Product SiteDocumentation Site

Red Hat Enterprise Linux 6

6.1 Technical Notes

Technical Release Documentation

Legal Notice

Copyright © 2011 Red Hat Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
All other trademarks are the property of their respective owners.


1801 Varsity Drive
RaleighNC 27606-2072 USA
Phone: +1 919 754 3700
Phone: 888 733 4281
Fax: +1 919 754 3701

Abstract
The Red Hat Enterprise Linux 6.1 Technical Notes list and document the changes made to the Red Hat Enterprise Linux 6 operating system and its accompanying applications between Red Hat Enterprise Linux 6.0 and minor release Red Hat Enterprise Linux 6.1.

1. Package Updates
1.1. abrt
1.2. acroread
1.3. anaconda
1.4. apr
1.5. apr-util
1.6. at
1.7. audit
1.8. augeas and virt-v2v
1.9. authconfig
1.10. autofs
1.11. avahi
1.12. bash
1.13. bfa-firmware
1.14. bind
1.15. bind-dyndb-ldap
1.16. binutils
1.17. blktrace
1.18. btrfs-progs
1.19. busybox
1.20. bzip2
1.21. certmonger
1.22. cifs-utils
1.23. cluster and gfs2-utils
1.24. compat-dapl
1.25. coolkey
1.26. coreutils
1.27. corosync
1.28. cracklib
1.29. crash
1.30. crda
1.31. cronie
1.32. cryptsetup-luks
1.33. cups
1.34. curl
1.35. cvs
1.36. dapl
1.37. dbus
1.38. device-mapper-multipath
1.39. dhcp
1.40. dovecot
1.41. dracut
1.42. e2fsprogs
1.43. ebtables
1.44. eclipse
1.45. edac-utils
1.46. efibootmgr
1.47. elfutils
1.48. emacs
1.49. epydoc
1.50. evince
1.51. evolution
1.52. evolution-data-server
1.53. evolution-mapi
1.54. fakechroot
1.55. fcoe-utils
1.56. febootstrap
1.57. fence-agents
1.58. fence-virt
1.59. file
1.60. fipscheck
1.61. firefox
1.62. firstaidkit
1.63. firstboot
1.64. freeradius
1.65. freetype
1.66. gcc
1.67. gdb
1.68. gdm
1.69. ghostscript
1.70. git
1.71. glib2
1.72. glibc
1.73. gnome-panel
1.74. gnome-power-manager
1.75. gnome-terminal
1.76. gpxe
1.77. grub
1.78. gtk2
1.79. gvfs
1.80. hal
1.81. hivex
1.82. hplip
1.83. httpd
1.84. hwdata
1.85. ibus
1.86. ibus-chewing
1.87. ibus-hangul
1.88. ibus-m17n
1.89. ibutils
1.90. im-chooser
1.91. imsettings
1.92. initscripts
1.93. iok
1.94. ipmitool
1.95. iproute
1.96. iprutils
1.97. iptables
1.98. iputils
1.99. irqbalance
1.100. iscsi-initiator-utils
1.101. iwl6000-firmware
1.102. iwl6050-firmware
1.103. java-1.6.0-openjdk
1.104. jss
1.105. kabi-whitelists
1.106. kdelibs
1.107. kdenetwork
1.108. kernel
1.109. kexec-tools
1.110. krb5
1.111. krb5-appl
1.112. ksh
1.113. ldapjdk
1.114. libcacard and spice-client
1.115. libcap-ng
1.116. libcgroup
1.117. libcmpiutil
1.118. libcxgb3
1.119. libdfp
1.120. libgcrypt
1.121. libgssglue
1.122. libguestfs
1.123. libguestfs-winsupport
1.124. libhbalinux
1.125. libica
1.126. libnl
1.127. libpciaccess
1.128. libselinux
1.129. libtdb
1.130. libtiff
1.131. libtirpc
1.132. libuser
1.133. libvirt
1.134. libvirt-cim
1.135. libvirt-java
1.136. libvirt-qpid
1.137. libvpd
1.138. libvpx
1.139. lldpad
1.140. logrotate
1.141. logwatch
1.142. lohit-devanagari-fonts
1.143. lohit-kannada-fonts
1.144. lohit-oriya-fonts
1.145. lohit-tamil-fonts
1.146. lsvpd
1.147. luci
1.148. lvm2
1.149. m17n-contrib
1.150. mailman
1.151. man-pages
1.152. man-pages-ja
1.153. man-pages-overrides
1.154. mcelog
1.155. mdadm
1.156. memtest86+
1.157. mesa
1.158. microcode_ctl
1.159. mipv6-daemon
1.160. mksh
1.161. mod_auth_mysql
1.162. mod_nss
1.163. mysql
1.164. net-snmp
1.165. net-tools
1.166. netcf
1.167. netlabel_tools
1.168. NetworkManager
1.169. NetworkManager-openswan
1.170. nfs-utils
1.171. nfs-utils-lib
1.172. nspr, nss, nss-softokn, and nss-util
1.173. nss
1.174. nss-pam-ldapd
1.175. oddjob
1.176. openais
1.177. opencryptoki
1.178. openldap
1.179. openmpi
1.180. openoffice.org
1.181. openscap
1.182. openssh
1.183. openssl
1.184. openswan
1.185. openwsman
1.186. oprofile
1.187. pacemaker
1.188. PackageKit
1.189. pam
1.190. pam_krb5
1.191. pam_ldap
1.192. pam_pkcs11
1.193. pango
1.194. papi
1.195. paps
1.196. parted
1.197. perl
1.198. perl-Mozilla-LDAP
1.199. perl-Sys-Virt
1.200. php
1.201. php-pecl-memcache
1.202. pidgin
1.203. pixman
1.204. plymouth
1.205. policycoreutils
1.206. polkit
1.207. poppler
1.208. postfix
1.209. postgresql
1.210. powerpc-utils
1.211. powertop
1.212. prelink
1.213. procps
1.214. psmisc
1.215. pykickstart
1.216. python
1.217. python-ethtool
1.218. python-gudev
1.219. python-meh
1.220. python-nss
1.221. python-pycurl
1.222. python-qpid
1.223. python-urlgrabber
1.224. python-virtinst
1.225. qemu-kvm
1.226. ql2400-firmware
1.227. ql2500-firmware
1.228. qpid-cpp
1.229. qpid-tests
1.230. qpid-tools
1.231. qt
1.232. quagga
1.233. quota
1.234. rdesktop
1.235. rds-tools
1.236. redhat-lsb
1.237. redhat-release
1.238. redhat-rpm-config
1.239. Release Notes
1.240. report
1.241. resource-agents
1.242. rgmanager
1.243. rhn-client-tools and yum-rhn-plugin
1.244. rhnlib
1.245. ricci
1.246. rpm
1.247. rsync
1.248. rsyslog
1.249. ruby
1.250. s390utils
1.251. samba
1.252. saslwrapper
1.253. screen
1.254. scsi-target-utils
1.255. seabios
1.256. selinux-policy
1.257. setup
1.258. shadow-utils
1.259. smartmontools
1.260. sos
1.261. spice-client
1.262. spice-server
1.263. spice-xpi
1.264. squashfs-tools
1.265. squid
1.266. srptools
1.267. sssd
1.268. strace
1.269. subversion
1.270. sudo
1.271. syslinux
1.272. sysstat
1.273. system-config-firewall
1.274. system-config-kickstart
1.275. system-config-users
1.276. systemtap
1.277. sysvinit-tools
1.278. tcsh
1.279. thunderbird
1.280. tigervnc
1.281. tomcat6
1.282. tuned
1.283. tzdata
1.284. udev
1.285. upstart
1.286. util-linux-ng
1.287. valgrind
1.288. vgabios
1.289. vim
1.290. virt-manager
1.291. virt-top
1.292. virt-viewer
1.293. virtio-win
1.294. volume_key
1.295. vsftpd
1.296. vte
1.297. watchdog
1.298. webkitgtk
1.299. wireshark
1.300. xguest
1.301. xinetd
1.302. xorg-x11-drv-intel
1.303. xorg-x11-drv-mga
1.304. xorg-x11-drv-nouveau
1.305. xorg-x11-drv-qxl
1.306. xorg-x11-drv-wacom and wacomcpl
1.307. xorg-x11-drv-xgi and xorg-x11-drivers
1.308. xorg-x11-server
1.309. xorg-x11-server-utils
1.310. yaboot
1.311. yum
1.312. yum-metadata-parser
1.313. yum-rhn-plugin and rhn-client-tools
1.314. yum-utils
2. New Packages
2.1. RHEA-2011:0533: 389-ds-base
2.2. RHEA-2011:0664: PyPAM
2.3. RHEA-2011:0644: biosdevname
2.4. RHEA-2011:0589: compat-openldap
2.5. RHEA-2011:0562: ding-libs
2.6. RHEA-2011:0635: foghorn
2.7. RHEA-2011:0579: hwloc
2.8. RHEA-2011:0658: icedtea-web
2.9. RHEA-2011:0631: ipa
2.10. RHEA-2011:0624: ipa-pki-theme
2.11. RHEA-2011:0811: iwl100-firmware
2.12. RHEA-2011:0552: iwl6000g2a-firmware
2.13. RHEA-2011:0553: iwl6000g2b-firmware
2.14. RHEA-2011:0660: kdewebdev
2.15. RHEA-2011:0431: kmod-hpwdt
2.16. RHEA-2011:0449: kmod-snd-hda
2.17. RHEA-2011:0777: libcxgb4
2.18. RHEA-2011:0656: libnes
2.19. RHEA-2011:0669: matahari
2.20. RHEA-2011:0629: mod_revocator
2.21. RHEA-2011:0625: netxen-firmware
2.22. RHEA-2011:0572: nuxwdog
2.23. RHEA-2011:0528: omping
2.24. RHEA-2011:0626: osutil
2.25. RHEA-2011:0623: perl-Class-MethodMaker
2.26. RHEA-2011:0709: perl-IO-Tty
2.27. RHEA-2011:0723: perl-IPC-Run
2.28. RHEA-2011:0617: perl-Parse-RecDescent
2.29. RHEA-2011:0640: perl-Term-ProgressBar
2.30. RHEA-2011:0605: perl-TermReadKey
2.31. RHEA-2011:0627: pki-core
2.32. RHEA-2011:0612: python-kerberos
2.33. RHEA-2011:0613: python-krbV
2.34. RHEA-2011:0622: python-netaddr
2.35. RHEA-2011:0630: python-pyasn1
2.36. RHEA-2011:0608: python-rhsm
2.37. RHEA-2011:0805: qpid-qmf
2.38. RHEA-2011:0654: ras-utils
2.39. RHEA-2011:0691: ruby-shadow
2.40. RHEA-2011:0671: scons
2.41. RHEA-2011:0670: sigar
2.42. RHEA-2011:0575: slapi-nis
2.43. RHEA-2011:0585: spice-protocol
2.44. RHEA-2011:0576: spice-vdagent
2.45. RHEA-2011:0611: subscription-manager
2.46. RHEA-2011:0532: svrcore
2.47. RHEA-2011:0727: system-switch-java
2.48. RHEA-2011:0657: tomcatjss
2.49. RHEA-2011:0604: virt-what
3. Technology Previews
4. Known Issues
4.1. Installer
4.2. Deployment
4.3. Virtualization
4.4. Storage and Filesystems
4.5. Networking
4.6. Clustering
4.7. Authentication
4.8. Devices
4.9. Kernel
4.10. Desktop
A. Revision History
The Red Hat Enterprise Linux 6.1 Technical Notes list and document the changes made to the Red Hat Enterprise Linux 6 operating system and its accompanying applications between Red Hat Enterprise Linux 6.0 and minor release Red Hat Enterprise Linux 6.1.
For system administrators and others planning Red Hat Enterprise Linux 6.1 upgrades and deployments, the Technical Notes provide a single, organized record of the bugs fixed in, features added to, and Technology Previews included with this new release of Red Hat Enterprise Linux.
For auditors and compliance officers, the Red Hat Enterprise Linux 6.1 Technical Notes provide a single, organized source for change tracking and compliance testing.
For every user, the Red Hat Enterprise Linux 6.1 Technical Notes provide details of what has changed in this new release.

