Bug Fixes

BZ#1193243

When a suffix-mapping tree entry was created without the corresponding back-end database, the server failed to start. This bug has been fixed.

BZ#1145072

If a value of a password policy attribute was deleted, it caused a null reference and an unexpected termination of the server. These crashes no longer occur.

BZ#1080185, BZ#1138745

This update fixes a memory leak caused by a previous patch for BZ#1080185.

BZ#1048987

If a Virtual List View search fails with the timelimit or adminlimit parameters exceeded, the allocated memory of the IDL no longer leaks.

BZ#1162704

If a search for "passwordAdminDN" in a "cn=config" entry returns a non-existing value, a memory leak no longer occurs.

BZ#1169975

Rebuilding the Class of Service (CoS) cache no longer causes a memory leak.

BZ#1115960

A bug in the nested CoS, when the closest above password policy was sometimes not selected as expected, has been fixed.

BZ#1169974

When a SASL bind operation fails and Account Lockout is enabled, the Root DSE entry no longer gets incorrectly updated with passwordRetryCount.

BZ#1145379

Password restrictions and syntax checks for Directory Manager and password administrators are now properly applied so that these roles are not affected by them.

BZ#1175868, BZ#1166313

Performance degradation with searches in large groups has been fixed by introducing normalized DN cache.

BZ#1153739

Due to a known vulnerability in SSLv3, this protocol is now disabled by default.

BZ#1207024

This update adds the flow control so that unbalanced process speed between a supplier and a consumer does not cause replication to become unresponsive.

BZ#1171308

A bug to replicate an "add: userPassword" operation has been fixed.

BZ#1145374, BZ#1183820

A bug in the Windows Sync plug-in code caused AD-only member values to be accidentally removed. Now, local and remote entries are handled properly, preventing data loss.

BZ#1144092

Performing a schema reload sometimes caused a running search to fail to return results. Now, the old schema is not removed until the reload is complete. The search results are no longer corrupted.

BZ#1203338

The Berkeley DB library terminated unexpectedly when the Directory Server simultaneously opened an index file and performed a search on the "cn=monitor" subtree. The two operations are now mutually exclusive, which prevents the crash.

BZ#1223068, BZ#1228402

When simple paged results requests were sent to the Directory Server asynchronously and then abandoned immediately, the search results could leak. Also, the implementation of simple paged results was not thread-safe. This update fixes the leak and modifies the code to be thread-safe.

Enhancements

BZ#1167976

A new memberOf plug-in configuration attribute memberOfSkipNested has been added. This attribute allows you to skip the nested group check, which improves performance of delete operations.

BZ#1118285

The Directory Server now supports TLS versions supported by the NSS library.

BZ#1193241

The logconv.pl utility has been updated to include information about the SSL/TLS versions in the access log.

Bug Fixes

BZ#1181207

NetworkManager could not handle bonding parameters on the kernel command line with Kickstart installations and could terminate unexpectedly. With this update, Kickstart installations succeed.

BZ#1156564

Adding a connection available only to a particular user via nm-connection-editor could result in an incomplete connection being interpreted by the NetworkManager daemon. Applying this unintended configuration caused NetworkManager to terminate unexpectedly. Now, invalid connections are not created, and NetworkManager no longer crashes.

BZ#1173245

Saving Wireless Enterprise connections (802.1X-based) in the editor with the "Available to all users" and "Ask for this password every time" settings created an invalid profile, which disappeared after saving. With this update, nm-connection-editor does not allow saving invalid connections.

BZ#1076169

Previously, NetworkManager sometimes failed to set up DHCPv6, and IPv6 was not configured. With this update, NetworkManager parses RA flags correctly and runs DHCPv6 as intended.

BZ#1085015

This update fixes the translation of the "Create New Ad-Hoc Wireless Network" nm-applet menu entry.

BZ#1003877

Primary bond options were not properly handled in NetworkManager and nm-connection-editor. Now, configurations with active-backup bonds work as intended.

BZ#1157867

Removing an alias ifcfg file made NetworkManager disconnect both the alias and the base interfaces. This has been fixed.

BZ#1167491

When a user mistyped the gateway IP, no warning was provided. Now, nm-connection-editor informs the user of a possibly incorrect gateway field.

BZ#1207599

NetworkManager could sometimes contain duplicated IPv6 addresses in its configuration. With this update, there are no duplicated IPv6 addresses on the D-Bus interface and in the nmcli tool.

BZ#1213327

The nmcli tool could become unresponsive if both NetworkManager and nm-applet were stopped and the "nmcli con" command was issued.

BZ#1111672

Connections with a missing or 0.0.0.0 next-hop address were regarded as invalid.

Enhancements

BZ#979181

Previously, the NM_CONTROLLED=no setting only worked if HWADDR was also set. Now, it is also possible to specify that a device is unmanaged by setting NM_CONTROLLED=no and DEVICE=<interface>.

BZ#1063661

NetworkManager did not allow configuring VLAN on top of bond devices, and Anaconda installations using VLAN over bond did not work. This update adds support for VLANs (IEEE 802.11q) on top of Ethernet Bonds and Ethernet Bridges (IEEE 802.1d).

BZ#905641

This update enhances nm-connection-editor, which now enables easier editing of IP addresses and routes. In addition, nm-connection-editor attempts to automatically detect and highlight typos and incorrect configurations.

BZ#1056790

With this update, NetworkManager supports arping when configuring static IP addresses, so statically configured IPv4 addresses to other nodes on the local network are announced.

BZ#1046074

NetworkManager now supports the "multicast_snooping" option, configured via BRIDGING_OPTS in the ifcfg file, for bridge interfaces.

BZ#1200131

With this update, custom DNS options can be configured in connection profiles. The DNS options are read and written using the RES_OPTIONS variable in ifcfg files.

Bug Fixes

BZ#1140837

Prior to this update, if the RPM v3 binary was used to re-sign custom and third-party unsigned packages, PackageKit could not handle installing these packages. As a consequence, installing certain packages using the PackageKit GUI could fail with the following error message:

pct = div * (ts_current - 1) + pct_start + ((div / 100.0) * val)

This update fixes PackageKit to handle these rare cases, and the installation no longer fails in the described situation.

BZ#1172119

Previously, when MAILTO recipients were set in the /etc/sysconfig/packagekit-background file, the /etc/cron.daily/packagekit-background.cron script only checked for the return value from the pkcon command before trying to send email reports. As a consequence, two unnecessary empty emails were sent under certain circumstances. With this update, the $PKTMP file is not attempted to be sent by email if the files is empty, and only emails with useful information are now sent in the described scenario.

Bug Fix

BZ#1125304

Due to the changes made to X Virtual Frame Buffer (Xvfb) in Red Hat Enterprise Linux 6.6, the XGrabPointer() function started to return a value of 0 if used on an SDL window placed outside the Xvfb root window boundaries. Consequently, if an SDL program expected the original return value, a problem could occur. With this update, the SDL library conforms to the new behavior, and programs using this library now work as expected.

Bug Fix

BZ#1205603

An attempt to upgrade the SDL library without upgrading the libX11 library could result in applications emitting the following error:

symbol lookup error: /usr/lib64/libSDL-1.2.so.0: undefined symbol: _XGetRequest after updating SDL

This update modifies the SDL spec file to prevent an upgrade on systems with a too outdated libX11 version. As a result, the mentioned error no longer occurs.

Bug Fixes

BZ#1199261

The abrt-addon-ccpp process logs messages using the rsyslog daemon. When rsyslog terminated unexpectedly, abrt-addon-ccpp could enter a deadlock state, because the /dev/log socket was not freed. The underlying source code has been modified to fix this bug, and the deadlock no longer occurs in the described situation.

BZ#1208154

The "bootloader" plug-in was renamed to "boot". However, ABRT still used the old name when generating SOS reports. As a consequence, ABRT did not include SOS report data in its crash reports. With this update, ABRT now uses the correct name and generates SOS reports as expected.

BZ#1212095

The libreport library could previously change mode of any file or mode of the dump directory because it followed symbolic links. Also, libreport could change ownership of a new dump directory. This behavior could lead to security issues. With this update, this bug has been fixed, and libreport no longer changes modes or ownership.

Enhancement

BZ#1150197, BZ#1152222, BZ#1153311

This update introduces ABRT micro-reporting. When a crash occurs, users can now send authenticated reports about the problem called micro-reports. These reports contain non-sensitive data describing the problem and optionally host name, machine ID, and RHN account number. Micro-reports help Red Hat to track bug occurrences and to provide instant solutions to crashes. See https://access.redhat.com/node/642323 for more information about micro-reporting.

Bug Fixes

BZ#1145812

On the custom storage screen, selecting mountpoint and format as EFI System Partition caused the following error message to be displayed:

You have not created a /boot/efi partition.

This update modifies the way boot devices are looked up. As a result, an acceptable boot device is located and no error is reported in the described situation.

BZ#1139606

The Anaconda installer set the "boot" flag on the PowerPC Reference Platform (PReP) partition when using GUID Partition Table (GPT) disks. Consequently, the GUID of the partition changed to the EFI System Partition instead of PReP. Now, when using GPT disks, the boot flag is only set on boot partitions that are formatted as EFI partitions, and the PReP partition GUID is no longer replaced with the ESP GUID.

BZ#1153376

The LVM physical volume (PV) and volume group (VG) size was sometimes smaller than expected. Consequently, Anaconda sometimes tried to create a logical volume (LV) that was larger than the available space in the VG. Now, Anaconda verifies the amount of available space when creating a LV and if the request is too large, only the available space is used. Also, a warning message is included in the storage.log file.

BZ#1129499

Under specific circumstances, if a device lookup by name failed, the function failed instead of gracefully returning "no such device". As a consequence, Anaconda terminated unexpectedly. With this update, if a device lookup by name fails, it is treated as if nothing was found instead of an error.

BZ#1083586

Previously, Anaconda forced the vesa driver after the Linux framebuffer (fbdev). As a consquence, the X server could terminate unexpectedly while booting. Now, Anaconda no longer crashes.

BZ#979163

Some servers use network cards that take a very long time to initialize since the link is reported as being available. Consequently, the download of the kickstart file failed. This update re-adds support for the "nicdelay" installer boot option by using NetworkManager's feature of checking the gateway with a ping before the device is reported as connected. As a result, for servers with network cards taking a very long time to initialize, the "nicdelay" boot option can be used to prevent kickstart download from failing.

BZ#1168024

When starting the VNC server, Anaconda always passed the "-nevershared" option, and Anaconda only allowed one VNC connection. This update removes the "-nevershared" option. The user has to use the "-shared" option from their VNC client to connect to a shared connection.

BZ#1021445

The Anaconda installer searched for prepboot disks with a preference for those on the same disk as /boot. If a user deleted all partitions including /boot, the object would be a NoneType. Consequently, Anaconda terminated unexpectedly. This update adds a guard to perform a safe default in the described situation.

Enhancements

BZ#1144979

On IBM System z, if LDL-formatted Direct Access Storage Devices (DASDs) are detected, the Anaconda installer now displays a warning dialog that explains the problem and presents a list of the detected Linux Disk Layout (LDL) DASDs with an option to format them as Compatible Disk Layout (CDL). Before, although LDL DASDs were recognized by the kernel, they were not officially supported in the installer. The user can now choose whether or not to format the detected LDL DASDs as CDL.

BZ#1083459

This update adds support for LVM Thin Provisioning as a device type within the Anaconda installer and kickstart configuration.

Bug Fixes

BZ#994201

Due to incorrect race condition handling in the "atd" daemon, "atd" terminated unexpectedly. With this update, "atd" handles the race condition correctly, so that now "atd" no longer terminates in the described scenario.

BZ#1166882

Previously, the "at" command was not properly checking the return value of the fclose() function call. As a consequence, if the /var/spool/at file system filled up, "at" could leave empty stale files in the spool directory. With this update, "at" properly checks the return value from fclose(), and "at" no longer leaves empty files in spool in the described scenario.

Bug Fixes

BZ#1112388

Previously, some cgroup controller types used in the /etc/cgconfig.conf file were not recognized. As a consequence, parsing error occurred in Augeas and an error message was returned. With this update, the Augeas module can parse files containing these controller names as expected.

BZ#1121263

Entries in the /etc/services file containing colons in the service name prevented Augeas from parsing the file. This update makes sure that the "service_name" field in the services.aug file is able to support the colon character, and the aforementioned entries can now be parsed successfully.

BZ#1129508

When entries in /etc/rsyslog.conf were configured for remote logging over Transmission Control Protocol (TCP), Augeas was unable to parse the file. The underlying source code has been fixed, and files containing this configuration are now parsed successfully.

BZ#1144652

By default, the /etc/sysconfig/iptables.save file was parsed by the wrong module, which led to a parsing failure and an error reported by Augeas. The wrong module has been substituted with a correct one, and /etc/sysconfig/iptables.save is now parsed correctly by default.

BZ#1175854

Previously, the Augeas utility did not correctly parse the "ssh" and "fence_kdump_*" parameters in the /etc/kdump.conf file. As a consequence, using Augeas to edit these parameters in kdump configuration failed. With this update, Augeas has been updated to parse "ssh" and "fence_kdump_*" as intended, and the described problem no longer occurs.

BZ#1186318

Previously, the aug_match API returned paths of files and nodes with special characters unescaped, unsuitable for use in further API calls. Consequently, specially constructed file names could cause programs built on Augeas to function incorrectly, and implementing escaping in such programs was impossible. With this update, Augeas escapes paths returned from aug_match correctly, and paths returned from aug_match can be used safely and reliably in further API calls.

BZ#1203597

Prior to this update, Augeas was unable to parse the /etc/krb5.conf configuration files containing values with curly brackets ("{}"). To fix this bug, Augeas lens (parser) has been fixed to handle these characters in krb5.conf setting values, and Augeas can now parse these krb5.conf files as expected.

BZ#1209885

Previously. Augeas was unable to parse the .properties (Java-style) files containing a multi-line value that begins with a blank line. Augeas lens (parser) has been fixed to accept an empty starting line, thus fixing this bug.

Enhancement

BZ#1160261

A lens for the /etc/shadow file format has been added to Augeas to parse the shadow password file.

Bug Fixes

BZ#1145137

Prior to this update, it was not possible to specify multiple Lightweight Directory Access Protocol (LDAP) servers with the authconfig command. This bug has been fixed, and multiple LDAP servers can now be specified as expected.

BZ#1194397

Previously, the authconfig utility did not pass passwords provided by the "--winbindjoin" option when calling "net join". Consequently, the user was asked for a password. Now, passwords are passed by authconfig to "net join" automatically, and users do not have to provide them in this situation.

Security Fix

CVE-2014-8169

It was found that program-based automounter maps that used interpreted languages such as Python would use standard environment variables to locate and load modules of those languages. A local attacker could potentially use this flaw to escalate their privileges on the system.

