HTTP Response processing.
- update langpack to 20210511

- Updated to 6.2.8.
- Updated book to 1.02.
- Fixed CVE-2021-30184.
- Packed watch and upstream public signing key to sourcerpm.

- update to 4.94.2 (fix CVE-2020-28007 ... CVE-2020-28026 and CVE-2021-27216)

- avoid infinite-loop in avahi-daemon (closes: #39357) (fixes: CVE-2021-3468)

- 0.15.0 (Fixes: CVE-2020-14355)

- 8.1.2 released (fixes: CVE-2021-27921, CVE-2021-27922, CVE-2021-27923)

- New version.
- Fixes:
  + CVE-2020-17525 Remote unauthenticated denial-of-service in Subversion mod_authz_svn

- 0.3.15 released
- Corrected mutliple security issues in tcsd
  (Fixes: CVE-2020-24332, CVE-2020-24330, CVE-2020-24331)

- Applied security fix from upstream (Fixes CVE-2018-16789).

- Applied security fix from upstream (Fixes CVE-2018-8754).

- Applied security fix from upstream (Fixes CVE-2018-18584).

- Applied security patches from Debian and Gentoo (Fixes: CVE-2014-0466, CVE-2015-8107).

- Updated to upstream version 0.32.3 (Fixes: CVE-2017-5208,
  CVE-2017-5331, CVE-2017-5332, CVE-2017-5333).

- Applied security patch from Gentoo (Fixes: CVE-2017-9430).

- Updated to upstream version 1.2.1 (Fixes: CVE-2018-16741, CVE-2018-16742,
  CVE-2018-16743, CVE-2018-16744, CVE-2018-16745, CVE-2019-1010189, CVE-2019-1010190).

- Applied security fix from upstream (Fixes: CVE-2019-14495).

- Updated to upstream version 1.18.0 (Fixes: CVE-2017-5991, CVE-2018-10289,
  CVE-2018-16647, CVE-2018-16648, CVE-2019-14975, CVE-2020-26519).