Note

Previous versions of the Technical Notes contained a Package Manifest appendix. The Package Manifest is now available as a seperate document.

1. Package Updates

1.1. abrt

1.1.1. RHBA-2011:0619: bug fix update

Updated abrt packages that resolve several issues are now available.
The abrt package provides the Automatic Bug Reporting Tool.
These updated abrt packages provide fixes for the following bugs:
  • Prior to this update, the ABRT GUI did not warn the user when it could not connect to the Gnome keyring daemon (that is, could not save any of the user's settings). With this update, a warning message is displayed in such a case. (BZ#576866)
  • The previous version of ABRT did not properly restore the core_pattern parameter (which is used to specify a coredump file pattern name) if it was too long. This update restores the core_pattern parameter to its previous value when the abrt daemon is stopped. (BZ#614486)
  • If the TAINT_HARDWARE_UNSUPPORTED flag, which detecs hardware not officially supported by Red Hat, is set (in the /proc/sys/kernel/taint file), ABRT indicates that the flag is set in the created crash report. (BZ#623142)
  • The abrt-addon-ccpp plugin crashed due to a segmentation fault if the /proc/[PID]/ directory did not exist. With this update, ABRT no longer crashes in case the /proc/[PID]/ directory does not exist. (BZ#649309)
  • The abrt package has been upgraded to upstream version 1.1.16, which provides a number of bug fixes and enhancements over the previous version. (BZ#650975)
  • Content from various files in the /var/log/ directory is now included in the creation of an sosreport (which is created via the abrt-plugin-sosreport plugin). (BZ#665405)
  • Prior to this update, the "Help" button in the ABRT GUI displayed the "About" window. With this update, a proper help page is displayed. (BZ#666267)
  • Occasionally, ABRT did not send an attached core dump file along with a crash report. This was due to the large size of the core dump file which was consequently rejected by the server which was receiving the crash report. With this update, attachments and their sizes are listed in the crash report, making it easier to detect any problems caused by the large size of the attachments. (BZ#668875)
  • Previously, ABRT was using "Strata-Message:" headers in server responses. However, servers no longer use these headers. With this update, the aforementioned headers are no longer used by ABRT. (BZ#670492)
  • By default, in Red Hat Enterprise Linux 6, ABRT did not enable any reporters, causing environments which do not run an X server to not be notified of any crashes ABRT detected. With this update, the mailx plugin is enabled as the default reporter for every crash and the root user is now notified of any crashes via the root@localhost mailbox. (BZ#678724)
  • The duplicate hash of a crash was computed from the package NVR (Name, Version, Release), path of the executable and the backtrace hash. This caused the hash to be different for the same bug which occurred in two versions of the same package. With this update, the component name and the backtrace hash are used when computing the duplicate hash. (BZ#694410)
All users of abrt are advised to upgrade to these updated packages, which resolve these issues.

1.2. acroread

1.2.1. RHBA-2011:0813: bug fix update

Updated acroread packages that resolve an issue are now available.
Adobe Reader allows users to view and print documents in Portable Document Format (PDF).
These updated acroread packages fix the following bug:
  • With a recent update, the OpenLDAP libraries have been moved to different directory. This update changes the way Adobe Reader links to these libraries. (BZ#680202)
All users of acroread are advised to upgrade to these updated packages, which resolve this issue.

1.3. anaconda

1.3.1. RHBA-2011:0530: bug fix and enhancement update

An updated anaconda package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.1.
The anaconda package contains portions of the Anaconda installation program that can be run by the user for reconfiguration and advanced installation options.
This updated anaconda package provides fixes for the following bugs:
  • Auto-partitioning no longer clears immutable partitions. (BZ#593642)
  • Anaconda no longer creates a new EFI system partition when one is not needed. (BZ#593984)
  • Anaconda now properly detects ext2's dirty/clean states. (BZ#601862, BZ#614812)
  • Anaconda no longer forgets IP method selection in the loader when returning to a previous menu. (BZ#609570)
  • The "Proxy password" field in stage 2 now correctly displays asterisks instead of plain text. (BZ#611825)
  • Text mode now allows IPv6 configuration. (BZ#612476)
  • Anaconda no longer displays free regions of less than 1MB in extended partitions. (BZ#626025)
  • Anaconda no longer loses focus on certain screens. (BZ#671017)
  • ".treeinfo" files are now properly fetched over a proxy. (BZ#634655)
  • Anaconda now writes correct NFS (Network File System) repository information into the summary Kickstart file. (BZ#635201)
  • The /boot/ directory can now reside on an ext4 partition. (BZ#638734)
  • Anaconda no longer fails to detect a disk if its size exceeds 1TB. (BZ#654360)
  • Anaconda is once again able to detect the file system on a previously-created RAID device. (BZ#678028)
  • Anaconda now generates the correct, FIPS-enabled initramfs (initial RAM file system) when the kernel option "fips=1" is provided on the kernel command line. (BZ#692350)
  • Anaconda incorrectly failed with a traceback when an attempt to unpack a driver disk to a pre-existing root partition did not succeed. (BZ#640260)
  • Fingerprint authentication has been disabled on IBM System z because it is not supported on that platform. (BZ#676854)
  • Static IPv4 configuration is now used when requested in stage 2: Anaconda no longer falls back to using DHCP. (BZ#641324)
  • Anaconda is now able to properly detect an md RAID array with a spare disk. (BZ#652874)
  • Anaconda now correctly reports an error when a network-based certificate is specified in Kickstart with no networking setup. (BZ#636533)
  • A custom value is now properly honored when shrinking a file system. (BZ#621490)
  • The "list-harddrives" command output for CCISS devices is now valid input for Kickstart files. (BZ#702430)
  • Anaconda now selects the new kernel after upgrade. (BZ#683891)
In addition, this updated package provides the following enhancements:
  • This update adds the cnic, bnx2i, and be2net drivers for better iSCSI support. (BZ#442980, BZ#529443)
  • This update adds drivers for the Emulex 10GbE PCI-E Gen2 and Chelsio T4 10GbE network adapters. (BZ#633307, 633319)
  • Algorithms from the SHA-2 hash function family can now be used to encrypt the boot loader password. (BZ#554874)
  • Anaconda now allows a username and password to be entered for iSCSI Discovery sessions. (BZ#607827)
  • The "rdate", "which", "tty" and "ntpdate" commands have been added to the install image. (BZ#354432, 614399)
  • The graphical installer now runs using the full display resolution. (BZ#663411)
  • Anaconda now features improved SSL certificate-handling. (BZ#667122, BZ#599042, BZ#678574)
  • It is now possible to specify additional packages when using the "@packages --default" Kickstart option. (BZ#621349)
  • On IBM System z, the /boot/ directory can now be placed on an LVM logical volume. (BZ#618376)
  • Anaconda now supports blacklisting to determine which modules can be loaded during installation. (BZ#644535)
Users are advised to upgrade to this updated anaconda package, which resolves these issues and adds these enhancements.