Note

This issue has been fixed by adding the "AUTOFS_" prefix to the affected environment variables so that they are not used to subvert the system. A configuration option ("force_standard_program_map_env") to override this prefix and to use the environment variables without the prefix has been added. In addition, warnings have been added to the manual page and to the installed configuration file. Now, by default the standard variables of the program map are provided only with the prefix added to its name.

Bug Fixes

BZ#1163957

If the "ls *" command was executed before a valid mount, the autofs program failed on further mount attempts inside the mount point, whether the mount point was valid or not. While attempting to mount, the "ls *" command of the root directory of an indirect mount was executed, which led to an attempt to mount "*", causing it to be added to the negative map entry cache. This bug has been fixed by checking for and not adding "*" while updating the negative map entry cache.

BZ#1124083

The autofs program by design did not mount host map entries that were duplicate exports in an NFS server export list. The duplicate entries in a multi-mount map entry were recognized as a syntax error and autofs refused to perform mounts when the duplicate entries occurred. Now, autofs has been changed to continue mounting the last seen instance of the duplicate entry rather than fail, and to report the problem in the log files to alert the system administrator.

BZ#1153130

The autofs program did not recognize the yp map type in the master map. This was caused by another change in the master map parser to fix a problem with detecting the map format associated with mapping the type in the master map. The change led to an incorrect length for the type comparison of yp maps that resulted in a match operation failure. This bug has been fixed by correcting the length which is used for the comparison.

BZ#1156387

The autofs program did not update the export list of the Sun-format maps of the network shares exported from an NFS server. This happened due to a change of the Sun-format map parser leading to the hosts map update to stop working on the map re-read operation. The bug has been now fixed by selectively preventing this type of update only for the Sun-formatted maps. The updates of the export list on the Sun-format maps are now visible and refreshing of the export list is no longer supported for the Sun-formatted hosts map.

BZ#1175671

Within changes made for adding of the Sun-format maps, an incorrect check was added that caused a segmentation fault in the Sun-format map parser in certain circumstances. This has been now fixed by analyzing the intent of the incorrect check and changing it in order to properly identify the conditions without causing a fault.

BZ#1201195

A bug in the autofs program map lookup module caused an incorrect map format type comparison. The incorrect comparison affected the Sun-format program maps where it led to the unused macro definitions. The bug in the comparison has been fixed so that the macro definitions are not present for the Sun-format program maps.

Bug Fix

BZ#1015671

Previously, the b43-openfwwf firmware was incorrectly recognized as the closed-source b43 firmware from Broadcom, which caused the b43 driver to expect the behavior of the Broadcom b43 firmware. This update corrects the location where the firmware images are installed, and as a result, the b43-openfwwf firmware is recognized correctly.

Bug Fix

BZ#839249

Previously, the length of bacula daemon names was limited to 30 characters and any additional characters were automatically truncated without displaying an error message. The truncated name was passed to other applications that, as a consequence, did not work as expected. With this update, the limit has been exceeded to 64 characters, so the length of the name is no longer cut.

Bug Fixes

BZ#1148507

Prior to this update, Bash refused to import previously exported functions whose names contained a hyphen. As a consequence, scripts that used such functions did not work properly, and Bash printed the following error message:

bash: error importing function definition for `BASH_FUNC_function-name'

With this update, Bash accepts hyphens in the names of imported functions.

BZ#1150544, BZ#1155455

Previously, Bash incorrectly parsed function definitions containing a here-document that ended with the end-of-file or end-of-string character. Consequently, Bash accessed an invalid memory segment when the parsed function was copied, and Bash terminated with a segmentation fault. This problem has been fixed. As a result, Bash no longer crashes when the aforementioned function definitions are used.

BZ#1119587

The section in the Bash man page describing the ulimit command did not contain the fact that 512-byte blocks are used for the "-c" and "-f" options in POSIX mode. This information has now been added.

Bug Fixes

BZ#1112356

Previously, the "slip" option was not handled correctly in the Response Rate Limiting (RRL) code in BIND, and the variable counting the number of queries was not reset after each query, but after every other query. As a consequence, when the "slip" value of the RRL feature was set to one, instead of slipping every query, every other query was dropped. To fix this bug, the RRL code has been amended to reset the variable correctly according to the configuration. Now, when the "slip" value of the RRL feature is set to one, every query is slipped as expected.

BZ#1142152

BIND incorrectly handled errors returned by dynamic databases (from dyndbAPI). Consequently, BIND could enter a deadlock situation on shutdown under certain circumstances. The dyndb API has been fixed not to cause a deadlock during BIND shutdown after the dynamic database returns an error, and BIND now shuts down normally in the described situation.

BZ#1146893

Because the Simplified Database Backend (SDB) application interface did not handle unexpected SDB database driver errors properly, BIND used with SDB could terminate unexpectedly when such errors occurred. With this update, the SDB application interface has been cleaned to handle these errors correctly, and BIND used with SDB no longer crashes if they happen.

BZ#1175321

Due to a race condition in the beginexclusive() function, the BIND DNS server (named) could terminate unexpectedly while loading configuration. To fix this bug, a patch has been applied, and the race condition no longer occurs.

BZ#1215687

Previously, when the resolver was under heavy load, some clients could receive a SERVFAIL response from the server and numerous "out of memory/success" log messages in BIND's log. Also, cached records with low TTL (1) could expire prematurely. Internal hardcoded limits in the resolver have been increased, and conditions for expiring cached records with low TTL (1) have been made stricter. This prevents the resolver from reaching the limits when under heavy load, and the "out of memory/success" log messages from being received. Cached records with low TTL (1) no longer expire prematurely.

Enhancement

BZ#1176476

Users can now use RPZ-NSIP and RPZ-NSDNAME records with Response Policy Zone (RPZ) in the BIND configuration.

Bug Fixes

BZ#1175318

Previously, the bind-dyndb-ldap 2.x driver (used in Red Hat Enterprise Linux 6.x) did not handle forward zones correctly when it was in the same replication topology as bind-dyndb-ldap 6.x (used in Red Hat Enterprise Linux 7.1). As a consequence, forward zones stopped working on all replicas. The underlying source code has been patched to fix this bug, and forward zones now continue to work in the described situation.

BZ#1142176

The bind-dyndb-ldap library incorrectly compared current time and the expiration time of the Kerberos ticket used for authentication to an LDAP server. As a consequence, the Kerberos ticket was not renewed under certain circumstances, which caused the connection to the LDAP server to fail. The connection failure often happened after a BIND service reload was triggered by the logrotate utility. A patch has been applied to fix this bug, and Kerberos tickets are correctly renewed in this scenario.

BZ#1126841

Prior to this update, the bind-dyndb-ldap plug-in incorrectly locked certain data structures. Consequently, a race condition during forwarder address reconfiguration could cause BIND to terminate unexpectedly. This bug has been fixed, bind-dyndb-ldap now locks data structures properly, and BIND no longer crashes in this scenario.

BZ#1219568

Previously, the bind-dyndb-ldap plug-in incorrectly handled timeouts which occurred during LDAP operations. As a consequence, under very specific circumstances, the BIND daemon could terminate unexpectedly. With this update, bind-dyndb-ldap has been fixed to correctly handle timeouts during LDAP operations and the BIND daemon no longer crashes in this scenario.

BZ#1183805

The documentation for bind-dyndb-ldap-2.3 located in the /usr/share/doc/bind-dyndb-ldap-2.3/README file incorrectly stated that the "idnsAllowTransfer" and "idnsAllowQuery" LDAP attributes are multi-valued. Consequently, users were not able to configure DNS zone transfer and query acess control lists according to the documentation. The documentation has been fixed to explain the correct attribute syntax.

Bug Fix

BZ#1175590

On IBM System z, the linker sometimes generated undesirable runtime relocations for thread-local-storage variables. These undesirable relocations could under certain circumstances cause execmod AVC errors. This bug has been fixed, and AVC errors are no longer returned in this scenario.

Bug Fixes

BZ#1133523

Previously, the biosdevname utility did not parse Vital Product Data (VPD) correctly. As a consequence, names for network interfaces on Vindicator 2 Emulex card were displayed incorrectly when NIC extended partitioning (nPAR-EP) was enabled. VPD parsing has been modified, and Network interface names are now displayed correctly.

BZ#1207557

Prior to this update, the biosdevname utility did not read Vital Product Data (VPD) on NICs with vpd-r:2.0, which resulted in incorrect network interface names when NIC partitioning (NPAR) was enabled on certain NICs. With this update, biosdevname reads VPD data also in cases when NIC has vpdr:2.0, and interface names are now formed as expected if NPAR is enabled.

BZ#1212449

Due to a scheme used for slot numbers derivation, the biosdevname utility did not populate proper names for Virtual Functions (VFs) of on-board NICs. Now, the scheme that enables VFs of on-board NICs can have proper names, too.

Enhancements

BZ#1158564

attribute for a new Mellanox driver and allowing naming of FCoE devices to be ignored.

BZ#1003465, BZ#1084225

This update provides an implementation of 10-GB Ethernet adapters naming scheme from Mellanox. Now, the biosdevname utility produces expected network interface names for Mellanox 10-GB Ethernet adapters that have 2 physical ports on the same PCI device. The /sys/class/net/<iface>/dev_port attribute is designed to distinguish network interfaces.

Bug Fixes

BZ#1169501

When compiling a C++ program using the Boost.MPI library, the compiling process previously failed to find the "boost::mpi::environment::environment(bool)" symbol and terminated with an "undefined reference" error. This update adds the missing symbol, and the described compiling process now successfully creates an executable.

BZ#1128313

Previously, the boost packages could use packages for different architectures as their dependencies, which in some cases led to a variety of problems with the functionality of the Boost clients. With this update, dependency declarations specify the architecture of the package where relevant, and all packages necessary for correct operation of the Boost clients are downloaded properly.

BZ#1167383, BZ#1170010

Prior to this update, a number of Boost libraries were not compatible with the GNU Compiler Collection (GCC) provided with Red Hat Developer Toolset. A fix has been implemented to address this problem, and the affected libraries now properly work with Red Hat Developer Toolset GCC.

Bug Fixes

BZ#1163023

Prior to this update, after the user upgraded from Red Hat Enterprise Linux 6.5 to Red Hat Enterprise Linux 6.6 and rebooted the system, certmonger in some cases erroneously exited shortly after starting or performed a series of unnecessary checks for new certificates. A patch has been applied to fix this bug, and these problems no longer occur in the described situation.

BZ#1178190

Previously, the "getcert list" command did not display the "pre-save command" and "post-save command" values. As a consequence, running "getcert list" could return incomplete results. With this update, the problem has been fixed, and running "getcert list" displays the "pre-save command" and "post-save command" values as expected.

Enhancements

BZ#1161768

The certmonger service now supports the Simple Certificate Enrollment Protocol (SCEP). For obtaining certificates from servers, the user can now offer enrollment over SCEP.

BZ#1169806

Requesting a certificate using the getcert utility during an IdM client kickstart enrollment no longer requires certmonger to be running. Previously, an attempt to do this failed because certmonger was not running. With this update, getcert can successfully request a certificate in the described situation, on the condition that the D-Bus daemon is not running. Note that certmonger requires a system reboot to start monitoring the certificate obtained in this way.

BZ#1222595

Previously, after the user ran the "getcert list" command, the output included the PIN value if it was set for the certificate. Consequently, the user could unintentionally expose the PIN, for example by publicly sharing the output of the command. With this update, the "getcert list" output only contains a note that a PIN is set for the certificate. As a result, the PIN value itself is no longer displayed in the "getcert list" output.

Bug Fix

BZ#965103

Previously, when the chkconfig utility modified a file in the /etc/xinetd.d/ directory, it set the file permissions to "644" and the SELinux context to "root:object_r:etc_t". Such permissions, however, do not adhere to the Defense Information Systems Agency's (DISA) Security Technical Implementation Guide (STIG), which requires files in /etc/xinetd.d/ to be unreadable by other users. With this update, chkconfig ensures that the xinetd files it modifies have the "600" permissions and the correct SELinux context is preserved.

Bug Fix

BZ#1080482

Previously, attempts to mount a CIFS share failed when the system keytab was stored in a non-default location specified using the default_keytab_name setting in the /etc/krb5.conf file, even when the user provided the correct Kerberos credentials. However, mounting succeeded when default_keytab_name pointed to the default /etc/krb5.keytab file. The cifs.upcall helper process has been modified to respect non-default keytab locations provided using default_keytab_name. As a result, CIFS mount now works as expected even when the keytab is stored in a non-default location.

Bug Fixes

BZ#1149516

Previously, the gfs2_convert utility or a certain corruption could introduce bogus values for the ondisk inode "di_goal_meta" field. Consequently, these bogus values could affect GFS2 block allocation, cause an EBADSLT error on such inodes, and could disallow the creation of new files in directories or new blocks in regular files. With this update, gfs2_convert calculates the correct values. The fsck.gfs2 utility now also has the capability to identify and fix incorrect inode goal values, and the described problems no longer occur.

BZ#1121693

The gfs2_quota, gfs2_tool, gfs2_grow, and gfs2_jadd utilities did not mount the gfs2 meta file system with the "context" mount option matching the "context" option used for mounting the parent gfs2 file system. Consequently, the affected gfs2 utilities failed with an error message "Device or resource busy" when run with SELinux enabled. The mentioned gfs2 utilities have been updated to pass the "context" mount option of the gfs2 file system to the meta file system, and they no longer fail when SELinux is enabled.

BZ#1133724

A race condition in the dlm_controld daemon could be triggered when reloading the configuration, which caused a dangling file pointer to be written to. Consequently, under certain rare conditions, dlm_controld could terminate unexpectedly with a segmentation fault, leaving Distributed Lock Manager (DLM) lockspaces unmanaged and requiring a system reboot to clear. This bug has been fixed, and dlm_controld no longer crashes when the configuration is updated.

BZ#1087286

Previously, errors generated while updating the resource-agents scheme were sometimes not reported. As a consequence, if an error occurred when updating the resource-agents schema, the update failed silently and later attempts to start the cman service could fail as well. With this update, schema errors are reported, and remedial action can be taken at upgrade time in case of problems.

Enhancements

BZ#1099223

The qdiskd daemon now automatically enables the master_wins mode when votes for the quorum disk default to 1 or when the number of votes is explicitly set to 1. As a result, quorum disk configuration is more consistent with the documentation, and a misconfiguration is avoided.

BZ#1095418

A new error message has been added to the qdiskd daemon, which prevents qdiskd from starting if it is configured with no heuristics in a cluster with three or more nodes. Heuristics are required in clusters with three or more nodes using a quorum device for correct operation in the event of a tie-break. Now, if no heuristics are specified and the cluster contains three or more nodes, the cman service fails to start and an error message is returned. This behavior prevents misconfigurations.

