- new version
- security fixes:
  CVE-2017-2925, CVE-2017-2926, CVE-2017-2927, CVE-2017-2928,
  CVE-2017-2930, CVE-2017-2931, CVE-2017-2932, CVE-2017-2933,
  CVE-2017-2934, CVE-2017-2935, CVE-2017-2936, CVE-2017-2937,
  CVE-2017-2938

- Backported upstream fixes for CVE-2015-5352, CVE-2015-6563,
  CVE-2015-6564.

- Really applied upstream fix for CVE-2016-2776.
- Applied fix for CVE-2016-2848.

- Thanks Alt Linux Active Users Club and personally yyy@
- Apply security patch from Debian:
  Disable support for reading input from a shell command, or writing
  output to a shell command. This was done by the pipe (|) prefix. It
  was possible to perform a command injection as discrived by
  CVE-2016-5118 since it use popen.

- Fixed CVE-2015-7547.

- Updated to 1.0.0p (fixes CVE-2014-3571, CVE-2015-0206,
  CVE-2014-3569, CVE-2014-3572, CVE-2015-0204, CVE-2015-0205,
  CVE-2014-8275, CVE-2014-3570).

- New version 3.14.5
- Security fixes:
  + CVE-2013-5605 Handle invalid handshake packets

- CVE-2013-2174 fixed (curl_easy_unescape() may parse data beyond the end of the input buffer)

- applied the upstream provided patch to fix CVE-2013-2944
  (ECDSA signature vulnerability if openssl backend is loaded)

- Fixed CVE-2013-1667: memory exhaustion with arbitrary hash keys

- 2.10.6
- p6 security update (fix CVE-2012-3374)

- Security fix: CVE-2012-3547
- Fixed permissions for /etc/raddb/modules, /etc/raddb/sql/mysql,
  /etc/raddb/sql/postgresql dirs (640 -> 750)

- 3.6.4 (CVE-2012-1182)

- Updated to 1.2.49 (fixes CVE-2011-3048).

- Updated to 2.12 (fixes CVE-2012-1569).

- Backport to p6 branch (fixes CVE-2011-3372)

- 1.8.2. Security fixes:
  + CVE-2011-3601
  + CVE-2011-3602
  + CVE-2011-3603
  + CVE-2011-3604
  + CVE-2011-3605

- NMU: 0.8.8.4
- Security fixes:
  CVE-2011-2911 CVE-2011-2912 CVE-2011-2913 CVE-2011-2914 CVE-2011-2915

- Blindly updated 0.2.1.30 (fixes numerous bugs including CVE-2011-0427).
- Updated build dependencies.

- 4.1.1 including CVE-2011-1898 fix

- 6.3.20
  + fixes CVE-2011-1947: STARTTLS denial of service vulnerability
    (thanks ldv@ for heads-up)

- 3.8.10. Security fixes:
  + CVE-2011-1689
  + CVE-2011-1688
  + CVE-2011-1687
  + CVE-2011-1686
  + CVE-2011-1685
- Enhance findreq skiplist.

- New version (fixes CVE-2011-1401).

- snapshot of 2.6 branch (20101015)
- fixed CVE-2010-1526 (ALT #24399)

- Imported fix of race conditions in ncpmount/ncpumount operations
  from Fedora (fixes CVE-2009-3297).

- 0.37.1
- Fix buffer overflow when processing list of controllers from command line (CVE-2011-1006)

- fixes for CVE-2010-4410 and CVE-2010-4411 (v5.12.3-RC2-1-gb7fa2ac)

- some backports
- security fix: CVE-2010-2891 (ALT #24394)

- new version
- fix CVE-2010-3357 (closes: #24316)

- 2.6.32.24
- CVE-2010-3904 fixed

- New version 1.0.6:
  + Fixed CVE-2010-1192, CVE-2010-1194 (certificate validation flaws)
- Build changes:
  + Disabled static build
  + Fixed install section
  + Plugins moved from devel subpackage to the main

- Backported upstream fix for CVE-2010-1163 (env_reset, ignore_dot and
  secure_path sudoers options all had to be explicitly disabled
  to make an attack possible).
- Backported upstream fix for CVE-2010-1646 (env_reset sudoers option
  had to be explicitly disabled to make an attack possible).

- 1.24. Contains security fixes for CVE-2010-0292, CVE-2010-0293, CVE-2010-0294.

- NMU: security fix for CVE-2009-2368 (array index overflow) (ALT #20701)
  + thanks crux@ for heads-up

- fix build with gcc
- Add patch to prevent restriction bypass using OpenSSH's scp options -F
  and -o (CVE-2007-6415)

- Security fix: eggdrop remote crash vulnerability (incomplete patch for
  CVE-2007-2807) (Closes: #20067)

- Updated to 2.6.22. Security fixes:
  + CVE-2008-4810
  + CVE-2008-4811

- ac20050924p1: security fixes for CVE-2006-4335, CVE-2006-4337,
  CVE-2006-4338 (DoS, system access)
- removed patch1, patch2, patch4, patch5 (didn't apply)