1.4. apr

1.4.1. RHSA-2011:0507: Moderate security update

The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.
Updated apr packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
It was discovered that the apr_fnmatch() function used an unconstrained recursion when processing patterns with the '*' wildcard. An attacker could use this flaw to cause an application using this function, which also accepted untrusted input as a pattern for matching (such as an httpd server using the mod_autoindex module), to exhaust all stack memory or use an excessive amount of CPU time when performing matching. (CVE-2011-0419)
Red Hat would like to thank Maksymilian Arciemowicz for reporting this issue.
All apr users should upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the apr library, such as httpd, must be restarted for this update to take effect.

1.5. apr-util

1.5.1. RHSA-2010:0950: Moderate security update

Updated apr-util packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. apr-util is a library which provides additional utility interfaces for APR; including support for XML parsing, LDAP, database interfaces, URI parsing, and more.
It was found that certain input could cause the apr-util library to allocate more memory than intended in the apr_brigade_split_line() function. An attacker able to provide input in small chunks to an application using the apr-util library (such as httpd) could possibly use this flaw to trigger high memory consumption. (CVE-2010-1623)
All apr-util users should upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the apr-util library, such as httpd, must be restarted for this update to take effect.

1.6. at

1.6.1. RHBA-2011:0016: bug fix update

An updated at package that fixes bugs is now available for Red Hat Enterprise Linux 6.
At and batch read commands from standard input or from a specified file. At allows you to specify that a command will be run at a particular time. Batch will execute commands when the system load levels drop to a particular level. Both commands use /bin/sh.
This update fixes the following bugs:
  • Previously, the at daemon (atd) wrongly contained permissions 0755 for atd configuration. With this update, atd has the correct permissions 0644 as have all other such files. (BZ#589099)
  • Previously, the initscript caused the "OK" message to be printed twice. With this update, the initscript behaves as expected and no longer echoes duplicate messages. (BZ#615104)
  • Previously, the PIE label was not compiled with -fpie/-fPIE. This update adds a PIE compile option to specify secure Position-Independent Executables. (BZ#630019)
All users of at are advised to upgrade to this updated package, which resolves this issue.

1.7. audit

1.7.1. RHBA-2011:0653: bug fix and enhancement update

Updated audit packages that fix bugs and provide enhancements are now available for Red Hat Enterprise Linux 6.
The audit packages contain the user space utilities for storing and searching the audit records which have been generated by the audit subsystem in the Linux 2.6 kernel.
This update fixes the following bugs:
  • System processes — that is processes with an audit id (auid) of -1 — are logged by the audit subsystem. However, if the ausearch utility was used to locate events where the auid was -1, it would display all events. In this update, under these circumstances, ausearch only returns events with an auid of -1. (BZ#670938)
  • A value of 'syslog' for the 'disk_error_action' parameter in 'auditd.conf' instructs auditd to issue a warning to syslog if an error is encountered when writing audit events to disk. If 'disk_error_action' was set to 'syslog', auditd always attempted to exec() a child process. Consequently, if a disk error was encountered (ie. a disk full error), auditd would attempt to exec() a null child process, and logging would not resume after the disk error was reported to syslog. In this update the child process is not called when the 'syslog' option is used, and logging continues as expected. (BZ#688664)
  • Previously if an audispd plug-in was restarted, the plug-in was not marked as active. Consequently, the remote logging plug-in (audisp-remote) was unable to bind to a privileged port on reconnect because all privileges had been dropped. In these updated packages, audispd plug-ins are marked as active after being restarted, and the audisp-remote plug-in functions as expected. (BZ#695605)
  • Previously, the "autrace -r" command on the IBM System z architecture attempted to audit network syscalls not available on IBM System z. Consequently, an error similar to the following might have been returned:
    Error inserting audit rule for pid=13163
    With this update, "autrace -r" is now aware of system calls not available on this architecture, which resolves this issue. (BZ#697463)
  • When an ignore directive was included in an audit.rules configuration file, the auditctl utility became unresponsive when attempting to load those rules. With this update, the issue is resolved. (BZ#640948)
  • Previously, the audit_encode_nv_string() function was not checking if the memory allocation (malloc) it was performing succeeded. Consequently, if the malloc operation encountered an out of memory (OOM) error, audit_encode_nv_string() crashed attempting to reference a NULL pointer. With this update, audit_encode_nv_string() checks if the malloc is successful, which resolves this issue. (BZ#647128)
  • Previously, the man page for the "audit_encode_nv_string" function incorrectly documented the return value type as an "int". The man page for "audit_encode_nv_string" now correctly displays return value type for the "audit_encode_nv_string" function as a "char *" (BZ#647131)
Additionally, the audit packages are updated (rebased) to the upstream version 2.1-1. (BZ#584981) This rebase provides the following bugfixes and enhancements:
  • autrace now uses the correct syscalls on i386 systems
  • Added support for new event types related to virtualization, netfilter, the mmap syscall, key based authentication, and cryptographic session establishment.
  • Updated syscall tables for the 2.6.37 kernel.
  • Updated sample rules for new syscalls and packages.
  • The overflow_action configuration item was added to audisp-remote to allow configurable actions for remote logging queue overflows.
  • A new option in the audisp-syslog plug-in to send syslog audit events to local[0-7]
All audit users are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.