Bug Fix

BZ#1111249, BZ#1114622

The internal ricci API has been extended with an ability to temporarily stop a clustered resource, which was used to resolve the BZ#1111249 enhancement request in the luci packages, documented in the RHBA-2015:20054 erratum.

Bug Fix

BZ#1115626

Previously, after the user inserted a contactless PIV card, coolkey could not access it in a contactless way. As a consequence, the light indicating the card status started to blink inconsistently, and the Enterprise Security Client (ESC) failed to detect the card. With this patch, coolkey accesses the card certificate or key instead of the PIV authentication, PIV signing, or PIV key exchange keys. As a result, when the user inserts a contactless PIV card, ECS now successfully detects it.

Bug Fix

BZ#1136431

When the corosync utility was configured with the IPv6 network and packet fragmentation was disabled on the Network Interface Controller (NIC) or switch, no packets were delivered. This update implements a correct calculation of the data fragment size, and packets are delivered as intended.

Enhancements

BZ#1163846

Earlier when using the UDP unicast (UDPU) protocol, all messages were sent to all the configured members, instead of being sent to only the active members. This makes sense for merge detection messages, otherwise it creates unnecessary traffic to missing members and can trigger excessive Address Resolution Protocol (ARP) requests on the network. The corosync code has been modified to only send messages to the missing members when it is required, otherwise to only send messages to the active ring members. Thus, most of the UDPU messages are now sent only to the active members with an exception of the messages required for proper detection of a merge or a new member (1-2 pkts/sec).

BZ#742999

With this update, the corosync packages have been modified to test whether the network interface has different IP address, port, and IP version when using the Redundant Ring Protocol (RRP) mode. Now, corosync properly checks correctness of the configuration file and prevents failures when using the RRP mode.

Bug Fix

BZ#728999

Previously, the debug options in the package build scripts were disabled. Consequently, the debuginfo packages were not generated for the cpufrequtils utility. With this update, the debug options in the build scripts have been enabled, and debuginfo options are now available for cpufrequtils binary files.

Enhancement

BZ#730304

Prior to this update, the cpufreq-aperf utility was missing man pages. To provide the user with more information on cpufreq-aperf, the man pages have been added.

Enhancement

BZ#1187332

The turbostat utility now supports the 6th Generation Intel Core Processors – for mobile and desktop.

Bug Fix

BZ#1196755, BZ#1211828, BZ#1219780, BZ#1225024

A previous update brought in a change in the kernel introducing the intel_pstate driver, incompatible with how scaling was managed until Red Hat Enterprise Linux 6.7. Consequently, the cpuspeed service printed needless error messages during system boot and shutdown. With this update, platforms using intel_pstate support only the "performance" and "powersave" scaling governors, the default option and default state being "powersave". If the user has set a different governor from the above-mentioned, for example "ondemand" or "conservative", they have to edit the configuration and choose one from the two, "powersave" or "performance". In addition, needless error messages are no longer returned.

Bug Fixes

BZ#1179480

A prior update of the AMD64 and Intel 64 kernels removed the STACKFAULT exception stack. As a consequence, using the "bt" command with the updated kernels previously displayed an incorrect exception stack name if the backtrace originated in an exception stack other than STACKFAULT. In addition, the "mach" command displayed incorrect names for exception stacks other than STACKFAULT. This update ensures that stack names are generated properly in the described circumstances, and both "bt" and "mach" now display correct information.

BZ#1208557

Attempting to run the crash utility with the vmcore and vmlinux files previously caused crash to enter an infinite loop and became unresponsive. With this update, the handling of errors when gathering tasks from pid_hash[] chains during session initialization has been enhanced. Now, if a pid_hash[] chain has been corrupted, the patch prevents the initialization sequence from entering an infinite loop. This prevents the described failure of the crash utility from occurring. In addition, the error messages associated with corrupt or invalid pid_hash[] chains have been updated to report the pid_hash[] index number.

BZ#1073987

On certain system configurations, the "kmem -f", "kmem -F", and "kmem [address]" command options previously took a very long time to complete. This update increases the internal hash queue size used to store the address of each free page, and streamlines the free page search to only check the NUMA node that contains a specified address. As a result, the mentioned "kmem" options no longer have a negative impact on performance.

Enhancement

BZ#1195596

The makedumpfile command now supports the new sadump format that can represent more than 16 TB of physical memory space. This allows users of makedumpfile to read dump files over 16 TB, generated by sadump on certain upcoming server models.

Bug Fix

BZ#1204175

Due to a regression in parsing the /etc/anacrontab file caused by the previous cronie erratum released in the Fastrack channel, environment variables set in the /etc/anacrontab file were not recognized, and error messages were logged. These updated cronie packages fix the regression, and the variables are now set correctly for anacron jobs.

Bug Fixes

BZ#1031383

Previously, the anacron process could terminate unexpectedly in cases when the anacrontab file contained incorrect configuration settings. To fix this bug, the configuration settings format check has been amended, and the anacron process no longer crashes.

BZ#1082232

Prior to this update, the crond pid file could be erroneously removed in case a crond sub-process terminated unexpectedly. With this update, handling of the crond sub-processes termination has been corrected, and the removal no longer occurs.

Enhancements

BZ#1108384

The crond daemon now logs shutdowns. Its proper terminations are therefore distinguishable from abnormal ones.

BZ#1123984

The crond daemon now logs errors when jobs are skipped due to getpwnam() call failures.

Bug Fixes

BZ#951553

Incorrect reference for PageLogFormat in HTML documentation has been corrected, and PageLogFormat documentation is now accessible.

BZ#988062

Documentation for the operation of the CUPS Line Printer Daemon back-end "sanitize_title" option has been amended and now describes the option clearly.

BZ#1145064, BZ#1178370

Due to a problem with HTTP multipart handling in the CUPS scheduler, some browsers did not work as expected when attempting to add a printer using the web interface. A change from a later version has been backported enabling adding printers in all browsers without problems.

BZ#1161171

It was not possible to disable Secure Sockets Layer (SSLv3) and keep other secure protocols enabled in CUPS. This left CUPS users vulnerable to the POODLE attack (CVE-2014-3566), and needing to deploy the stunnel utility for mitigation. This update disables SSLv3 support by default. For users who need to continue using SSLv3, an SSLOptions configuration directive has been added to the cupsd.conf file for the cupsd service and to the client.conf file for the client programs.

BZ#1164854

When the BrowsePoll configuration directive was used and the remote server configured for polling forbade access, the cups-polld process retried accessing immediately in a busy loop. The process consumed all processor time and increased network traffic. With this update, a mandatory delay of ten seconds has been introduced to prevent that. Affected users should also fix their configuration by removing the BrowsePoll line for the server, or adjusting the server to allow remote queries.

BZ#1170002

The CUPS scheduler incorrectly assumed the print queue still existed when there were only implicit classes with all members deleted due to being unresponsive. When sending a job using separate Create-Job and Send-Document requests to an implicit class whose members were being deleted, the CUPS scheduler terminated unexpectedly with a NULL dereference. The scheduler has been amended to respond with an error instead of crashing in this case.

BZ#1187840

A missing NULL check in job processing code caused the CUPS scheduler to terminate unexpectedly when a job with more than one file aborted due to a filter failure. This update adds the check to prevent the CUPS scheduler from crashing in the described situation.

BZ#1196217

The ErrorPolicy configuration directive was not validated on startup, and an unintended default error policy could be used without a warning. The directive is now validated on startup and reset to the default if the configured value is incorrect. The intended policy is used, or a warning message is logged.

BZ#1198394

Due to an incomplete fix in a prior update, some environment variables were not correctly set on startup, which led to SELinux denials. The remainder of the original fix has been added, and the variables are now set correctly on startup.

Enhancements

BZ#1115219

It is now possible to direct jobs to a single printer with failover to other printers instead of using load balancing among printers that is built into CUPS. Jobs can be directed to the first working printer of a set, the preferred printer, with other printers used only if the preferred one is unavailable.

BZ#1120587

Description of the ErrorPolicy directive with supported values has been added to the cupsd.conf(5) man page. The ErrorPolicy directive defines the default policy used when a back end is unable to send a print job to the printer.

Security Fixes

CVE-2014-3613

It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker able to trick a user into connecting to a malicious server could use this flaw to set the user's cookie to a crafted domain, making other cookie-related issues easier to exploit.

CVE-2014-3707

A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPT_COPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory.

CVE-2014-8150

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct additional requests.

CVE-2015-3143, CVE-2015-3148

It was discovered that libcurl implemented aspects of the NTLM and Negotatiate authentication incorrectly. If an application uses libcurl and the affected mechanisms in a specifc way, certain requests to a previously NTLM-authenticated server could appears as sent by the wrong authenticated user. Additionally, the initial set of credentials for HTTP Negotiate-authenticated requests could be reused in subsequent requests, although a different set of credentials was specified.

Bug Fixes

BZ#1154059

An out-of-protocol fallback to SSL version 3.0 (SSLv3.0) was available with libcurl. Attackers could abuse the fallback to force downgrade of the SSL version. The fallback has been removed from libcurl. Users requiring this functionality can explicitly enable SSLv3.0 through the libcurl API.

BZ#883002

A single upload transfer through the FILE protocol opened the destination file twice. If the inotify kernel subsystem monitored the file, two events were produced unnecessarily. The file is now opened only once per upload.

BZ#1008178

Utilities using libcurl for SCP/SFTP transfers could terminate unexpectedly when the system was running in FIPS mode.

BZ#1009455

Using the "--retry" option with the curl utility could cause curl to terminate unexpectedly with a segmentation fault. Now, adding "--retry" no longer causes curl to crash.

BZ#1120196

The "curl --trace-time" command did not use the correct local time when printing timestamps. Now, "curl --trace-time" works as expected.

BZ#1146528

The valgrind utility could report dynamically allocated memory leaks on curl exit. Now, curl performs a global shutdown of the NetScape Portable Runtime (NSPR) library on exit, and valgrind no longer reports the memory leaks.

BZ#1161163

Previously, libcurl returned an incorrect value of the CURLINFO_HEADER_SIZE field when a proxy server appended its own headers to the HTTP response. Now, the returned value is valid.

Enhancements

BZ#1012136

The "--tlsv1.0", "--tlsv1.1", and "--tlsv1.2" options are available for specifying the minor version of the TLS protocol to be negotiated by NSS. The "--tlsv1" option now negotiates the highest version of the TLS protocol supported by both the client and the server.

BZ#1058767, BZ#1156422

It is now possible to explicitly enable or disable the ECC and the new AES cipher suites to be used for TLS.

Bug Fixes

BZ#880121

If the multipathd daemon failed to add a multipath device, in some circumstances, it was freeing the alias and then accessing it and attempting to free it again. Consequently, multipathd terminated unexpectedly. With this update, multipathd no longer frees the alias twice, or attempts to access the freed alias, and thus no longer crashes in the described situation.

BZ#1120047

Previously, any target port with the ALUA preference bit set was given a higher priority than all other target ports. Consequently, when a target port had the preference bit set, multipath did not balance load between it and other ports that were equally optimized. With this update, the preference bit only increases the priority of paths that are not already optimized. Now, if the preference bit is set on a non-optimized port, the port is used. However, if the preference bit is set on an optimized port, all optimized ports are used, and multipath loads balance across them.

BZ#1136966

When the parted utility created partitions on an existing multipath device, it raced with the kpartx utility to create the partitions. This could cause device or resource busy errors. Now, kpartx only creates partition devices when the multipath device is activated, and no longer automatically creates partitions when parted is run on existing multipath devices.

BZ#1148096

Previously, a multipath device was not assigned a user_friendly_name by initramfs, which caused a conflict with the name already assigned by the normal system. Because of the name conflict, multipath could try to update the wrong device, and thus cause data corruption. To fix this bug, multipath checks paths to see if a device's user_friendly_name is already assigned, and assigns a new one if it is.

BZ#1171862

Previously, the libmultipath utility was keeping a global cache of sysfs data for all programs, even though this was only necessary for the multipathd daemon. As a consequence, a memory error could occur when multiple threads were using libmultipath without locking. This led to unexpected termination of multithreaded programs using the mpath_persistent_reserve_in() or mpath_persistent_reserve_out() functions. With this update, only multipathd uses the global sysfs data cache, and the described crashes are thus avoided.

BZ#1175888

Previously, the first time the multipath utility recognized a path device, the path device was not claimed in the udev utility, and other programs could race multipath to claim it. As a consequence, multipath systems could fail to boot during installation. With this update, the multipathd daemon now checks the kernel command line on startup. If it has recognized any parameters with a World Wide Identifier (WWID) value, it adds those WWIDs to the list of multipath WWIDs. Devices with those WWIDs are thus claimed the first time they are recognized. As a result, if multipath systems do not boot successfully during installation, users can add mpath.wwid=[WWID] to the kernel command line to work around the problem.

Enhancements

BZ#978947

This update adds new built-in configuration for Dell MD36xxf storage arrays.

BZ#997028

With this udpate, multipath autodetects whether an EMC CLARiiON array is set up in ALUA or PNR mode, and correctly configures itself to match.

BZ#1072081

Now, the multipathd daemon has two new configuration options "delay_watch_checks" and "delay_wait_checks". The user is recommended to refer to the multipath(8) man page for more information.

Bug Fixes

BZ#1130804

Previously, the DHCPv6 client was sometimes started to configure a network interface which was not fully loaded. Consequently, dhclient failed to run because the network interface did not have a link-local address yet, which the DHCPv6 client requires. This update adds a wait loop into dhclient-script, and dhclient no longer fails due to a missing link-local address.

BZ#1150587

When the dhcpd daemon was using a plain interface as well as an interface configured as a VLAN trunk, and the dhcpd daemon was configured to listen only on the plain interface, it detected traffic also from VLAN networks, regardless of the configuration. As a consequence, dhcpd was generating incorrect responses. With this update, the bug has been corrected, and in the described scenario, dhcpd now ignores tagged requests, and thus generates correct responses.

BZ#1151054

When running the DHCPv6 relay agent and the "lower" interface was specified ("-l") on the command line before the "upper" interface ("-u"), message relaying did not work. The underlying source code has been fixed, and DHCPv6 relay agent now relays messages properly.

BZ#1185075

When a large number of nodes with InfiniBand network cards booted at the same time, some nodes were assigned duplicate IP addresses. With this update, generation of the xid field in DHCP messages sent by the client has been fixed for the xid fields to be unique, and nodes are now assigned unique IP addresses as expected.

BZ#1187967

Previously, attempting to run the dhcrelay and dhcrelay6 services simultaneously prevented the latter service from starting. The dhcrelay6 init script has been fixed, and running both dhcrelay and dhcrelay6 services no longer causes problems.