1.8. augeas and virt-v2v

1.8.1. RHBA-2011:0650: bug fix update

Updated virt-v2v and augeas packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
virt-v2v is a tool for converting virtual machines to use the KVM hypervisor. It modifies both the virtual machine image and its associated libvirt metadata. virt-v2v will also configure a guest to use VirtIO drivers if possible.
augeas is a library for programmatically editing configuration files. augeas parses configuration files as a tree structure, which it exposes through its public API.
Bug fixes:
BZ#609483
Red Hat Enterprise Linux guest conversion did not update /etc/sysconfig/kernel, which would lead to an incorrect kernel being set as the default in future updates. This would cause boot failure. /etc/sysconfig/kernel now updates correctly.
BZ#616720
Partially written guest images were not cleaned up if a conversion to a libvirt target failed or was interrupted. With this update, all created volumes are removed if a conversion is not successful.
BZ#618965
virt-v2v would not always update software in the transfer volume when updates were available because it relied on timestamps. The transfer volume is now updated whenever virt-v2v is used.
BZ#623571
virt-v2v could not detect VMware Tools to uninstall it if VMware Tools was installed via tarball. When VMware Tools detected that it was no longer running on a VMware platform and attempted to disable itself on the guest, it overwrote changes made by virt-v2v during conversion. This resulted in broken networking and initrd images containing unnecessary drivers. virt-v2v can now detect and uninstall VMware Tools even when VMware Tools is installed via tarball.
BZ#623579
If a Linux guest had an invalid default entry in the grub.conf file, virt-v2v assumed it was an i686 guest. This resulted in a converted guest that did not boot. virt-v2v now assumes an AMD64 or Intel 64 default architecture instead of i686.
BZ#642258
virt-v2v could not convert a Red Hat Enterprise Linux guest that did not have the /etc/securetty file. Conversion without this file is now possible.
BZ#643867
Conversion failed if conversion required updating the kernel and the guest had additional kernel modules installed. Conversion now succeeds and virt-v2v no longer attempts to uninstall old kernels.
BZ#644295
When performing an offline installation of the VirtIO block driver in a Windows guest, virt-v2v incorrectly assumed that ControlSet001 was always the current control set, even if ControlSet001 had been marked as failed. The correct control set is now detected, and the VirtIO block driver installed in the correct location.
BZ#656883
When creating a libvirt guest using block storage, virt-v2v incorrectly set the disk type to auto. This made libvirt unable to start the guest. Disk type is now set explicitly based on source metadata or other detection methods.
BZ#581421
In certain circumstances, virt-v2v exited with a return value of 0, even though conversion failed. The correct values are now returned.
BZ#609448
Red Hat Enterprise Linux guest conversion did not update /boot/grub/device.map with converted block device names in certain circumstances. device.map now updates as expected.
BZ#670778
virt-v2v failed to convert a guest to a Red Hat Enterprise Virtualization target if the current working directory was not universally readable. Universal readability is no longer required.
BZ#672521
virt-v2v failed to convert Windows guests that had a C:\Temp directory because it created a C:\temp directory without checking for file names that used alternative cases. virt-v2v now checks for case-sensitive file names before creating an appropriate temporary directory.
BZ#671300
virt-v2v failed to enable VirtIO support when converting a Xen guest that had both a paravirtualized Xen kernel and a fully virtualized kernel installed. The fully virtualized kernel is now made the default kernel and conversion succeeds as expected.
BZ#676323
It was not possible to create a Red Hat Enterprise Virtualization template from a guest that was converted by virt-v2v. Guests imported with this updated package can now be used to create templates.
BZ#679017
When converting a 64-bit Windows XP guest to run on Red Hat Enterprise Virtualization, virt-v2v incorrectly identified the guest as 64-bit Windows 2003. 64-bit Windows XP guests are now correctly identified as Windows XP when imported into Red Hat Enterprise Virtualization.
BZ#690286
augeas was not thread safe, and could leak file descriptors when multiple programs attempted to use the libvirt library simultaneously. This resulted in the failure of the calling program. augeas has been modified to remove the global variable that caused this threading issue.
BZ#620449
Sparse storage was not retained across conversion. Storage type is now retained across conversion, but can be modified with the -oa flag.
BZ#654531
virt-v2v used enum integers to populate the ovf:disk-interface field when converting for Red Hat Enterprise Virtualization. However, this produced an ovf file that was not intelligible to Red Hat Enterprise Virtualization Manager. The disk-interface is now populated with correct enum values (IDE, SCSI, or VirtIO), allowing Red Hat Enterprise Virtualization Manager to understand the ovf file.
BZ#664942
When converting a guest to run on Red Hat Enterprise Virtualization, virt-v2v identified created storage as sparse or raw. This combination is not supported when importing into a data center that uses block storage (fibre channel or iSCSI). virt-v2v can now convert storage format and allocation policy correctly. Additionally, customers can specify a format and allocation policy compatible with the target data center type by using the -of and -oa command line options.
BZ#671083
virt-v2v conversion would hang if its output was redirected at the command line. This bug was reported and corrected during development. It was not seen in production systems in the field.
BZ#678950
Conversion of a Red Hat Enterprise Linux Desktop virtual machine failed with the following error:
Can't locate object method "can_handle" via package
"Sys::VirtV2V::Converter::RedHat" at
/usr/share/perl5/vendor_perl/Sys/VirtV2V/Converter.pm line 121.
This issue has been resolved and conversion should now complete successfully
Enhancements:
BZ#581108
virt-v2v can now convert guests which use the qcow2 disk format.
BZ#615977
virt-v2v can now convert Microsoft Windows guests to run on a libvirt or Red Hat Enterprise Virtualization target without requiring the Guest Tools ISO.
BZ#671353
virt-v2v includes support for Windows XP guests with the latest version of virtio-win. New installations of Red Hat Enterprise Linux 6.1 will have this support automatically. Users upgrading from an earlier version of virt-v2v may need to manually alter /etc/virt-v2v.conf. If you see the following error message when attempting to convert a Windows XP guest:
virt-v2v: No app in config matches os='windows' name='virtio' major='5'
minor='1' arch='i386'
the following section must be added to /etc/virt-v2v.conf:
<app os='windows' major='5' minor='1' arch='i386' name='virtio'>
    <path>/usr/share/virtio-win/drivers/i386/WinXP</path>
  </app>
  <app os='windows' major='5' minor='1' arch='x86_64' name='virtio'>
    <path>/usr/share/virtio-win/drivers/amd64/WinXP</path>
</app>
BZ#676553
virt-v2v now enables the conversion of Windows guests which do not have available VirtIO drivers, although these guests are not guaranteed to operate correctly after conversion.
BZ#615182
virt-v2v requires root privileges to convert a guest to run on Red Hat Enterprise Virtualization. When run without these privileges, virt-v2v output an error to this effect but did not fail immediately. This resulted in a number of other error messages being printed, which obscured the primary error. virt-v2v now fails immediately after it outputs the primary privilege error.
BZ#672498
virt-v2v now relies on libvirt to detect volume metadata such as size and format. Guests with volumes that are not contained in a storage pool will therefore fail to be converted. The error message that results from such a failure has been updated to provide detailed information on how to create a storage pool to contain the target volume.
All users of virt-v2v and augeas are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

1.9. authconfig

1.9.1. RHBA-2011:0595: bug fix and enhancement update

Updated authconfig packages that fix several bugs and add an enhancement are now available.
The authconfig package contains a command line utility and a GUI application that can configure a workstation to be a client for certain network user information and authentication schemes and other user information and authentication related options.
These updated authconfig packages provide fixes for the following bugs:
  • Prior to this update, authconfig unnecessarily restarted the user information and authentication services even though there were no configuration changes that would require the restart. With this update, services are no longer restarted unless explicitly required. (BZ#595261)
  • The authentication configuration utility did not keep the "Require smart card for login" check box set when Kerberos was also enabled. When the check box was checked and the configuration was saved with the "Apply" button, the system would correctly require smart card for login. However, on the subsequent run of the authentication configuration utility the check box would be unchecked again and it was necessary to check it again to keep the option switched on. With this update, the "Require smart card for login" stays checked even after subsequent runs of the authentication configuration utility. (BZ#620475)
  • The authentication configuration tool GUI incorrectly duplicated its window when the "Revert" button was pressed. This update fixes the duplicity problem. (BZ#621632)
  • In some cases, when multiple configuration files with the same configuration settings contained different configuration values for a setting, the configuration files contents were not properly synchronized with authconfig. With this update, the synchronization works as expected. (BZ#624159)
  • The authentication configuration tool GUI allowed to choose user identity and authentication schemes which require packages that are not installed on the system by default. With this update, certain identity and authentication schemes cannot be configured when they are not installed on the system. (BZ#639747)
  • The authconfig textual user interface incorrectly required the nss-pam-ldap package to be installed when the configuration used SSSD for LDAP user identification. With this update, the nss-pam-ldap package is not required in such a case. (BZ#663882)
  • Prior to this update, the authentication configuration tool overwrote the cache_credentials value to "True" in the SSSD configuration file (/etc/sssd/sssd.conf) if the configuration allowed using SSSD for the network user information and authentication services. With this update, the "cache_credentials" parameter is no longer overwritten in the aforementioned case. (BZ#674844)
  • The "system-config-authentication" command crashed when executed in an environment without the X server running. With this update, a proper error message is printed in the aforementioned case. (BZ#676333)
In addition, these updated authconfig packages provide the following enhancement:
  • The authconfig package has been upgraded to upstream version 6.1.12, which provides a number of bug fixes and enhancements over the previous version. This version also adds new options: "--enableforcelegacy" and "--disableforcelegacy". These options allow the user to use legacy LDAP and Kerberos user identity and authentication modules instead of the SSSD modules. (BZ#655910)
Users are advised to upgrade to these updated authconfig packages, which resolve these issues and add this enhancement.

1.10. autofs

1.10.1. RHBA-2011:0403: bug fix update

An updated autofs package that fixes one bug is now available for Red Hat Enterprise Linux 6.
The autofs utility controls the operation of the automount daemon. The automount daemon automatically mounts file systems when you use them, and unmounts them when they are not busy.
This update fixes the following bug:
  • Prior to this update, an attempt to restart the autofs service while a mounted file system was in use caused the service to stop responding upon its startup. This was due to inappropriate locking during the recursive reconstruction of mount trees of pre-existing mounted multi-mount map entries. With this update, the underlying source code has been adapted to avoid the deadlock during the mount tree reconstruction, so that autofs now starts as expected. Additionally, this update prevents autofs from occasionally terminating with a segmentation fault upon a map entry lookup. (BZ#689754)
All users of autofs are advised to upgrade to this updated package, which fixes this bug.