Enhancement

BZ#1058674

With this update, the dhcpd daemon is able to handle dhcp option 97 - Client Machine Identifier (pxe-client-id), so it is now possible to statically allocate an IP address for a particular client based on its identifier, sent in option 97.

Bug Fix

BZ#1192357

Prior to this update, the dmidecode utility did not support the DDR4 type of memory. Consequently, compiling of the dmidecode code for hardware with DDR4 memory type gave out of specs results. With this update, dmidecode has been updated so that the DDR4 is among memory types and no longer returns out of specs while compiling the dmidecode source code.

Bug Fixes

BZ#723228

The ports used by dovecot were in some cases unavailable during the boot process by other services, which caused dovecot to fail to start and display an "Address already in use" error. This update configures the portreserve service to ensure that dovecot's ports stay available during the boot process, which prevents the described failure from occurring.

BZ#771336

Previously, the dovecot utility used too small a login input buffer for Kerberos authentication. As a consequence, users who attempted to use Kerberos authentication were not able to log in. This updated version of dovecot uses a bigger input buffer, and users can now authenticate to their email accounts using a Kerberos ticket.

BZ#813957

Prior to this update, dovecot logged a redundant "unable to get certificate" error message when no certification revocation list (CRL) was available. With this update, dovecot no longer treats missing CRL as an error, and no longer logs an error in the mentioned scenario.

BZ#961466

When the LIST-STATUS extension was used with certain hierarchy separator symbols, dovecot in some cases terminated unexpectedly. Consequently, the user was unable to list the contents of their e-mail folder. This update fixes the code for traversing folders, and using LIST-STATUS no longer causes dovecot to crash.

BZ#1131749

Previously, after executing the "uid copy" command against a non-existent mailbox, the dovecot server became unresponsive. As a consequence, the user could not download e-mails unless recovered manually. A patch has been provided to fix this bug, and dovecot no longer hangs in the aforementioned scenario.

Enhancement

BZ#1153041

With this update, it is possible to configure which Secure Sockets Layer (SSL) protocols dovecot allows. Among other things, this allows users to disable SSLv3 connections and thus mitigate the impact of the POODLE vulnerability. Due to security concerns, SSLv2 and SSLv3 are now also disabled by default, and the user has to be allow them manually if required.

Bug Fixes

BZ#1198117

Previously, the dracut utility incorrectly printed an error message if the /tmp/net.$netif.override file did not exist. With this update, dracut verifies whether /tmp/net.$netif.override exists before it attempts to read it, which prevents the described error from occurring.

BZ#1005886

Prior to this update, the dracut logrotate configuration determined that the "time" option had priority over the "size" option. Consequently, the dracut logs were rotated only yearly regardless of their size. This update removes the "time" option of the logrotate configuration, and the dracut logs now rotate when the size exceeds 1 MB.

BZ#1069275

If "ip=ibft" was specified as a kernel command-line argument, but the "ifname=<iface>:<mac>" parameter was not, dracut did not handle network interfaces correctly. As a consequence, iSCSI disks were not connected to the system, and thus the system failed to boot. With this update, dracut handles "ip=ibft" as a kernel command-line argument, even without "ifname=<iface>:<mac>", and iSCSI disks are now connected to the system successfully resulting in successful system boot.

BZ#1085562

If the /etc/crypttab file did not contain a new line as the last character, dracut failed to parse the last line of the file, and the encrypted disk could not be unlocked. This update fixes dracut to handle /etc/crypttab without a new line at the end, and the encrypted disk specified on the last line is now handled as expected, requesting a password and unlocking the disk.

BZ#1130565

If the /etc/lvm/lvm.conf file had host tags defined, the initramfs virtual file system did not insert the /etc/lvm/lvm_hostname.conf file during kernel upgrade, which previously led to a boot failure. This update adds /etc/lvm/lvm_hostname.conf along with /etc/lvm/lvm.conf, and the system now boots with host tags as intended.

BZ#1176671

Previously, dracut did not parse the kernel command line correctly for some iSCSI parameters, which led to iSCSI disks not being connected. With this update, dracut parses the kernel command-line parameters for iSCSI correctly, and iSCSI disks are now connected successfully.

BZ#1184142

Due to an internal change in the nss-softokn-freebl package, dracut could not build an initramfs file in FIPS mode. To fix this bug, nss-softokn-freebl delivers its own dracut module and dracut now requires nss-softokn-freebl as a dependency. As a result, dracut can build FIPS-enabled initramfs with all files.

BZ#1191721

When network parameters were specified on the kernel command line, dracut only attempted to connect to iSCSI targets provided the network could be brought up. Consequently, for misconfigured networks, iSCSI firmware settings or iSCSI offload connections were not explored. To fix this bug, dracut now attempts to connect to the iSCSI targets even if after a certain timeout no network connection can be brought up. As a result, iSCSI targets can be connected even for misconfigured kernel command-line network parameters.

BZ#1193528

Due to changes in FIPS requirements, a new deterministic random-byte generator (drbg) was added to the kernel for FIPS purposes. With this update, dracut loads drbg as other kernel modules in FIPS mode.

Enhancements

BZ#1111358

With this update, dracut can boot from iSCSI on a network with VLANs configured, where the VLAN settings are stored in the iBFT BIOS.

BZ#1226905

LVM thin volumes are now supported in initramfs.

Enhancement

BZ#766443

The dstat utility has been enhanced to support the use of symbolic links as its parameters. This allows users to dynamically specify the boot device name, which ensures that dstat displays correct information after hot plugs and similar operations.

Bug Fix

BZ#1218262

Previously, if the superblock of an ext2, ext3, or ext4 file system contained a "last mount" or "last check" time which was set in the future, the e2fsck utility did not fix the error in "preen" mode. As a consequence, an incorrect system clock could stop the boot process and wait for an administrator intervention due to a failed boot-time file system check. With this update, these time-stamp errors are fixed automatically in "preen" mode, and the boot process is no longer interrupted in the described situation.

Bug Fix

BZ#1200884

Previously, the libsysfs packages were not listed as a dependency for the edac-utils packages. As a consequence, on systems where the libsysfs packages were not installed independently, the edac-utils packages were not fully functional due to the lack of libraries provided by libsysfs. This update adds libsysfs to the list of dependencies for edac-utils. As a result, libsysfs can be automatically installed together with edac-utils, thus providing all the libsysfs libraries necessary for edac-utils to work properly on all systems.

Bug Fix

BZ#1151681

Previously, when the installation of the Generation 2 Virtual Machine (Gen2 VM) on the Hyper-V 2012 and R2 host was completed, the VM disappeared from the Virtual Machines list. As a consequence, the Hyper-V Manager could no longer load the VM settings, which rendered the VM unusable. With this update, the bug in the efibootmgr packages has been fixed so that the VM settings are accessible in the described scenario.

Bug Fix

BZ#1167724

The eu-stack utility supports showing inlined frames and it is now able to produce backtraces even for processes that might have some of their on-disk libraries updated or deleted.

• Improved DWZ compressed DWARF multi-file support with new functions, "dwarf_getalt" and "dwarf_setalt", has been introduced.
• Support for ARM 64-bit architecture and Red Hat Enterprise Linux for POWER, little endian has been added.
• The libdw library now supports LZMA-compressed (.ko.xz) kernel modules.
• Support for ".debug_macro" has been added; new functions has been introduced: "dwarf_getmacros_off", "dwarf_macro_getsrcfiles", "dwarf_macro_getparamcnt", and "dwarf_macro_param".
• New GNU extensions to the DWARF format are now recognized.
• New functions have been added to the libdw library: "dwarf_peel_type", "dwarf_cu_getdwarf", "dwarf_cu_die", "dwelf_elf_gnu_debuglink", "dwelf_dwarf_gnu_debugaltlink", "dwelf_elf_gnu_build_id".

Bug Fixes

BZ#852516

Previously, the data_space_start value was set inaccurately. As a consequence, the emacs text editor returned the following memory warning message:

Emergency (alloc): Warning: past 95% of memory limit

To fix this bug, data_space_start has been set correctly, and emacs no longer returns warning messages.

BZ#986989

When using the glyph face encoding, a text face was not removed from the garbage collector. As a consequence, the emacs text editor terminated unexpectedly with a segmentation fault when attempting to remove the face. With this update, the text face is also removed from the garbage collector, and emacs thus no longer crashes in the described scenario.

Bug Fix

BZ#1015310

Previously, the enchant library opened the user's custom dictionary file in write mode. Consequently, the content of the file was always erased, and any words added to the dictionary earlier were forgotten. With this update, the dictionary file is opened in append mode. As a result, new additions to the custom dictionary no longer delete previously saved words.

Bug Fixes

BZ#979789

Previously, misleading information about available modules in nested module directories was displayed to the user. To fix this bug, the code detecting module versions has been amended, and correct information is now displayed.

BZ#1117307

Prior to this update, modules were not properly unloaded when a loading module file contained the "module unload" command. With this update, the logic in the code for version detection of modules has been modified, and modules that contain the "module unload" command are now unloaded correctly.

Enhancement

BZ#1066605

This update enables the ethtool utility to accept a user-defined Receive-Side Scaling (RSS) hash key value for the Ethernet driver, which improves the performance and security of RSS. As a result, the user can set the RSS hash key value for the Ethernet driver with ethtool.

Bug Fixes

BZ#1163375

The Evolution client could not connect to a mail server using the Secure Sockets Layer (SSL) protocol when the server had SSL disabled due to the POODLE vulnerability. With this update, the Evolution Data Server has been modified to also connect using the Transport Layer Security (TLSv1) protocol, thus fixing this bug.

BZ#1141760

Previously, the e-calendar-factory process did not terminate automatically when the user logged out of the graphical desktop environment, and e-calendar-factory thus redundantly consumed system resources. This update fixes the underlying code, which prevents this problem from occurring.

Bug Fix

BZ#1160279

When the Exchange Web Services (EWS) connector was used, the UI part of the connector failed to load due to a missing external symbol. Consequently, the user could neither change the settings nor configure a new mail account for the EWS part of the evolution-exchange packages. This update corrects the library link options during build time to have the missing symbol available. Now, the UI part of the EWS connector loads properly, and the mail account can be added and configured.

Bug Fix

BZ#1049805, BZ#1094515, BZ#1099551, BZ#1111482, BZ#1118008, BZ#1123897, BZ#1171734

This update adds the "--tls1.0" option to the fence agent for HP Integrated Lights-Out 2 (iLO2) devices. With this option, iLO2 negotiation of the TLS protocol works as expected when using an iLO2 device with firmware version 2.27.

• The fence_kdump agent now supports the "monitor" action, making integration with a cluster stack easier.
• The fence-agents packages now support the fence_ilo_moonshot fence agent for HP Moonshot iLO devices. For information on the fence_ilo_moonshot parameters, see the fence_ilo_moonshot(8) man page.
• This update adds support for the fence_ilo_ssh fence agent. The agent logs into an iLO device using SSH and reboots a specified outlet. For information on the fence_ilo_ssh parameters, see the fence_ilo_ssh(8) man page.
• This update adds support for the fence_mpath fence agent. This agent is an I/O fencing agent that uses SCSI-3 persistent reservations to control access to multipath devices. For information on fence_mpath and its parameters, see the fence_mpath(8) man page.
• The fence agent for APC devices over Simple Network Management Protocol (SNMP) has been updated to support the latest versions of the APC firmware.
• This update adds support for the fence_emerson fencing agent for Emerson devices over Simple Network Management Protocol (SNMP). It is an I/O fencing agent that can be used with the MPX and MPH2 Emerson devices. For information on the parameters for the fence_emerson fencing agent, see the fence_emerson(8) man page.

Bug Fixes

BZ#1125290

Previously, the fence-virt utility in some case incorrectly returned a zero exit code when it detected an error in processing a request. With this update, the static analysis errors that caused this problem have been fixed, and fence-virt now returns appropriate error codes if it detects an error.

BZ#1078197

Due to an incorrectly configured range of supported TCP and multicast ports, fence-virt did previously not work properly with certain ports. This update fixes the range of supported TCP and multicast ports, which prevents the problem form occurring.

Enhancement

BZ#1020992

When the fence-virt and fence-xvm utilities are invoked with the "-o status" parameter, they now print their status in a more comprehensible manner, as either "Status: ON" or "Status: OFF".

Bug Fix

BZ#1024825

Due to a bug in the fprintd daemon code, long-running Pluggable Authentication Module (PAM) clients were experiencing file descriptor leaks for each iteration of authentication. With this update, the file descriptor closes after completing its job, and therefore the file descriptor leaks no longer occur.

Security Fix

CVE-2014-2015

A stack-based buffer overflow was found in the way the FreeRADIUS rlm_pap module handled long password hashes. An attacker able to make radiusd process a malformed password hash could cause the daemon to crash.

Bug Fixes

BZ#1078736

The number of dictionaries have been updated.

* This update implements several Extensible Authentication Protocol (EAP) improvements.

* A number of new expansions have been added, including: %{randstr:...}, %{hex:...}, %{sha1:...}, %{base64:...}, %{tobase64:...}, and %{base64tohex:...}.

* Hexadecimal numbers (0x...) are now supported in %{expr:...} expansions.

* This update adds operator support to the rlm_python module.

* The Dynamic Host Configuration Protocol (DHCP) and DHCP relay code have been finalized.

* This update adds the rlm_cache module to cache arbitrary attributes.

For a complete list of bug fixes and enhancements provided by this rebase, see the freeradius changelog linked to in the References section.

BZ#904578

The /var/log/radius/radutmp file was configured to rotate at one-month intervals, even though this was unnecessary. This update removes /var/log/radius/radutmp from the installed logrotate utility configuration in the /etc/logrotate.d/radiusd file, and /var/log/radius/radutmp is no longer rotated.

BZ#921563

The radiusd service could not write the output file created by the raddebug utility. The raddebug utility now sets appropriate ownership to the output file, allowing radiusd to write the output.

BZ#921567

After starting raddebug using the "raddebug -t 0" command, raddebug exited immediately. A typo in the special case comparison has been fixed, and raddebug now runs for 11.5 days in this situation.

BZ#1060319

MS-CHAP authentication failed when the User-Name and MS-CHAP-User-Name attributes used different encodings, even when the user provided correct credentials. Now, MS-CHAP authentication properly handles mismatching character encodings. Authentication with correct credentials no longer fails in this situation.

BZ#1135439

Automatically generated default certificates used the SHA-1 algorithm message digest, which is considered insecure. The default certificates now use the more secure SHA-256 algorithm message digest.

BZ#1142669

During the Online Certificate Status Protocol (OCSP) validation, radiusd terminated unexpectedly with a segmentation fault after attempting to access the next update field that was not provided by the OCSP responder. Now, radiusd does not crash in this situation and instead continues to complete the OCSP validation.