1.10.2. RHBA-2011:0753: bug fix update

An updated autofs package that fixes numerous bugs is now available for Red Hat Enterprise Linux 6.
The autofs utility controls the operation of the automount daemon. The automount daemon automatically mounts file systems when you use them, and unmounts them when they are not busy.
Bug fixes:
BZ#629480
When using client certificates with autofs, the certificate DN could not be used in LDAP ACLs. This prevented autofs from authenticating via SASL external. With this update, the SASL EXTERNAL authentication mechanism is used for mapping the certificate DN to an LDAP DN, allowing autofs to support SASL External authentication via TLS.
BZ#616426
The autfs initscript did not implement the functions force-reload and try-restart. Instead, the error try-restart and force-reload service action not supported was given and returned 3. This patch adds these initscript options so that the they are now implement and return appropriate values.
BZ#629359
Debugging output from autofs did not include IP addresses for mounts alongside hostname information which made it difficult to debug issues when using round-robin DNS. This update adds this feature, allowing logging output to show the IP address of a mount, rather than just the host name.
BZ#572608
Previously, automount woke up once per second to check for any scheduled tasks, despite the fact that adding a task triggered a wake up of that thread, which lead to a tight loop which used excessive CPU. This update removes these unnecessary wakeups.
BZ#520844
When an autofs map entry had multiple host names associated with it, there was no way to override the effect of the network proximity. This was a problem when a need existed to be able to rely on selection strictly by weight. With this patch, the server response time is also taken into consideration when selecting a server for the target of the mount. The pseudo option --use-weight-only was added that can only be used with master map entries or with individual map entries in order to provide this. For individual map entries, the option no-use-weight-only can also be used to override the master map option.
BZ#666340
If there were characters that matched isspace() (such as \t and \n) in a passed map entry key and there was no space in the key, these character were not properly preserved, which led to failed or incorrect mounts. This was caused by an incorrect attempt at optimization by using a check to see if a space was present in the passed key and only then processing each character of the key individually, escaping any isspace() characters. This patch adds a check for isspace() characters to the same check for a space, eliminating the problem.
BZ#630954
If the map type was explicitly specified for a map, then the map was not properly updated when a re-read was requested. This was because the map stale flag was incorrectly cleared after the lookup module read the map, instead of at the completion of the update procedure. In this patch, the map stale flag should only be cleared if the map read fails for some reason, otherwise it updates when the refresh is completed.
BZ#650009
Previously, when autofs was restarted with active mounts, due to a possible recursion when mounting multi-mount map entries, autofs would block indefinitely. This was caused by a cache readlock which was held when calling mount_subtree() from parse_mount () in parse_sun.c. This patch fixes remount locking which resolves the issue.
BZ#577099
The master map DN string parsing is quite strict and, previously, autofs could not use an automount LDAP DN using the l (localityName) attribute. This patch adds the allowable attribute 'l', the locality.
BZ#700691
A previous bug fix caused the state queue manager thread to stop processing events, and mounts expired and then stopped. This was caused when the state queue task manager transferred an automount point pending task to its task queue for execution. The state queue was then mistakenly being seen as empty when the completing task was the only task in the state queue. This patch adds a check to allow the queue manager thread to continue, resolving the issue.
BZ#700697
The autofs gave a segmentation fault on the next null cache look up in the auto.master file. This was due to a regression issue, where a function to clean the null map entry cache, added to avoid a race when re-reading the master map, mistakenly failed to clear the hash bracket array entries. This patch sets the hash bracket array entries to NULL, resolving the issue.
All users of autofs are advised to upgrade to these updated packages, which provide numerous bug fixes.

1.11. avahi

1.11.1. RHSA-2011:0779: Moderate security and bug fix update

Updated avahi packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print to, and find shared files on other computers.
A flaw was found in the way the Avahi daemon (avahi-daemon) processed Multicast DNS (mDNS) packets with an empty payload. An attacker on the local network could use this flaw to cause avahi-daemon on a target system to enter an infinite loop via an empty mDNS UDP packet. (CVE-2011-1002)
This update also fixes the following bug:
  • Previously, the avahi packages in Red Hat Enterprise Linux 6 were not compiled with standard RPM CFLAGS; therefore, the Stack Protector and Fortify Source protections were not enabled, and the debuginfo packages did not contain the information required for debugging. This update corrects this issue by using proper CFLAGS when compiling the packages. (BZ#629954, BZ#684276)
All users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the update, avahi-daemon will be restarted automatically.

1.12. bash

1.12.1. RHBA-2011:0689: bug fix update

Updated bash packages that fix three bugs are now available for Red Hat Enterprise Linux 6.
Bash (Bourne-again shell) is the default shell for Red Hat Enterprise Linux.
This update fixes the following bugs:
  • When using arithmetic evaluation on an associative array with integer values, an attempt to provide an invalid subscript caused Bash to terminate unexpectedly with a segmentation fault. This update applies a patch that corrects this error, and providing an invalid subscript no longer causes the bash interpreter to crash. (BZ#618289)
  • Prior to this update, the Bash interpreter reported broken pipe errors for both external and built-in commands. Since these errors are only relevant for external commands, this update adapts the underlying source code to suppress the broken pipe error messages for built-in commands. As a result, only relevant messages are now presented to users. (BZ#664468)
  • Previous version of the bash(1) manual page did not provide a clear description of the "break", "continue", and "suspend" built-in commands. This update corrects this error, and extends the manual page to provide accurate and complete descriptions of these commands. (BZ#619704)
All users are advised to upgrade to these updated packages, which fix these bugs.

1.13. bfa-firmware

1.13.1. RHBA-2011:0593: bug fix and enhancement update

An updated bfa-firmware package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.
The bfa-firmware package contains the Brocade Fibre Channel Host Bus Adapter (HBA) Firmware to run Brocade Fibre Channel and CNA adapters. This package also supports the Brocade BNA network adapter.
The bfa-firmware package has been upgraded to upstream version 2.3.2.3, which provides a number of bug fixes and enhancements over the previous version. (BZ#617017)
All users of Brocade Fibre Channel and CNA adapters are advised to upgrade to this updated package, which fixes several bugs and adds various enhancements.

1.14. bind

1.14.1. RHSA-2010:0975: Important security update

Updated bind packages that fix two security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
It was discovered that named did not invalidate previously cached RRSIG records when adding an NCACHE record for the same entry to the cache. A remote attacker allowed to send recursive DNS queries to named could use this flaw to crash named. (CVE-2010-3613)
It was discovered that, in certain cases, named did not properly perform DNSSEC validation of an NS RRset for zones in the middle of a DNSKEY algorithm rollover. This flaw could cause the validator to incorrectly determine that the zone is insecure and not protected by DNSSEC. (CVE-2010-3614)
All BIND users are advised to upgrade to these updated packages, which contain a backported patch to resolve these issues. After installing the update, the BIND daemon (named) will be restarted automatically.