BZ#1173388

Prior to this update, radiusd failed to work with some of the more recent MikroTIK attributes, because the installed directory.mikrotik file did not include them. This update adds MikroTIK attributes with IDs up to 22 to dictionary.mikrotik, and radiusd now works as expected with these attributes.

Bug Fixes

BZ#1190640

Previously, due to a bug in the stdarg functions optimization, the compiler could produce incorrect code. The problem occurred only when the va_list variable escaped a PHI node. This bug has been fixed, and the compiler now generates correct code.

BZ#1150606

Previously, when the vectorization optimization was enabled, the compiler could extract a scalar component of a vector with element types whose precision did not match the precision of their mode. Consequently, GCC could terminate unexpectedly while trying to vectorize a code that was using bit-fields. With this update, the compiler no longer vectorizes such code, and the code now compiles correctly.

BZ#1177458

Previously, the compiler did not properly handle incorrect usage of the PCH (Precompiled Headers) feature. When a PCH file was not included as the first include, the compiler terminated unexpectedly with a segmentation fault. The compiler has been fixed not to use such incorrect includes, and it no longer crashes in this scenario.

BZ#1134560

In previous versions of the GNU Fortran compiler, the type specifiers for Cray pointees were incorrectly overwritten by the type specifiers of components with the same name. Consequently, compiling failed with an error message. This bug has been fixed, and the Cray pointers are now handled correctly.

Enhancement

BZ#1148120

The gcc hotpatch attribute implements support for online patching of multithreaded code on System z binaries. With this update, it is possible to select specific functions for hotpatching using a "function attribute" and to enable hotpatching for all functions using the "-mhotpatch=" command-line option. As enabled hotpatching has negative impact on software size and performance, it is recommended to use hotpatching for specific functions and not to enable hotpatch support in general.

Bug Fixes

BZ#1099929

When GDB found a thread with PID -1, GDB attempted to attach to that incorrect PID and consequently failed with an internal error. With this update, GDB detects the incorrect PID -1 earlier and displays a warning message to the user. In addition, the debugging session is no longer affected by the scenario described above.

BZ#1117841

GDB used a splay tree to store elements related to address maps. However, when iterating through splay trees that were too large, the recursion of the splay_tree_foreach_helper() function caused GDB to run out of stack, which generated a segmentation fault. The implementation of splay_tree_foreach_helper() has been changed to non-recursive, which improves the efficiency of iterator() and makes GDB avoid the aforementioned failure.

BZ#1119119

Previously, GDB did not check for a NULL pointer when trying to find the charset names from the user environment. This caused GDB to terminate unexpectedly, generating a segmentation fault. With this update, GDB correctly checks if it is dealing with a NULL file pointer, thus fixing the bug.

BZ#1139405

GDB uses the "(anonymous namespace)" string in the string representation of any symbol defined in an anonymous namespace. However, the linespec parser did not recognize that this string was a necessary component, symbol lookups failed and breakpoints could not set or reset on symbols defined in anonymous namespaces. To fix this bug, the anonymous namespace recognition has been abstracted to clarify the unique role of this representation requirement. Additionally, the linespec parser has been updated to properly deal with the required string. As a result, breakpoints on symbols in anonymous namespaces can be properly set or reset by GDB.

BZ#1149205

The "catch syscall" command uses a special type of breakpoint inside GDB, which is not maintained by the code that handles normal breakpoints. Previously, GDB was not able to properly catch a system call in the parent process after the fork() function call. With this update, system call catchpoints are no longer removed from a program that forked itself, and GDB is now able to correctly stop at a call from the parent process after it has forked.

BZ#1156192

A defect in the dlopen() library function previously caused recursive calls to dlopen() to crash or abort with a library assertion. Recursive calls to dlopen() may occur if an implementation of malloc() provided by the user calls dlopen(). The dlopen implementation is now reentrant, and recursive calls to dlopen() no longer crash or abort with an assertion.

BZ#1162264

Under certain conditions, while attaching to a process, GDB can perform the initial low level ptrace attach request, but the kernel previously refused to let the debugger finish the attach sequence. Consequently, GDB terminated unexpectedly with an internal error. Now, GDB handles the described scenario gracefully, reporting back to the user that the attach request failed. As a result, the user receives a warning noting that GDB was unable to attach because permission was denied. In addition, the debugging session is not affected by this behavior.

BZ#1186476

When a breakpoint was pending and a new object file appeared and this new object file contained multiple possible locations for the breakpoint, GDB was being too strict on checking this condition, and issued an internal error. The check for multiple locations for the same breakpoint has been relaxed, and GDB no longer issues an internal error in this scenario. The user now receives a warning mentioning that more than one location for the breakpoint has been found, but only one location will be used.

Bug Fix

BZ#629640

Due to incorrect open file flags, the gdbm utility caused creation of a new file when opening a non-existent file for reading. To fix this bug, the wrong file open flags have been set correctly, and gdbm thus no longer creates a new file in the aforementioned scenario.

Bug Fix

BZ#1180392

The previous release of gdbm introduced a regression in the way file handlers were used. Consequently, gdbm failed to write to a database opened for reading and writing. With this update, the file handlers have been fixed to use the right flags, and as a result, gdbm works with such databases as expected.

Bug Fixes

BZ#994452

Previously, a text intended for rendering in mode 3 (invisible) was not included in the PDF output of the pdfwrite device. As a consequence, text selection from documents with an invisible text, such as Optical character recognition (OCR) output, failed. With this update, mode 3 text is included in the PDF output, and copying a text from such PDF files now works as expected.

BZ#1027534

Prior to this update, some PDF files containing embedded objects were erroneously treated as portable collections, leading to a "/syntaxerror" error when processing these files. A fix has been applied so that only PDF files with "/Collection" attributes are treated as portable collections, and files with embedded objects are now processed correctly.

BZ#1060026

Correct PDF/A files could not be created due to a lack of support. This update backports improved support for creating PDF/A files from upstream, and correct PDF/A files can now be produced.

BZ#1105520

Previously, if an error occurred in the ghostscript interpreter in between allocating an array and initializing its contents, garbage collection could cause the interpreter to terminate unexpectedly while attempting to deallocate memory. A patch from upstream which immediately sets the array elements to null objects after allocation fixes this bug, and the ghostscript interpreter no longer crashes in the described scenario.

Bug Fixes

BZ#859965

This update of the name service cache daemon (nscd) adds a system of inotify-based monitoring and stat-based backup monitoring for nscd configuration files, so that nscd now correctly detects changes to its configuration and reloads the data. This prevents nscd from returning stale data.

BZ#1085312

A defect in the library could cause the list of returned netgroups to be truncated if one of the netgroups in the tree was empty. This error could result in application crashes or undefined behavior. The library has been fixed to handle empty netgroups correctly and to return the complete list of requested netgroups.

BZ#1088301

The gethostby* functions generated syslog messages for every unrecognized record type, even if the resolver options explicitly selected extra data. The library has been fixed to avoid generating logging messages when the user explicitly or implicitly requested the data. The number of syslog messages in DNSSEC-enabled systems related to calls to gethostby* is now reduced.

BZ#1091915

A defect in glibc could cause uninitialized bytes to be sent via a socket between the nscd client and server. When the application was analyzed using Valgrind, it reported a problem which could be confusing and misleading. The library has been fixed to initialize all bytes sent via the socket operation. Valgrind no longer reports problems with the nscd client.

BZ#1116050

A defect in the reinitialization of thread local structures could result in a too-small thread local storage structure which could lead to unexpected termination of an application. The thread library has been fixed to reinitialize the thread local storage structure correctly to prevent applications from crashing when they reuse thread stacks.

BZ#1124204

The times function provided by glibc did not allow users to use a NULL value for the buffer, and applications passing a NULL could terminate unexpectedly. The library has been fixed to accept a NULL value for the buffer and return the expected results from the kernel system call.

BZ#1138769

The getaddrinfo(3) function has been improved to return a valid response when an address lookup using the getaddrinfo(3) function for AF_UNSPEC is performed on a defective DNS server.

BZ#1159167

When using NetApp filers as NFS servers, the rpc.statd service could terminate unexpectedly. The glibc API segmentation violation in the server Remote Procedure Call (RPC) code that was causing this crash has been corrected, and the problem no longer occurs.

BZ#1217186

When a system with a large .rhosts file used the rsh shell to connect to a rlogind server, the authentication could time out. This update adjusts the ruserok(3) function, so that it first performs user matching in order to avoid demanding DNS lookups. As a result, rlogind authentication with large .rhosts files is faster and no longer times out.

Enhancements

BZ#1154563

The dlopen(3) function of the library, which is used to load dynamic libraries, can now be called recursively (a dlopen(3) function can be called while another dlopen(3) function is already in process). This update prevents crashes or aborts in applications that need to use the dlopen(3) function in this way.

BZ#1195453

The glibc dynamic loader now supports Intel AVX-512 extensions. This update allows the dynamic loader to save and restore AVX-512 registers as required, thus preventing AVX-512-enabled applications from failing because of audit modules that also use AVX-512.

Bug Fix

BZ#1204589

Previously, the qemu-kvm utility could terminate unexpectedly with a segmentation fault after the user attempted to create an image on GlusterFS using the "qemu-img create" command. The glusterfs packages source code has been modified to fix this bug, and qemu-kvm no longer crashes in the described situation.

Bug Fix

BZ#1098370

Due to a memory leak in the "housekeeping" plug-in, gnome-settings-daemon did not correctly release certain memory segments that were not needed anymore. Consequently, the daemon could possibly exhaust all available memory, in which case the system encountered performance issues. With this update, the "housekeeping" plug-in has been fixed to properly free unused memory. As a result, the above-mentioned scenario is prevented.

Security Fixes

CVE-2014-8155

It was found that GnuTLS did not check activation and expiration dates of CA certificates. This could cause an application using GnuTLS to incorrectly accept a certificate as valid when its issuing CA is already expired.

CVE-2015-0282

It was found that GnuTLS did not verify whether a hashing algorithm listed in a signature matched the hashing algorithm listed in the certificate. An attacker could create a certificate that used a different hashing algorithm than it claimed, possibly causing GnuTLS to use an insecure, disallowed hashing algorithm during certificate verification.

CVE-2015-0294

It was discovered that GnuTLS did not check if all sections of X.509 certificates indicate the same signature algorithm. This flaw, in combination with a different flaw, could possibly lead to a bypass of the certificate signature check.

Bug Fix

BZ#1036385

Previously, under certain circumstances, the certtool utility could generate X.509 certificates which contained a negative modulus. Consequently, such certificates could have interoperation problems with the software using them. The bug has been fixed, and certtool no longer generates X.509 certificates containing a negative modulus.

Enhancement

BZ#968474

This update corrects the timeout values used by gPXE to conform to RFC 2131 and the PXE specification.

Security Fixes

CVE-2012-5667

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way grep parsed large lines of data. An attacker able to trick a user into running grep on a specially crafted data file could use this flaw to crash grep or, potentially, execute arbitrary code with the privileges of the user running grep.

CVE-2015-1345

A heap-based buffer overflow flaw was found in the way grep processed certain pattern and text combinations. An attacker able to trick a user into running grep on specially crafted input could use this flaw to crash grep or, potentially, read from uninitialized memory.

Bug Fixes

BZ#799863

Prior to this update, the \w and \W symbols were inconsistently matched to the [:alnum:] character class. Consequently, regular expressions that used \w and \W in some cases had incorrect results. An upstream patch which fixes the matching problem has been applied, and \w is now matched to the [_[:alnum:]] character and \W to the [^_[:alnum:]] character consistently.

BZ#1103270

Previously, the "--fixed-regexp" command-line option was not included in the grep(1) manual page. Consequently, the manual page was inconsistent with the built-in help of the grep utility. To fix this bug, grep(1) has been updated to include a note informing the user that "--fixed-regexp" is an obsolete option. Now, the built-in help and manual page are consistent regarding the "--fixed-regexp" option.

BZ#1193030

Previously, the Perl Compatible Regular Expression (PCRE) library did not work correctly when matching non-UTF-8 text in UTF-8 mode. Consequently, an error message about invalid UTF-8 byte sequence characters was returned. To fix this bug, patches from upstream have been applied to the PCRE library and the grep utility. As a result, PCRE now skips non-UTF-8 characters as non-matching text without returning any error message.

Bug Fix

BZ#1177321, BZ#1206542

Previously, during the Pre-Boot Execution Environment (PXE) booting of a client configured to use the UEFI booting and the IP version 6 (IPv6) protocol, the client failed to display the expected selection menu as configured in the grub.cfg file and switched to the GRUB shell instead. With this update, the bug has been fixed so that the PXE boots the client and displays the operating system selection menu as configured in grub.cfg.

Bug Fix

BZ#622776

Previously, using GStreamer with the Phonon back end, common in the K Desktop Environment (KDE), led to sound synchronization problems, which caused jitter in the audio output. With this update, the improperly working GStreamer component and the consequent sound synchronization problems have been fixed. As a result, sound quality in applications using Phonon is no longer affected.

Bug Fixes

BZ#998061

Previously, the GNOME Desktop Virtual File System (GVFS) trash implementation did not take access permissions into consideration when creating file monitors for mount points. Consequently, file monitors were polling files without read access permissions, preventing AutoFS mount points from expiring as they normally would when not in use for some time. With this update, the trash implementation no longer creates file monitors to monitor files without read access permissions. As a result, AutoFS mount points can now freely expire.

BZ#1140451

Prior to this update, gvfs‑gdu‑volume‑monitor did not verify whether it received the data when getting the pool of GNOME Disk Utility (GDU) devices. Consequently, the gvfs‑gdu‑volume‑monitor process could terminate unexpectedly if the data was not received. Now, gvfs‑gdu‑volume‑monitor verifies whether the data was received, and no longer crashes.

Bug Fixes

BZ#1165676

Prior to this update, the gvfsd-gphoto2 utility did not verify whether it received the data when getting information on the camera attached storage. Consequently, gvfsd-gphoto2 could terminate unexpectedly if the data was not received. Now, gvfsd-gphoto2 verifies whether the data was received, and no longer crashes in the described situation.

BZ#1210203

The gvfsd-metadata daemon did not correctly handle the situation when an application tried to save a metadata entry larger than the size of a journal file, that is, larger than 32 kB. The daemon wrote all changes from the journal to the metadata database to make more space for the entry and then created a new journal file. This operation was repeated in an infinite loop unnecessarily, overloading the CPU and disk. With this update, the operation is retried only once. As a result, the metadata entry is not saved if it is too large, and gvfsd-metadata returns a warning instead.

Bug Fix

BZ#841419

Previously, the "Mic Mute" and "Touchpad Toggle" keys did not transmit the correct symbol in Lenovo laptops. With this update, the aforementioned keys are correctly recognized by the X.Org Server, and the XF86AudioMicMute and XF86TouchpadToggle signals are transmitted successfully.

Enhancement

BZ#1172669

To support the various "Fn" keys on latest Toshiba laptops, this update changes the hal-info remapping rules for Toshiba laptops from the provided kernel keycode to a keycode compatible with X.

Enhancement

BZ#1166497

The OPTIONS parameter has been added to the /etc/sysconfig/haproxy file, which allows the user to set extra options for the haproxy utility.

Security Fix

CVE-2014-9273

It was found that hivex attempted to read, and possibly write, beyond its allocated buffer when reading a hive file with a very small size or with a truncated or improperly formatted content. An attacker able to supply a specially crafted hive file to an application using the hivex library could possibly use this flaw to execute arbitrary code with the privileges of the user running that application.

Bug Fix

BZ#1164693

The hivex(3) man page previously contained a typographical error. This update fixes the typo.

Bug Fixes

BZ#682814

Previously, HPLIP did not correctly handle CUPS denying a requested operation, such enabling or disabling a printer. As a consequence, operating HP Device Manager as a non-root user did not prompt for the root password when the root password was required for an operation. With this update, the password callback is correctly implemented, and operating HP Device Manager as non-root user now always prompts for the root password when required.

BZ#876066

Prior to this update, the use of an uninitialized value could produce incorrect output from the hpcups driver. The underlying source code has been modified to initialize the value before it is used, and the described unexpected behavior is therefore prevented.

Security Fix

CVE-2013-5704

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.

Bug Fixes

BZ#1149906

The order of mod_proxy workers was not checked when httpd configuration was reloaded. When mod_proxy workers were removed, added, or their order was changed, their parameters and scores could become mixed. The order of mod_proxy workers has been made internally consistent during configuration reload.

BZ#906476

The local host certificate created during firstboot contained CA extensions, which caused the httpd service to return warning messages. This has been addressed by local host certificates being generated with the "-extensions v3_req" option.

BZ#1086771

The default mod_ssl configuration no longer enables support for SSL cipher suites using the single DES, IDEA, or SEED encryption algorithms.

BZ#963146

The apachectl script did not take into account the HTTPD_LANG variable set in the /etc/sysconfig/httpd file during graceful restarts. Consequently, httpd did not use a changed value of HTTPD_LANG when the daemon was restarted gracefully. The script has been fixed to handle the HTTPD_LANG variable correctly.

BZ#1057695

The mod_deflate module failed to check the original file size while extracting files larger than 4 GB, making it impossible to extract large files. Now, mod_deflate checks the original file size properly according to RFC1952, and it is able to decompress files larger than 4 GB.

BZ#1146194

The httpd service did not check configuration before restart. When a configuration contained an error, an attempt to restart httpd gracefully failed. Now, httpd checks configuration before restart and if the configuration is in an inconsistent state, an error message is printed, httpd is not stopped and a restart is not performed.

BZ#1149703

The SSL_CLIENT_VERIFY environment variable was incorrectly handled when the "SSLVerifyClient optional_no_ca" and "SSLSessionCache" options were used. When an SSL session was resumed, the SSL_CLIENT_VERIFY value was set to "SUCCESS" instead of the previously set "GENEROUS". SSL_CLIENT_VERIFY is now correctly set to GENEROUS in this scenario.

BZ#1045477

The ab utility did not correctly handle situations when an SSL connection was closed after some data had already been read. As a consequence, ab did not work correctly with SSL servers and printed "SSL read failed" error messages. With this update, ab works as expected with HTTPS servers.

BZ#1161328

When a client presented a revoked certificate, log entries were created only at the debug level. The log level of messages regarding a revoked certificate has been increased to INFO, and administrators are now properly informed of this situation.

Enhancement

BZ#767130

A mod_proxy worker can now be set into drain mode (N) using the balancer-manager web interface or using the httpd configuration file. A worker in drain mode accepts only existing sticky sessions destined for itself and ignores all other requests. The worker waits until all clients currently connected to this worker complete their work before the worker is stopped. As a result, drain mode enables to perform maintenance on a worker without affecting clients.

Enhancement

BZ#1170975

The PCI, USB, and vendor ID files have been updated with information about recently released hardware. Hardware utility tools that use these ID files are now able to correctly identify recently released hardware.

Bug Fix

BZ#1161368

When mounting a read-only file system that does not support file system freezing (such as SquashFS) and using the online backup feature, the online backup previously failed with an "Operation not supported" error. This update fixes the hypervvssd daemon so that it handles the online backup correctly, and the described error no longer occurs.

Bug Fixes

BZ#1066075

Previously, Java applications generated by Lotus Sametime or Eclipse became unresponsive when the Korean language input engine platform for the IBus input method (ibus-hangul) was used in Red Hat Enterprise Linux 6. To fix this bug, asynchronous key events have been added to IBus. Now, IBus can switch to asynchronous mode which resolves the hang.

BZ#1043381

Prior to this update, the X11 application became unresponsive when the user was typing using IBus and switched input contexts between the parent and the child windows. This update resolves the race condition causing this bug. Now, IBus properly handles the situation and the application no longer hangs.

Enhancement

BZ#1200973

Transliteration from Latin to US-ASCII characters is now supported. Prior to this update, icu in Red Hat Enterprise Linux 6 did not support this mode of the transliterator_transliterate() function. Consequently, it was not possible to perform certain operations. For example, the user could not easily remove non-ASCII characters from PHP code strings. With this update, the user can use transliterator_transliterate() to transliterate Latin characters to US-ASCII characters.

Bug Fix

BZ#1176177

Previously, during the rebuild process of the icu source package, two-digit format was used for calendar year in the test case and was not interpreted correctly. As a consequence, the year 2034 was displayed instead of year 1934 causing the check of the test case to fail. A patch has been applied to fix this bug and the check no longer fails.

Bug Fixes

BZ#1129624

Due to a race condition, the multicast_snooping bridging option failed to be applied before creating a bridge device. With this update, multicast_snooping is applied after the bridge is up, and the option now works as intended.

BZ#957706

Previously, the rc.sysinit script only set affinity for PID 1 (init), which caused that processes that were run from sysinit did not inherit this setting. This update sets affinity also for the script itself, and thus initscripts correctly set affinity for all running processes.

BZ#919472

The net.bridge.bridge-nf-call-ip6tables key was previously applied on all systems. Consequently, when a kernel module was missing, harmless but unnecessary messages were returned. The rules have been relocated from sysctl.conf, which ensures that they are applied only if needed.

BZ#1101546

When a shutdown was attempted while an NFS Client machine had I/O in progress on an NFS mount, the system became unresponsive during shutdown. This update applies a lazy mount, within which all processes that have open File Descriptors (FDs) are found and killed, and hangs thus no longer occur in this situation.

BZ#1136863

Previously, the netconsole starting priority was set to 50, which caused that netconsole was started late during the system boot. This update lowers the priority so that netconsole starts right after the network is up.

BZ#1157816

If resolv.conf.save was present, resolv.conf was overwritten by the content of resolv.conf.save. As a consequence, unexpected changes could occur to resolve.conf. Now, the content of resolv.conf is replaced only when the device is dynamically configured or contains DNS options in its ifcfg file.

BZ#997271

Previously, the broadcast address was not computed correctly due to the ipcalc utility not being aware of RFC 3021. With this update, ipcalc correctly recognizes RFC 3021, thus fixing this bug.

BZ#1109588

Previously, network aliases did not inherit the ARPCHECK variable from their parents, which caused that parents where not checked for duplicate IP addresses but their aliases did check them. With this update, alias devices inherit ARPCHECK.

BZ#1164902

Previously, a syntax error occurred when using the tcsh shell along with the grep utility, returning the following error after logging:

grep: character class syntax is [[:space:]], not [:space:]

The lang.csh code has been fixed, and error messages are no longer returned in this scenario.

BZ#1168664

Prior to this update, if the system became unresponsive during boot, the administrator was not able to determine the cause. This update adds more informative messages returned by rc.sysinit. In addition, a new rc.debug option for the kernel command line has been added, so that the administrator receives proper debugging information.

BZ#1176999

Due to a syntax error in the install_bonding_driver() function, the following error message was returned:

/sys/class/net/bonding/slaves: No such file or directory

The syntax error has been fixed, and the aforementioned error message is no longer returned.

BZ#1189337

Previously, network initscripts silently failed if the root was on the network file system and did not perform any action, which was confusing. Now, network initscripts print the following message to inform the system administrator:

rootfs is on network filesystem, leaving network up

BZ#1072967

Previously, the "ip addr flush" command was called with global scope, which is incorrect for loopback addresses. Consequently, the system could become unresponsive. With this update, the scope host for loopback is used, and the flush operation works as expected.

Bug Fixes

BZ#1131571

The ipa-server-install, ipa-replica-install, and ipa-client-install utilities are not supported on machines running in FIPS-140 mode. Previously, IdM did not warn users about this. Now, IdM does not allow running the utilities in FIPS-140 mode, and displays an explanatory message.

BZ#1132261

If an Active Directory (AD) server was specified or discovered automatically when running the ipa-client-install utility, the utility produced a traceback instead of informing the user that an IdM server is expected in this situation. Now, ipa-client-install detects the AD server and fails with an explanatory message.

BZ#1154687

When IdM servers were configured to require the TLS protocol version 1.1 (TLSv1.1) or later in the httpd server, the ipa utility failed. With this update, running ipa works as expected with TLSv1.1 or later.

BZ#1161722

In certain high-load environments, the Kerberos authentication step of the IdM client installer can fail. Previously, the entire client installation failed in this situation. This update modifies ipa-client-install to prefer the TCP protocol over the UDP protocol and to retry the authentication attempt in case of failure.

BZ#1185207

If ipa-client-install updated or created the /etc/nsswitch.conf file, the sudo utility could terminate unexpectedly with a segmentation fault. Now, ipa-client-install puts a new line character at the end of nsswitch.conf if it modifies the last line of the file, fixing this bug.

BZ#1191040

The ipa-client-automount utility failed with the "UNWILLING_TO_PERFORM" LDAP error when the nsslapd-minssf Red Hat Directory Server configuration parameter was set to "1". This update modifies ipa-client-automount to use encrypted connection for LDAP searches by default, and the utility now finishes successfully even with nsslapd-minssf specified.

BZ#1198160

If installing an IdM server failed after the Certificate Authority (CA) installation, the "ipa-server-install --uninstall" command did not perform a proper cleanup. After the user issued "ipa-server-install --uninstall" and then attempted to install the server again, the installation failed. Now, "ipa-server-install --uninstall" removes the CA-related files in the described situation, and ipa-server-install no longer fails with the mentioned error message.

BZ#1198339

Running ipa-client-install added the "sss" entry to the sudoers line in nsswitch.conf even if "sss" was already configured and the entry was present in the file. Duplicate "sss" then caused sudo to become unresponsive. Now, ipa-client-install no longer adds "sss" if it is already present in nsswitch.conf.

BZ#1201454

After running ipa-client-install, it was not possible to log in using SSH under certain circumstances. Now, ipa-client-install no longer corrupts the sshd_config file, and the sshd service can start as expected, and logging in using SSH works in the described situation.

BZ#1220788

An incorrect definition of the dc attribute in the /usr/share/ipa/05rfc2247.ldif file caused bogus error messages to be returned during migration. The attribute has been fixed, but the bug persists if the copy-schema-to-ca.py script was run on Red Hat Enterprise Linux 6.6 prior to running it on Red Hat Enterprise Linux 6.7. To work around this problem, manually copy /usr/share/ipa/schema/05rfc2247.ldif to /etc/dirsrv/slapd-PKI-IPA/schema/ and restart IdM.

Bug Fixes

BZ#878614

Prior to this update, ipmitool could handle only 16-byte-long Sensor Data Repository (SDR) item names. Consequently, listing a sensor with a long name could cause ipmitool to terminate unexpectedly. This update fixes the string identification handling, and the long sensor names are now trimmed correctly.

BZ#903019

Previously, ipmitool could not recognize neither sensor thresholds and presence, nor fan units of sensors on Sun Fire X4600 M2 Servers. This update resolves the unrecognized sensor reporting.

BZ#1028163

Previously, the ipmitool default timeout values set an insufficient time period. As a consequence, during retries, ipmitool could terminate unexpectedly with a segmentation fault, or produce a nonsensical error message. With this update, the ipmitool options passed from the environment variable are parsed correctly from the IPMITOOL_OPTS and IPMI_OPTS variables, and IPMITOOL_* variables take precedence over IPMI_* variables. As a result, ipmitool no longer crashes in the described situation.

BZ#1126333

Previously, ipmitool could not recognize the Sensor Data Repository (SDR) type Software ID. As a consequence, the default 5-second timeout for each affected line reported resulted in a very slow response. This update fixes the Intelligent Platform Management Bus (IPMB) request setup, and slow SDR access times are no longer experienced in the described situation.

BZ#1162175

Previously, the ipmitool utility required an unnecessary dependency on the OpenIPMI packages, which had to be installed together with ipmitool. This update removes the dependency on the OpenIPMI packages, which are no longer installed when installing ipmitool.

BZ#1170266

An earlier version of ipmitool contained a version mismatch between the ipmitool packages and the runtime-reported version. Consequently, running the "ipmitool -V" command displayed the 1.8.14 version number instead of the correct 1.8.11 version number. With this update, the runtime version change has been reverted to match the package version.

BZ#1194420

Previously, ipmitool could not recognize DDR4 memory modules and could terminate unexpectedly with a segmentation fault on such systems. This update adds support for DDR4 reporting. As a result, ipmitool no longer crashes on DDR4 systems when running the Field Replacement Unit (FRU) inventory listing.

Bug Fixes

BZ#997965

The default route was erroneously deleted after running the "ip route del" command without further parameters. A patch has been applied, and the default route is no longer removed in this situation.

BZ#1011817

Running the "bridge monitor file" command opened the file, but never closed it. A fix has been applied to close the opened file after loading its content. As a result, the command now closes all opened files as expected.

BZ#1034049

Previously, the "ip -6 addrlabel" command returned an incorrect error message that contained "inet" instead of "inet6". To fix this bug, the error message has been changed to include "inet" for IPv4 addresses and "inet6" for IPv6 addresses.

BZ#1040367

Prior to this update, the iproute utility handled the return values of the send() system call incorrectly when reading kernel responses. Consequently, iproute could interpret successful kernel responses as failures, which caused iproute to terminate with an error. With this update, iproute uses the return values correctly and processes kernel responses as intended.

BZ#1060195

The /sbin/ip file displayed statistics for 32-bit system even on 64-bit kernel. To fix this bug, a patch has been applied, and the statistics are now presented correctly.