1.14.2. RHBA-2011:0541: bug fix and enhancement update

Updated bind packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named), a resolver library (routines applications use when interfacing with DNS), and tools for verifying that the DNS server is operating correctly.
This update fixes the following bugs:
  • previously, bind on the 64-bit PowerPC architecture used emulated atomic operations rather than native instructions. In this updated package bind on the 64-bit PowerPC architecture uses the same native atomic operations as the PowerPC architecture. (BZ#623638)
  • previously, the bind package generated the /etc/rndc.key file. However, generating this file used entropy from /dev/random. Consequently, installation of the bind package might have hung. The rndc.key is used by the rndc utility for advanced administration commands and is no longer automatically generated during installation of the bind package. Users requiring the rndc utility should generate the key themselves, via the "rndc-confgen -a" command. (BZ#677381)
  • under certain circumstances, "named" was entering a deadlock. Consequently, "named" could not be stopped using the "/etc/init.d/named stop" command. In this updated package, the deadlock no longer occurs, resolving this issue. (BZ#623122)
  • previously, the named_sdb PostgreSQL database backend failed to reconnect to the database when the connection failed during named_sdb startup. With this update, named writes an error message to the system log and tries to reconnect during every lookup. (BZ#623190)
  • previously, file conflicts prevented the i686 and x86_64 versions of bind-devel from being installed on the same machine. In this update, the file conflict is resolved and both the i686 and x86_64 bind-devel packages can be installed on the same system. (BZ#658045)
  • previously, initscript killed all processes with the name "named" when stopping the named daemon. With this update, initscript kills only the selected one. (BZ#622785)
  • the return codes of the "dig" utility are documented in the dig man page. (BZ#640538)
  • previously the named.8 manpage mentioned the system-config-bind utility. This utility is not included with Red Hat Enterprise Linux 6. The man page is updated to remove the reference to the system-config-bind utility. (BZ#660676)
  • the "status" action of the named initscript would not complete when the bind-sdb package was installed. These updated packages resolve this issue. (BZ#661663, BZ#672777)
  • when resolv.conf contained the "search" keyword with no arguments, host/nslookup/dig utilities failed to parse it correctly. In these updated packages, such lines are ignored. (BZ#669163)
  • previously, the nsupdate man page incorrectly listed HMAC-MD5 as the only TSIG algorithm. In this updated package, the list of encryption algorithms was removed from the nsupdate man page. The dnssec-keygen man page contains a complete list of usable encryption algorithms. (BZ#672819)
In addition, this update adds the following enhancements:
  • the bind packages in this update are rebased to version 9.7.3. The References section of this erratum contains a link to the bind release notes. (BZ#653486)
  • the host utility now honors "debug", "attempts" and "timeout" options in resolv.conf. (BZ#622764)
  • a new option, called DISABLE_ZONE_CHECKING, has been added to /etc/sysconfig/named. This option adds the possibility to bypass zone validation via the named-checkzone utility in initscript and allows starting named with misconfigured zones. (BZ#623673)
  • with this update: size, MD5 and the modification time of the /etc/sysconfig/named configuration file are no longer checked via the "rpm -V bind" command. (BZ#646932)
  • Root zone DNSKEY is now included in the bind package, in the /etc/named.root.key file. (BZ#667375)
Users are advised to upgrade to these updated bind packages, which resolve these issues and add these enhancements.

1.15. bind-dyndb-ldap

1.15.1. RHBA-2011:0606: bug fix and enhancement update

An updated bind-dyndb-ldap package that fixes several bugs and adds several enhancements is now available for Red Hat Enterprise Linux 6.
The dynamic LDAP back-end is a plug-in for BIND that provides an LDAP database back-end capabilities. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server.
This update fixes the following bugs:
  • the plugin didn't load child zones correctly. The plugin has been fixed and now loads child zones well. (BZ#658286)
  • named aborted when attempting to connect to a local LDAP server during boot. Now it does not abort but the administrator must call "rndc reload" when LDAP server starts to correctly fetch zones. (BZ#662930)
  • the plugin flooded logs with too many messages. Now those messages are logged only when named is started with the "-d" (debug) parameter. (BZ#666244)
  • the plugin was rebased to 0.2.0 bugfix release. (BZ#667704)
  • queries for ANY type were not handled correctly, only SOA records were returned. The plugin was fixed and now all records are returned when asked. (BZ#667727)
  • the plugin failed to reconnect to the LDAP server when SASL authentication was used. The plugin was fixed and reconnection now works. (BZ#667730)
  • the plugin failed to delete nodes from the LDAP database when all resource records associated with the node were removed. Now the plugin deletes the empty nodes. (BZ#667732)
  • the plugin did not emit enough information when it was configured to use invalid credentials. Now it emits enough details. (BZ#667733)
This update adds the following enhancements:
  • It is now possible to specify allow-query and allow-transfer ACLs for zones. (BZ#667729)
  • It is now possible to set timeout for queries to the LDAP server. (BZ#667734)
Users are advised to upgrade to this updated bind-dyndb-ldap package, which resolves these issues.

1.16. binutils

1.16.1. RHBA-2011:0614: bug fix and enhancement update

Updated binutils packages that fix bugs and add various enhancements are now available.
Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).
These updated binutils packages provide fixes for the following bugs:
  • fix strip to keep the address of an empty section consistent with its offset in the object (BZ#614443)
  • fix if one of the input files is of a non-ELF format the linker may crash (BZ#680143)
  • fix occasional crash in linker (BZ#697703)
This update also adds these enhancements:
  • add support for the large code model on PowerPC (BZ#663587)
  • add support for ELF core dump notes sections for extra s390 registers (BZ#633448)
  • add support for the new instructions in the System z196 processor (BZ#631540)
  • add support for ELF objects with more then 65535 program headers (BZ#578661)
Users are advised to upgrade to these updated binutils packages, which resolve these issues.

1.17. blktrace

1.17.1. RHBA-2011:0718: bug fix update

Updated blktrace packages that fix numerous bugs are now available for Red Hat Enterprise Linux 6.
The blktrace packages contain a number of utilities to record the I/O trace information for the kernel to user space, and utilities to analyze and view the trace information. This includes:
  • blktrace (to extract event traces from the kernel)
  • blkparse (to produce formatted output of event streams)
  • blkiomon (for i/o monitoring - periodically generating per-device request size and request latency statistics, and providing histograms)
  • btreplay (for recreating IO loads recorded by blktrace)
  • btt (to analyse block i/o traces produces by blktrace)
Bug fixes:
BZ#583615
When the device list contained the same device as supplied on the command line, blktrace stopped immediately and further I/O tracing was impossible. This occurred when an error returned in BLKTRACESETUP ioctl caused the program to terminate whenever a device was duplicated in the devpaths. This patch ensures devices are not duplicated in the devpaths pool, thus fixing the problem.
BZ#619201
When blktrace was run without parameters, it incorrectly included the version number in its usage message. This resulted in the false assumption that the version number was a required parameter. This update edits the usage message so that the version number is not printed when running blktrace, blkparce or btt without parameters, avoiding any confusion.
BZ#650229
Previously, btreplay would give a 'No such file or directory' error when attempting to execute with /dev/cciss/foo because of the long path name. This was caused by missing the back conversion of underscores to slashes. This update converts the underscores to slashes to restore the device names with longer paths.
BZ#583624
Running 'blktrace -d <device> -k' once did not kill a running background trace. Running it a second time resulted in a 'BLKTRACETEARDOWN: Invalid argument' message, after which any further attempt to run it returned 'BLKTRACESETUP: No such file or directory'. This was caused by the option -k clobbering information about running a trace by the kernel (that is, blk_trace_remove), while files opened in debugfs by blktrace running in the background were not released. In this patch, the documentation is updated to remove the faulty 'kill' option. It advices to send a SIGINT signal via kill(1) to the running background blktrace for its correct termination.
BZ#650243
The documentation falsely gave the impression that blkiomon was not giving the correct output when working with a logical volume device. When working on a logical volume device, blkiomon does not understand the output of blktrace,as a logical volume device is quiet. While working with a physical device, it prints I/O statistics as expected. This patch updates the documentation to reflect this.
BZ#583695
When blkparse was run with a non-existent file as an argument, it returned no errors and the exit-code was zero. This update provides a warning message when a non-existent file is used as an argument and exits with a non-zero status.
BZ#595356
Previously, blktrace would not end after 30 seconds. Instead it would remain running until the user killed it, after which any further attempts to run it failed with an error. This was because when open_ios() failed, tracer_wait_unblock() in thread_main() waits for an event that will never occur. Because the event never occurs, any future attempts to run blktrace failed with an error. This update makes sure that unblock_tracers() is also called when an unsuccessful event occurs, (that is, when nthreads_running != ncpus).
BZ#595413
There was a mistake in the man page for btrecord. It incorrectly documented the option --input-base, which is unsupported, and the supported --max-bunch-time was undocumented. This update replaces --input-base with --input-directory, and adds the option --max-bunch to the btrecord man page.
BZ#595419
The blkiomon man page was missing elements. The options -d and --dump-lldd were not recorded. This patch adds these and a drv_data mast description to the blktrace man page.
BZ#595615
The blkparce man page was missing six elements. These were -A, --set-mask, -a, --act-mask, -D, and --input-directory. These options are now added to the blkparce man page.
BZ#595620
The blktrace man page was missing sixteen elements. These were:
  • -d <dev> | --dev=<dev>
  • -r <debugfs path> | --relay=<debugfs path>
  • -o <file> | --output=<file>
  • -D <dir> | --output-dir=<dir>
  • -w <time> | --stopwatch=<time>
  • -a <action field> | --act-mask=<action field>
  • -A <action mask> | --set-mask=<action mask>
  • -b <size> | --buffer-size
  • -n <number> | --num-sub-buffers=<number>
  • -l | --listen
  • -h <hostname> | --host=<hostname>
  • -p <port number> | --port=<port number>
  • -s | --no-sendfile
  • -I <devs file> | --input-devs=<devs file>
  • -v <version> | --versio
  • -V <version> | --version
These options are now added to the blktrace man page.
BZ#595623
The btreplay man page was missing three elements. These were -t, -x, and --acc-factor. These options are now added to the btreplay man page.
BZ#595628
The btt man page was missing four elements. These were -X, -m, --easy-parse-avgs, and --seeks-per-second. These options are now added to the btt man page.
All users are advised to upgrade to these updated packages, which resolve these issues.