BZ#1152951

Prior to this update, multipath routing did not function with IPv6 addresses and resulted in an "IP address is expected rather than "2001:470:25:94::1" error. To fix this bug, a patch that enables adding multipath routes using IPv6 addresses has been applied.

Enhancements

BZ#1131650

Support for spoof checking configuration has been added to iproute.

BZ#1177982

Dynamic precision, human readable, and IEC outputs are now backported to IP statistics.

Bug Fix

BZ#1146701

Previously, the format of firmware files was case sensitive. As a consequence, device attributes were not saved correctly for SIS-64 adapters after updating firmware with the pci.xxx file format. With this update, the firmware format is case insensitive, and device attributes are saved correctly in the described situation.

Bug Fix

BZ#1121665

When the user was trying to create a program using the ipset library, linking failed with an undefined reference to the ipset_port_usage() function. With this update, ipset_port_usage() is now provided by the library and a program using the ipset library is now compiled successfully.

Bug Fixes

BZ#1081422

Previously, no iptables revision was used for rules that match an ipset. As a consequence, iptables rules with the match-set option could be added, but not removed again, as the rules could not be located again for their removal. This update adds revision 0 and 1 code patches for libipt_SET. As a result, new ipset match rules can now be removed. Please note that adding and removing rules using the match-set option now works with the patch applied, but removing a rule that was added with an earlier version of iptables does not work and cannot be fixed. Use the rule number to remove such rules.

BZ#1088400

In iptables version 1.4.7-9, the use of alternatives was introduced. Because of the use of versioned (/lib*/xtables-%{version}) custom plug-ins, the plug-ins had to be placed in the appropriate versioned plug-in directory. Starting with iptables version 1.4.7-10, the plug-in directory was reverted back to /lib*/xtables/, but custom plug-ins from iptables version 1.4.7-9 were not copied over. Consequently, upgrading iptables 1.4.7-9 to a newer version led to a loss of custom plug-ins. A plug-in update trigger which detects updates to iptables from version 1.4.7-15 and lower has been added. As a result, custom plug-ins from the /%{_lib}/xtables-1.4.7/ directory are copied to the /%{_lib}/xtables/ directory if the plug-in in /%{_lib}/xtables-1.4.7/ has a newer file date or if it does not exist in the destination directory while updating from iptables version earlier than 1.4.7-15 to a newer version.

BZ#1084974

Previously, a space after Datagram Congestion Control Protocol (DCCP) packet types for print and save was missing, which led to malformed output. With this update, a space has been added at the end of the print_types() function output. As a result, the output of the "iptables -L", "iptables -S", and iptables-save commands is now correct.

BZ#1081191

Previously, some init script warning messages for a failed euid 0 check (no configuration file and nothing to save) were missing. Consequently, only exit status codes were provided in these cases, but no messages. This update adds the warning messages that are now provided in the described situation.

Enhancements

BZ#1161330

This update adds support for IPv6 ipset, as ipsets were not previously usable in IPv6 firewall rules.

BZ#1088361

This update adds support for the "-C" check option for the ip*tables commands. Previously, there was no simple way to check if a certain rule exists. Now, the "-C" option can be used in a rule to check if a rule exists.

Bug Fixes

BZ#829998

The arping command previously returned incorrect exit codes in some cases due to incorrect time related logic and exit-handling conditions in the code. With this update, the aforementioned problems have been fixed, and arping again returns correct values.

BZ#1099426

Due to incorrect code that handles the number of return path hops, the tracepath utility displayed an incorrect number of "back" hops. This update fixes the logic, and the number of displayed back hops is now accurate.

BZ#1113082

When domain name translation was forced to be carried out over the IPv6 protocol, the output of the "ping" command was incorrect as it displayed an incorrect IP address received from the internal library. The underlying logic has been modified to use the gethostbyname2() function instead of gethostbyname(), and domain name to IP address translation now works correctly.

BZ#1149574

Due to invalid logic present in the code, an erroneous warning message could be returned under certain circumstances:

WARNING: kernel is not very fresh, upgrade is recommended.

This update removes the code responsible for returning this erroneous warning message, thus fixing the bug.

Bug Fixes

BZ#1158932

Previously, the irqbalance utility did not set signal handlers for particular signals. Consequently, when irqbalance received a signal other than SIGINT or SIGHUP, it terminated without a cleanup. This update provides signal handlers for SIGUSR1, SIGUSR2, and SIGTERM. As a result, irqbalance now stops gracefully after finishing the current balancing iteration.

BZ#1178247

Prior to this update, the /sys/bus/pci/devices file handle was not freed properly if the directory was not available. As a consequence, a memory leak occurred. With this update, the file handle is freed as expected when irqbalance cannot open the directory, and memory leaks no longer occur in the described situation.

Enhancement

BZ#691746

The Internet Small Computer System Interface (iSCSI) now supports safe logout. Previously, an iSCSI session was allowed to log out even when an iSCSI device was still mounted, which could cause the host to become unresponsive. This update adds the "iscsi.safe_logout" option. With "iscsi.safe_logout" set to "Yes" in the /etc/iscsi/iscsid.conf file, the system blocks attempts to log out of an iSCSI session when one or more connected iSCSI drives are mounted.

Bug Fixes

BZ#1145848

The TLS/SSL implementation in OpenJDK previously failed to handle Diffie-Hellman (DH) keys with more than 1024 bits. This caused client applications using Java Secure Socket Extension (JSSE) to fail to establish TLS/SSL connections to servers using larger DH keys during the connection handshake. This update adds support for DH keys with size up to 2048 bits, thus fixing this bug.

BZ#1146622

Previously, the OpenJDK utility displayed characters containing the umlaut diacritical mark (such as ä, ö, or ü) and the eszett character (ß) in PostScript output incorrectly. A patch with support for umlaut and eszett characters has been applied, and OpenJDK now displays these characters correctly.

BZ#1164762

The jhat man page URL was broken. A patch has been applied to fix this bug, and the URL now functions as expected.

BZ#1168693

Previously, it was not possible to use the Serviceability Agent (SA) tool when the target application contained symbols using non-ASCII characters. Java Virtual Machine (JVM) and SA calculated different hashes for strings with such characters, and SA terminated with an error. A patch has been applied to fix this bug, and SA no longer crashes when non-ASCII characters are used.

BZ#1173326

Previously, jvmtiStringPrimitiveCallback was invoked when a string value was null. Consequently, Java Virtual Machine (JVM) could terminate unexpectedly. A patch has been applied to fix this bug, and JVM no longer crashes in this situation.

BZ#1176718

Prior to this update, the Java Native Interface (JNI) code handling fonts used an incorrect function parameter when setting context. Consequently, Java Virtual Machine (JVM) could terminate unexpectedly when disposing of certain fonts. The use of function parameters by the JNI code has been amended, and JVM no longer crashes in this situation.

BZ#1190835

Previously, calling the Files.probeContentType() function with the default GnomeFileTypeDetector using the libgio library caused Java Virtual Machine (JVM) to terminate unexpectedly at a thread's end. A patch has been applied, and the process now exits without problems.

BZ#1214835

Due to a regression, the Java Heap/CPU Profiling Tool (HPROF) produced truncated output when used with the "doe=n" argument. Consequently, the output file contained only the header, the data was missing. A patch has been applied, and the output of HPROF is now correct when using "doe=n".

Enhancement

BZ#1121211

Support for elliptic curve cryptography, the SunEC provider, has been added to OpenJDK 7. OpenJDK 7 can now establish Transport Layer Security or Secure Sockets Layer connections or perform encryption and decryption using this technology.

Bug Fixes

BZ#1154143

In Red Hat Enterprise Linux 6, the java-1.8.0-openjdk packages mistakenly included the SunEC provider, which does not function properly on this system. With this update, SunEC has been removed from the Red Hat Enterprise Linux 6 version of java-1.8.0-openjdk.

BZ#1155783

Prior to this update, the java-1.8.0-openjdk packages incorrectly provided "java-devel", which could lead to their inclusion in inappropriate builds. As a consequence, the "yum install java-devel" command in some cases installed java-1.8.0-openjdk-devel instead of the intended Java package. This update removes the providing configuration, and java-1.8.0-openjdk-devel can now be installed only by using the "yum install java-1.8.0-openjdk-devel" command.

BZ#1182011

Previously, the OpenJDK utility displayed characters containing the umlaut diacritical mark (such as ä, ö, or ü) and the eszett character (ß) in PostScript output incorrectly. A patch with support for umlaut and eszett characters has been applied, and OpenJDK now displays these characters correctly.

BZ#1189853

The java-1.8.0-openjdk package for Red Hat Enterprise Linux 6 did not provide the "java" virtual package. Consequently, when a package needed to use OpenJDK 8, it was necessary to require "java-1.8.0-openjdk" instead of commonly used "java". Now, it is sufficient to require "java" as expected.

BZ#1212592

OpenJDK used a copy of the system time zone data. This could cause a difference between OpenJDK time and the system time. Now, OpenJDK uses the system time zone data, and OpenJDK time and the system time are the same.

Enhancement

BZ#1210007

Red Hat now provides debug builds of OpenJDK in optional channels. With installed debug builds and JVM or JDK switched to using them, it is possible to do detailed HotSpot debugging. The debug builds can be used via alternatives or direct execution, in the same way as regular Java builds. Note that debug builds are not suitable for use in production, as they operate at a slower rate.

Enhancement

BZ#1149605

The support for OpenJDK8 has been added to the JPackage utilities, which enables Java system applications to be used with OpenJDK8.

Bug Fix

BZ#1158842

The pkg-config (.pc) files for JSON-C were incorrectly placed in the /lib64/pkgconfig/ directory in the 64-bit packages and in the /lib/pkgconfig/ directory in the 32-bit packages. Consequently, the pkg-config tool was unable to find these files and failed to provide the location of the installed JSON-C libraries, header files, and other information about JSON-C. With this update, the pkg-config files have been moved to the /usr/lib64/pkgconfig/ and /usr/lib/pkgconfig/ directory respectively. As a result, the pkg-config tool now successfully returns information about the installed JSON-C packages.

Bug Fixes

BZ#1190302

Previously, the HASH_ALGORITHM constant was defined incorrectly. As a consequence, object identifiers (OIDs) for SHA-256, SHA-384, and SHA-512 hash functions were incorrect. With this update, the underlying source code has been modified, and the mentioned OIDs are now correct.

BZ#1190303

Prior to this update, the source code for JSS was missing a condition for validating the key strength for the RC4 software stream cipher. As a consequence, JSS did not validate the key strength properly. A patch has been applied to fix this bug, and JSS now performs key strength validation checks as expected.

Enhancement

BZ#1167470

The Tomcat service has been updated to support the Transport Layer Security cryptographic protocol version 1.1 (TLSv1.1) and the Transport Layer Security cryptographic protocol version 1.2 (TLSv1.2) using JSS.

Security Fixes

CVE-2014-3940, Moderate

A flaw was found in the way Linux kernel's Transparent Huge Pages (THP) implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent hugepages.

CVE-2014-9683, Moderate

* A buffer overflow flaw was found in the way the Linux kernel's eCryptfs implementation decoded encrypted file names. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

CVE-2015-3339, Moderate

* A race condition flaw was found between the chown and execve system calls. When changing the owner of a setuid user binary to root, the race condition could momentarily make the binary setuid root. A local, unprivileged user could potentially use this flaw to escalate their privileges on the system.

CVE-2014-3184, Low

* Multiple out-of-bounds write flaws were found in the way the Cherry Cymotion keyboard driver, KYE/Genius device drivers, Logitech device drivers, Monterey Genius KB29E keyboard driver, Petalynx Maxter remote control driver, and Sunplus wireless desktop driver handled HID reports with an invalid report descriptor size. An attacker with physical access to the system could use either of these flaws to write data past an allocated memory buffer.

CVE-2014-4652, Low

* An information leak flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled access of the user control's state. A local, privileged user could use this flaw to leak kernel memory to user space.

CVE-2014-8133, Low

* It was found that the espfix functionality could be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks), and using that segment on the stack. A local, unprivileged user could potentially use this flaw to leak kernel stack addresses.

CVE-2014-8709, Low

* An information leak flaw was found in the Linux kernel's IEEE 802.11 wireless networking implementation. When software encryption was used, a remote attacker could use this flaw to leak up to 8 bytes of plaintext.

CVE-2015-0239, Low

* It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS did not initialize the SYSENTER model-specific registers (MSRs). Note: Certified guest operating systems for Red Hat Enterprise Linux with KVM do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on a KVM hypervisor.

Bug Fixes

BZ#1068674

Previously, when the HugePages feature was in use, the makedumpfile utility was unable to exclude these pages based on page type specified with the "-d" option. This led to a much longer dump collection time compared to the same system with no HugePages in use. This bug has been fixed, and the dump collection time is again optimal.

BZ#1208490

When setting up the kdump environment on a system with specific memory hotplug regions and then starting kdump.service, the operating system previously ran out of memory at boot time, and the booting process thus failed. This update adds a parameter to disable memory hotplug for kexec-tools, and the system now boots successfully in the described scenario.

BZ#971017

Prior to this update, /sbin/mkdumprd was not handling the "blacklist [directory]" statement in the /etc/kdump.conf file properly. As a consequence, modules filtered out by "blacklist [directory]" were inserted into the kernel by the initrd block device. The underlying source code has been patched, and mkdumprd now handles the "blacklist [directory]" statement correctly.

BZ#1104837

When cluster ip address was specified as an ip address and not as a resolvable host name, the kdump utility terminated unexpectedly returning error messages. This bug has been fixed, and kdump no longer crashes in the aforementioned situation.

BZ#1131945

Previously, the kdump service was not able to start on iSCSI boot devices during boot because kdump tried to start before the file system was mounted. A patch has been provided to fix this bug, and kdump now starts automatically during boot.

BZ#1132300

When the kdump service was started and no kdump initial ramdisk was present, kdump attempted to rebuild the ramdisk and called the mkdumprd script. As a consequence, two error messages were returned within the "service kdump start" command output. With this update, the user is informed that the FIPS mode will not be enabled while rebuilding the ramdisk, and the error messages are no longer returned.

BZ#1099589

Previously, the mlx4_core driver was excluded from initrd by default as mlx4_core was consuming too much memory. Nevertheless, the absence of mlx4_core led to problems in the ethernet driver. The fix allows modules that are listed as extra_modules in the /etc/kdump.conf file to load, and the user can now use mlx4_core.

Enhancements

BZ#1195601

The makedumpfile utility now supports the new sadump format that can represent more than 16 TB of physical memory space. This allows users of makedumpfile to read dump files over 16 TB in size, generated by sadump on certain upcoming server models.

BZ#1142666

With this update, the kexec-tools-eppic package has been modified to create a directory for eppic scripts in the /usr/share/ directory. Now, users of kexec-tools-eppic can find some sample eppic scripts for reference though they are contained in the kexec-tools packages.

Bug Fixes

BZ#1075656

Prior to this update, if the Kerberos principal keys were expired, the password change request did not take into account the FAST framework settings for password change requests. Consequently, the pre-auth methods, which require FAST, could not be used for user authentication. This update modifies krb5 to correctly use FAST armor in the password change messages, and the pre-auth methods can be used for user authentication.

BZ#1154130

Previously, after the user set up incremental propagation between a KDC master and slave, an attempt to perform a full synchronization failed with an error message. A patch has been applied to fix this problem, and full synchronization no longer fails after the user sets up incremental propagation between a KDC master and slave.

Enhancement

BZ#1170272

This update adds the LocalAuth plug-in API to krb5. SSSD can leverage LocalAuth to allow seamless authentication of Active Directory (AD) users to Red Hat Enterprise Linux Identity Management (IdM) clients.

Bug Fix

BZ#848026

Previously, users could experience a disproportionate increase in memory utilization by krb5-auth-dialog after being logged in on VMware virtual machines for longer periods of time. To fix this bug, a patch has been applied. Now, the krb5-auth-dialog memory leak no longer occurs in this situation.

Bug Fixes

BZ#1116072

Prior to this update, the result of a command substitution was lost if a file descriptor used for the substitution was previously explicitly closed. With this update, ksh no longer reuses file descriptors that were closed during the execution of a command substitution. Now, command substitutions work as expected in the described situation.

BZ#1117404

Previously, ksh in some cases terminated unexpectedly when re-setting a trap inside a function. With this update, ksh no longer uses invalid data for trap pointers and does not crash in this situation.

BZ#1160923

After the user changed into a directory that lacked execution permissions, ksh did not recognize that the change did not happen and that the user was instead still operating in the directory from which the user attempted to change. Also, the "pwd" utility incorrectly displayed the directory into which the user attempted to change instead of the directory in which the user was actually operating. This update modifies ksh to verify whether the directory change was successful. As a result, ksh reports an error if the necessary execution permissions are missing.

BZ#1168611

Previously, ksh sometimes incorrectly initialized a variable holding the path of the working directory. If a program changed the working directory between forking and ksh execution, then ksh could contain an incorrect value in the working directory variable. With this update, initialization of the working directory variable has been corrected, and ksh now contains the correct value in the aforementioned situation.

BZ#1173668

A nested associative array contained an unexpected extra empty value after the array was initialized. This update fixes a bug in the associative array initialization code that was causing this problem. As a result, newly-created nested associative arrays are empty as expected.

BZ#1176670

Previously, ksh terminated unexpectedly after an alarm occurred during a read operation with a modified Internal Field Separator (IFS). The ksh alarm built-in has been modified to preserve the IFS table during execution. As a result, ksh no longer crashes in this situation.

BZ#1188377

When the user set the export attribute to a variable, ksh in certain cases ignored some other variable attributes. For example, when the user set a variable to be both exported and upper-case, ksh did not set the upper-case option correctly. The typeset utility code has been fixed to respect all options that the user sets for a variable. As a result, ksh sets all attributes correctly even if the user sets multiple attributes simultaneously.

BZ#1189294

Previously, after the user unset an associative array, the system did not free the newly-available memory. Consequently, ksh consumed more and more memory over time. The underlying source code has been modified to free the memory after the user unsets an associative array, thus fixing this problem.

Bug Fix

BZ#1160636, BZ#1167796

Users of the lasso packages could previously experience several problems related to Red Hat Enterprise Linux interoperability with Microsoft Active Directory Federation Services (ADFS). Authentication against ADFS failed when using the mod_auth_mellon module. In addition, in Apache sessions, the limit for the number of elements was insufficient and multi-value variables were not supported. Also, the MellonCond parameter did not work when used together with the MellonSetEnv(NoPrefix) parameter. This update fixes the above described problems with ADFS interoperability.

Bug Fixes

BZ#619777

Previously, downloaded files with duplicated names were not renamed even when the "xfer:auto-rename" and "xfer:clobber" options were enabled. To fix this bug, the condition for renaming downloaded files has been modified and they are now renamed as expected.

BZ#674875

Prior to this update, the lftp manual page did not contain information on the "xfer:auto-rename" option. The option has been documented and added to the page, where it is now available to users.

BZ#732863

Due to a bug in error checking code, lftp could fail to connect to a remote host with an IPv6 address if the local host had only IPv4 connectivity, but the remote host domain name was resolved also to IPv6 addresses. With this update, the code has been amended, and the connectivity problems no longer occur in this situation.

BZ#842322

Due to an incorrect evaluation of the length of an uploaded file, the lftp tool became unresponsive after a file transfer in ASCII mode. With this update, the volume of transferred data is recognized correctly and the lftp program no longer hangs in this scenario.

BZ#928307

When running lftp in mirror mode on a website, lftp terminated with an error in cases of HTTP 302 redirection. To fix this bug, lftp has been amended and now successfully proceeds to the new location in such situations.

BZ#1193617

With the "cmd:fail-exit" option enabled, lftp could terminate unexpectedly when any command was executed after the "help" command. With this update, the "help" command has been amended to return correct return code, and lftp no longer exits in this scenario.

Bug Fixes

BZ#1036355

Previously, the cgconfigparser utility wrote the whole multi-line value in a single write() function call, while the 'devices' kernel subsystem expected only one line per write(). Consequently, cgconfigparser did not properly set the multi-line variables. The underlying source code has been fixed, and cgconfigparser now parses all variables as intended.

BZ#1139205

Prior to this update, if '/etc/cgfconfig.conf' or a configuration file in the '/etc/cgconfig.d/' directory contained the cgroup name 'default' that was not enclosed in double quotation marks, backwards compatibility was broken and cgconfigparser failed to parse the file. With this update, 'default' without double quotation marks is again considered a valid cgroup name, and configuration files are now parsed correctly.

Bug Fixes

BZ#1186821

The libdrm packages have been upgraded to upstream version 2.4.59, which provides a number of bug fixes and enhancements over the previous version.

BZ#1032663

The mesa packages have been upgraded to upstream version 10.4.3, which provides a number of bug fixes and enhancements over the previous version. Among other changes, this version includes support for new Intel 3D graphic chip sets.

BZ#1176666

Support for new Intel 3D graphic chip sets has been backported to the xorg-x11-drv-intel packages.

* The xorg-x11-drv-ati packages have been upgraded to upstream version 7.5.99, which contains a number of bug fixes and enhancements over the previous version. Among other changes, this version includes support for new AMD 3D graphic chip sets.

BZ#1084104

Previously, the radeon driver did not work correctly with the Virtual Network Computing (VNC) module if hardware acceleration was enabled. Consequently, a VNC client connected to a computer set up this way only displayed a blank screen. With this update, this problem has been resolved, and it is now possible to use VNC with the aforementioned setup.

Bug Fixes

BZ#1153855

Using the "virt-sysprep" command to remove a user account from a guest with enabled SELinux did not properly trigger the SELinux relabel process, which caused the guest to be unable to boot. With this update, removing users from such guests properly triggers the relabel. In addition, the virt-sysprep(1) man page now advises to use the "--selinux-relabel" option when cleaning SELinux-enabled guests.

BZ#1100530

The output of the "guestfish -h" command did not include command aliases, which have now been added.

BZ#1056558, BZ#1122557

As a result of the fix for BZ#1056558, it was not possible to use a block device for output when using the virt-sparsify utility. This update re-enables block devices to be used as ouput in virt-sparsify.

BZ#1153846

Using Tab-completion in guestfish on guests with the XFS file system did not correctly append the slash ("/") symbol to directory names. This update adjusts guestfish to properly distinguish files and directories on this file system, and thus fixes the problem.

BZ#1138630

Using the "virt-sysprep" command to remove user accounts did not properly remove the user entries from the /etc/shadow file. With this update, the lens to parse /etc/shadow has been added to the Augeas tool and "virt-sysprep" makes use of it. As a result, removing users from guests using "virt-sysprep" removes also their entries in /etc/shadow.

BZ#1038977

The libguestfs utilities were not able to use disk images on XFS file systems with 4-kilobyte sector size. This update introduces the "cachemode" parameter for the add_drive API, which controls drive caching and has a default value that allows disk images stored on the described file systems to be usable.

BZ#1128942

The libguestfs tools could not use disk images that contained the colon (":") symbol in their path. With this update, path handling in libguestfs and in virt-sparsify has been improved, and such images can now be used as expected.

BZ#1091859

The scrub-file API failed when attempting to handle symbolic links. With this update, scrub-file resolves the file path before handling it further, and as a result, using scrub-file on a symbolic link now properly affects the link's target.

BZ#1159651, BZ#1160203

Due to an incorrect implementation of the libguestfs firstboot scripts runner, the firstboot scripts logged only the last executed script instead of all executed scripts. In addition, firstboot scripts that cause booting to stop, such as a script that reboots the guest, were unintentionally executed on every boot. These problems have now been fixed.

BZ#1074005

In the Java binding, or APIs that return a list of objects different from String caused an ArrayIndexOutOfBoundsException exception to be triggered. The creation of the result list has been fixed, and these APIs now return the expected result.

BZ#1168751

The way in which the lvm-set-filter API handles the lvm.conf file has been rewritten, so that lvm-set-filter is properly able to change the LVM device filter.

Enhancements

BZ#1151901

The output of the "virt-ls --csv --checksum" command now always includes a field for the checksum value, even if the field is empty, like in the case of directories. As a result, the command's output is more easily parseable.

BZ#1164734, BZ#1151739, BZ#1153974, BZ#1100533

Minor fixes and improvements have been done to the help message of the "set-append" command, an error message of the "guestfish umount" command, and to the guestfish(1) and virt-edit(1) man pages.

Bug Fix

BZ#1025841, BZ#1063328

Previously, running the "tcpdump" command with the filter expression containing the keyword "vlan" produced unexpected output, as the filter generated by the libpcap Berkeley Packet Filter (BPF) compiler did not employ BPF extensions. To fix this bug, libpcap has been amended and now generates filters that use BPF extensions when appropriate. As a result, running "tcpdump" with filters containing "vlan" produces correct results.

Security Fix

CVE-2015-1774

A flaw was found in the way the LibreOffice HWP (Hangul Word Processor) file filter processed certain HWP documents. An attacker able to trick a user into opening a specially crafted HWP document could possibly use this flaw to execute arbitrary code with the privileges of the user opening that document.

Bug Fix

BZ#1150048

OpenXML interoperability has been improved.

* This update adds additional statistics functions to the Calc application, thus improving interoperability with Microsoft Excel and its "Analysis ToolPak" add-in.

* Various performance improvements have been implemented in Calc.

* This update adds new import filters for importing files from the Appple Keynote and Abiword applications.

* The export filter for the MathML markup language has been improved.

* This update adds a new start screen that includes thumbnails of recently opened documents.

* A visual clue is now displayed in the Slide Sorter window for slides with transitions or animations.

* This update improves trend lines in charts.

* LibreOffice now supports BCP 47 language tags.

For a complete list of bug fixes and enhancements provided by this rebase, see the libreoffice change log linked from the References section.

Bug Fixes

BZ#591451

The libsemanage test suite previously failed when attempting to test the libsemanage library. With this update, an error in the underlying code has been corrected, which allows the libsemanage test suite to work as expected.

BZ#872700

Prior to this update, the semodule command failed with an error message when attempting to enable an already enabled module, or disable an already disabled module. This update adjusts the behavior of the command to succeed and not to produce error messages in the described scenarios.

Bug Fixes

BZ#1198096

Previously, when the default CPU mask was specified while using Non-Uniform Memory Access (NUMA) pinning, virtual CPUs (vCPUs) could not be pinned to physical CPUs that were not contained in the default node mask. With this update, the control groups (cgroups) code correctly attaches only vCPU threads instead of the entire domain group, and using NUMA pinning with the default cpuset subsystem now works as expected.

BZ#1186142

The interface configuration of any libvirt domain which was of type='network' and referenced an "unmanaged" libvirt network had incorrect XML data for the interface transmitted during a migration, containing the "status" of the interface instead of the name of the network to use ("configuration"). As a consequence, the migration destination tried to set up the domain network interface using the status information from the source of the migration, and the migration thus failed. With this update, libvirt sends the configuration data for each device during migration rather than the status data, and the migration of a domain using interfaces of type='network' now succeeds.

BZ#1149667

In Red Hat Enterprise Linux 6.6, support was added for libvirt to report whether QEMU is capable of creating snapshots. However, libvirt did not probe for the snapshot capability properly. As a consequence, the snapshot capability of KVM Guest Image in VDSM was reported as unavailable even when it was available, and creating a disk snapshot in some cases failed. With this update, libvirt no longer reports QEMU snapshot capability, and therefore does not cause the described problem.

BZ#1138523

Previously, using the "virsh pool-refresh" command, or restarting or refreshing the libvirtd service after renaming a virtual storage volume in some cases caused the "virsh vol-list" to display an incorrect name for the renamed storage volume. This update adds a check for the resulting name, which returns an error if the storage volume name is incorrect.

BZ#1158036

Prior to this update, when using the "virsh save" command to save a domain to an NFS client with the "root squash" access rights reduction while running the libvirtd service with a non-default owner:group configuration, saving the NFS client failed with a "Transport endpoint is not connected" error message. This update ensures that the chmod operation during the saving process correctly specifies the non-default owner:group configuration, and using "virsh save" in the described scenario works as expected.

BZ#1113474

A virtual function (VF) could not be used in the macvtap-passthrough network if it was previously used in the hostdev network. With this update, libvirt ensures that the VF's MAC address is properly adjusted for the macvtap-passthrough network, which allows the VF to be used properly in the described scenario.

Bug Fixes

BZ#667789

Previously, the "mute microphone" key in some cases did not work when using Red Hat Enterprise Linux 6. With this update, libX11 properly resolves the key symbol assigned to the "mute microphone" key by the xkeyboard-config keyboard layout files, and the "mute microphone" key now works as expected.

BZ#1206240, BZ#1046410, BZ#1164296

On 32-bit architectures, an X11 protocol client was under certain circumstances disconnected after processing a large number of X11 requests. With this update, the libxcb library exposes the request sequence number as a 64-bit integer so that libX11 can make use of 64-bit sequence number even on 32-bit systems. As a result, the described failure of the X11 client no longer occurs.

Security Fix

CVE-2015-1819

A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory.

Enhancement

BZ#1085584

This update adds support for failover between Precision Time Protocol (PTP) domains or Network Time Protocol (NTP) sources. The system is now able to fall back to an alternate time source if PTP becomes unavailable, or maintain PTP synchronization in the event of Network Interface Controller (NIC) failure by using another NIC in the system.