1.18. btrfs-progs

1.18.1. RHEA-2011:0567: enhancement update

An updated btrfs-progs package that adds an enhancement is now available for Red Hat Enterprise Linux 6.
The btrfs-progs package provides user-space programs to create, check, modify, and correct any inconsistencies in a Btrfs file system.
This update adds the following enhancement:
  • The btrfs-progs package has been updated to the latest upstream version, and newly includes the btrfs utility for easier administration of Btrfs file systems. (BZ#645741)
All users of Btrfs are advised to upgrade to this updated package, which adds this enhancement.

1.19. busybox

1.19.1. RHBA-2011:0559: bug fix update

Updated busybox packages that fixes several bugs are now available.
Busybox is a single binary containing a large number of system commands, including a shell. This package can be useful for recovering from certain types of system failures, particularly those involving broken shared libraries.
This update addresses the following issues:
  • Previously, the cpio applet included with busybox printed summary messages to stdout instead of stderr as the stand alone cpio does. Consequently nothing was returned to the shell when the busybox cpio applet ran. The updated applet include a patch that corrects this: the busybox cpio applet now prints summary messages to stderr, returning information to the shell as the standalone utility does. (BZ#615391)
  • As initially released, the "busybox hwclock" utility included with Red Hat Enterprise Linux 6 honored the current Filesystem Hierarchy Standard (FHS 2.3) and assumed the adjtime state file was at /var/lib/hwclock/adjtime. If kexec was invoked to load a second kernel over a crashed kernel, this caused "busybox hwclock" to return incorrect and inconsistent values when compared with the same command running in the first kernel prior to the crash. With this update, the config file for busybox hwclock was reverted to its old behavior. It now assumes the adjtime state file is at /etc/adjtime, as was the case in FHS 2.1, and "busybox hwclock" behaves as expected when run in an initial or reloaded kernel. (BZ#621853)
  • The "busybox awk" utility incorrectly treated all strings of digits with leading zeros as octal integer constants. This meant strings such as "0xffff" and "07777" were handled correctly but strings such as "0.531" were not. As a consequence, awk operations that correctly manipulated such strings as numbers were not handled correctly by busybox awk. With this update, the awk utility included with busybox correctly differentiates between hexadecimal and floating decimal strings and handles manipulations of the latter as expected. (BZ#633961)
All busybox users should install this update, which fixes these bugs.

1.20. bzip2

1.20.1. RHSA-2010:0858: Important security update

Updated bzip2 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
bzip2 is a freely available, high-quality data compressor. It provides both standalone compression and decompression utilities, as well as a shared library for use with other programs.
An integer overflow flaw was discovered in the bzip2 decompression routine. This issue could, when decompressing malformed archives, cause bzip2, or an application linked against the libbz2 library, to crash or, potentially, execute arbitrary code. (CVE-2010-0405)
Users of bzip2 should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running applications using the libbz2 library must be restarted for the update to take effect.

1.21. certmonger

1.21.1. RHBA-2011:0570: bug fix and enhancement update

An enhanced certmonger package that fixes various bugs and provides several enhancements is now available for Red Hat Enterprise Linux 6.
The certmonger utility monitors certificate expiration and can refresh certificates with the CAs (Certifying Authorities) in networks that use public-key infrastructure (PKI).
Bug fixes:
BZ#624142
If the certmonger service failed to contact a CA, the subprocess that submitted the request became defunct. This occurred because the parent process did not read the subprocess status. With this update, the parent process reads the subprocess status and there is no defunct process after a CA contact failure.
BZ#636894
Previously, after installing the certmonger utility, the certmonger service failed to start. This occurred because the package installation did not signal the system bus daemon that it needed to re-read its configuration as to allow the certmonger daemon to connect to the bus. This update fixes the bug and the certmonger service can be started right after the installation.
BZ#643561
The certmonger package has been upgraded to upstream version 0.34, which provides a number of bug fixes and enhancements over the previous version.
BZ#652047
Previously, the certmonger utility did not display a user-friendly error message when the user ran the ipa-getcert command with privileges that were insufficient for the system bus to allow it to communicate with the certmonger service. With this update, certmonger suppresses the original error message if a user-friendly message is available. The user can display both messages with the -v option.
BZ#652049
Prior to this update, the ipa-getcert list command did not return any output if certmonger was not tracking any certificates. With this update, the command returns a message that the certificate list is empty.
BZ#687899
Due to inappropriate SELinux policy settings, the certmonger daemon could not execute some of its helper processes. The updated policy now allows certmonger to run these processes and the certmonger libraries create temporary files in a location that certmonger can access.
BZ#688229
The certmonger service accepted a non-existent PIN (Personal Identification Number) file for the NSS (Network Security Services) database if the user ran the ipa-getcert request command with the -p option. This occurred because certmonger failed to detect reading errors in the file with the PIN and proceeded with an empty PIN value. With this update, such reading errors are logged and certmonger proceeded as if it had read an empty PIN value.
BZ#689776
Previously, the certmonger service terminated unexpectedly if the user attempted to use a certificate database stored in a non-existent directory. While preparing an error message to return to its client, the daemon attempted to use already-freed memory, which could have caused a segmentation fault. With this update, certmonger displays a message that the directory does not exist and remains stable in these circumstances.
BZ#690886
After installation of the ipa-client package, the ipa-client-install script runs the ipa-getcert command. As a consequence, the certmonger daemon runs its ipa-submit helper. The helper contacts the IPA server. Previously, if it received a fault message response from the server, it terminated with a segmentation fault and created a core dump; the installation failed. This happened because it attempted to dereference an uninitialized pointer while processing the fault message. With this update, the helper handles the fault message correctly and the enrollment process completes successfully.
BZ#691351
Previously, running the getcert command with an invalid Extended Key Usage parameter caused a segmentation fault. This happened because the command attempted to dereference a NULL pointer while attempting to report that the parameter value was not a valid OID (Object Identifier). With this update, certmonger reports that the OID validation failed and prints a message that the provided Extended Key Usage is invalid.
BZ#695672
Prior to this update, certmonger could have seemingly ignored the attempts to resubmit a certificate with changed Subject and Principal names. This occurred because the certificate changes were not saved if a certificate with the same nickname already existed in the certificate database. With this update, the certmonger utility removes the certificates with the respective nickname before storing the new certificate and the resubmit command works as expected.
BZ#695675
Previously, the certmonger service could have failed to resubmit certificates. This happened if the SELinux policy did not allow certmonger to write to the defined location for storing keys. With this update, the service reads information about the keys to verify that the keys had been generated and stored properly. If the reading fails, the keys are generated again.
BZ#696185
Previously, the getcert tool terminated unexpectedly with a segmentation fault if the user issued the getcert start-tracking command with changed values of the parameters Extended Key Usage, DNS, Email and Principal name. The command caused a buffer overflow in the getcert tool because the internal buffer in the getcert command was too small to hold four new values. This update enlarges the internal buffer of the command and the bug no longer occurs.
Enhancements:
BZ#624143
The ipa-getcert and getcert commands did not accept the location of a passphrase, which could provide the encrypted keying material and allow monitoring of an already-issued certificate or key pair. This update adds the -p and -P options to the getcert start-tracking command, which allows the user to pass the utility a PIN either in a file or directly.
BZ#683926
Previously, the certmonger service did not support a verbose mode for the ipa-getcert command. This update adds the --verbose option to the command.
All users of certmonger are advised to upgrade to this updated package, which resolves these issues and provides these enhancements.

1.22. cifs-utils

1.22.1. RHBA-2011:0380: bug fix update

An updated cifs-utils package that fixes a bug is now available for Red Hat Enterprise Linux 6.
The Server Message Block (SMB), also known as Common Internet File System (CIFS), is a standard file-sharing protocol widely deployed on Windows machines. The tools included in this package work in conjunction with support in the kernel to allow users to mount a SMB/CIFS share onto a client, and use it as if it were a standard Linux file system.
This update fixes the following bug:
  • Due to an error in the cifs.upcall utility, Generic Security Services Application Program Interface (GSSAPI) channel bindings in Kerberos authentication messages were not set properly. This would cause some servers to reject authentication requests. Consequent to this, an attempt to mount a CIFS share with the security mode set to "krb5" could fail with the following error:
    mount error(5): Input/output error
    
    This update corrects the cifs.upcall utility to set the GSSAPI channel bindings properly, and such CIFS shares can now be mounted as expected. (BZ#668366)
All users of cifs-utils are advised to upgrade to this updated package, which resolves this issue.

1.22.2. RHBA-2011:0569: bug fix update

An updated cifs-utils package that fixes five bugs is available.
The SMB/CIFS protocol is a standard file sharing protocol widely deployed on Microsoft Windows machines. This package contains tools for mounting shares on Linux using the SMB/CIFS protocol. The tools in this package work in conjunction with support in the kernel to allow one to mount a SMB/CIFS share onto a client and use it as if it were a standard Linux file system.
The cifs-utils package has been updated to the latest upstream version. Bugs fixed in this updated package include:
  • While trying to mount a share (DFS or 'classic') with Kerberos, a "mount error(5): Input/output error" occurred due to a problem with the MIT krb5 libraries. cifs.upcall now sets the GSSAPI checksum properly in SPNEGO blobs. This is necessary for proper interoperability with EMC servers when using krb5 authentication, and allows for a successful mount . (BZ#645127)
  • When mounting a share as root with kerberos, cifs.upcall used the ticket of root (/tmp/krb5cc_0) instead the one of the user specified with 'uid=' or 'user='. This was due to the --legacy-uid command line option for cifs.upcall not being properly implemented. This patch ensures that this option can be properly implemented, allowing successful mounting of a share as root with kerberos. (BZ#667382)
  • When two CIFS shares were mounted on the same server, each for a different user who had valid krb5 credentials, only the one mounted first could access the data. This was because cifs had a built in design limitation of a single set of credentials per mount. That limitation caused the implementation of a number of hacks to deal with it. With this patch mount.cifs now supports the 'cruid=' mount option, fixing this issue. (BZ#669377)
  • mount.cifs did not handle numeric uid=, gid=, or cruid= options correctly, and would often return an error when they were specified. With this patch, a check is run to see if any error occurred by setting errno to 0 before the conversion. If an error occurs, the broken value is treated as a name, allowing it to be correctly handled. Additionaly, this path fixes a compiler warning about cruid being uninitialized. (BZ#696951)
  • In order to update the man pages and include a couple small patches, cifs-utils has been rebased to 4.8.1. (BZ#658981)
All users who are using the cifs file system should update to this new package in order to take advantage of these bug fixes.

1.23. cluster and gfs2-utils

1.23.1. RHBA-2010:0844: bug fix update

Updated cluster and gfs2-utils packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
The cluster packages contain the core clustering libraries for Red Hat High Availability as well as utilities to maintain GFS2 file systems for users of Red Hat Resilient Storage.
This update provides fixes for the following bugs:
  • The /proc/mounts file system is no longer updated with the wrong device. (BZ#634201)
  • A 'service cman stop remove' command no longer erroneously and permanently sets the 'remove' flag for a node for every subsequent stop/leave operation. (BZ#638954)
  • When two cluster nodes attempt to form a cluster with different configuration files, the one with the more recent version no longer gets killed. (BZ#639958)
  • The fsck.gfs2 utility no longer crashes if journals are missing. (BZ#637699)
All users of Red Hat High Availability and Red Hat Resilient Storage are advised to upgrade to these updated packages, which address these issues.

1.23.2. RHBA-2011:0361: bug fix update

Updated cluster and gfs2-utils packages that fix a bug are now available for Red Hat Enterprise Linux 6.
The cluster packages contain the core clustering libraries for Red Hat High Availability as well as utilities to maintain GFS2 file systems for users of Red Hat Resilient Storage.
This update provides fixes for the following bug:
  • Due to an incorrect conversion of directory inodes with the height larger than 1, running the gfs2_convert utility on a file system with extremely large directories may have caused the file system to become corrupted. With this update, the underlying source code has been modified to target this issue, and the gfs2_convert utility now works as expected. (BZ#643279)
All users of Red Hat High Availability and Red Hat Resilient Storage are advised to upgrade to these updated packages, which resolve this issue.

1.23.3. RHBA-2011:0537: bug fix update

Updated cluster and gfs2-utils packages that fix various defects are now available for Red Hat Enterprise Linux 6.
The cluster packages contain the core clustering libraries for Red Hat High Availability as well as utilities to maintain GFS2 file systems for users of Red Hat Resilient Storage.
This update provides fixes for the following defects:
  • CMAN init script race condition has been fixed (BZ#595725)
  • plock owner synchronization has been fixed (BZ#617306)
  • plocks are now ignored until they written to their checkpoint (BZ#623810)
  • plock signatures are now re-sent after a new totem ring forms (BZ#623816)
  • post_join_delay now works after a loss and subsequent regain of quorum (BZ#624844)
  • "service cman stop remove" now functions correctly (BZ#634718)
  • Active cluster nodes with higher configuration version numbers are no longer killed when they join the cluster (BZ#639018)
  • The ccs_tool man page no longer shows 'update' and 'upgrade' subcommands (BZ#577874)
  • ccs_tool cluster configuration editing has been dropped (BZ#614885)
  • The interaction between corosync and cman restarting independently of one another has been improved (BZ#617234)
  • reporting of corosync's exit code has been improved (BZ#617247)
  • cman_tool manual page no longer talks about "config version" as an argument to -r (BZ#619874)
  • Qdiskd now stops voting & exits if removed from the configuration (BZ#620679)
  • gfs_controld: fix plock owner in unmount (BZ#624822)
  • Qdiskd now reports to users when the quorumd "label" attribute overrides the "device" attribute (BZ#635413)
  • Qdiskd now has a hard limit on heuristic timeouts (BZ#636243)
  • Pacemaker-specific versions of dlm_controld and gfs_controld have been removed since they are no longer required (BZ#649021)
  • cman now allows users to select udpu (UDP unicast) corosync transport mechanism (BZ#657041)
  • Qdiskd now assumes votes for each cluster node are 1 when not specified in cluster.conf (BZ#663433)
  • The cman init script can no longer include an incorrect sysconf file (BZ#669340)
  • DLM recovery no longer hangs after fencing completion in some instances (BZ#678704)
  • The cluster.rng schema has been updated (BZ#645830, BZ#618705, BZ#684020, BZ#629017, BZ#680172)
  • A memory leak in the XML parser has been fixed (BZ#680155)
  • Heuristic checks are unreliable (BZ#688154)
  • cman quorum timeout is too short (BZ#688201)
  • The following issues have been addressed in the gfs2-utils package:
  • fsck.gfs2 was truncating directories with more than 100,000 entries (BZ#628013)
  • fsck.gfs2 was processing some files twice (BZ#621313)
  • fsck.gfs2 no longer crashes if journals are missing (BZ#622576)
  • When mounting a gfs2 file system, the same device requested on the command line now appears in /proc/mounts and /etc/mtab (BZ#632595)
  • gfs2_convert now resumes after an interrupted conversion (BZ#637913)
  • fsck.gfs2 can now repair rgrps resulting from gfs_grow->gfs2_convert (BZ#576640)
  • mkfs.gfs2 no longer segfaults with 18.55TB and -b512 (BZ#624535)
  • mkfs.gfs2 now supports discard request generation (BZ#656956)
  • fsck.gfs2: reports master/root inodes as unused and fixes the bitmap (BZ#663037)
  • gfs2_convert no longer corrupts the file system if the di_height is too large. (BZ#630005)
  • gfs2_convert no longer exits success without doing anything (BZ#688734)
In addition, this update provides the following enhancements:
  • gfs2_edit now outputs hexadecimal values in lower-case (BZ#634623)
  • gfs2_edit now prints continuation blocks (BZ#634623)
  • gfs2_edit's savemeta and restoremeta functions now report progress (BZ#634623)
  • gfs2_edit has improved handling of corrupt file systems and enhanced usability (BZ#674843)
  • It is now possible to prevent the cluster software from starting at boot using the kernel command line (BZ#563901)
  • The cluster now has a script which can be used with the watchdog daemon to reboot the host (BZ#560700)
  • Fenced now sends notifications over DBus (BZ#592964)
All users of Red Hat High Availability and Red Hat Resilient Storage are advised to upgrade to these updated packages, which resolve these issues.

1.24. compat-dapl

1.24.1. RHBA-2011:0343: bug fix update

Updated compat-dapl packages that fix a bug are now available.
The DAT programming API provides a means of utilizing high performance network technologies, such as InfiniBand and iWARP, without needing to write your program to use those technologies directly. This package contains the libraries that implement version 1.2 of the DAT API. The current (and recommended version for any new code) is 2.0. These 1.2 libraries are provided solely for backward compatibility.
This update fixes the following bug:
  • Under certain error conditions, an error in the code path in compat-dapl did not allow the cp_ptr entry to be cleaned up correctly in the internal link list. This could cause new connections to fail. This update includes a backported fix from uDAPL 2.0 which ensures the entry is cleaned up correctly and subsequent connections work as expected. (BZ#673992)
Users should upgrade to these updated packages, which resolve this issue.

1.24.2. RHBA-2011:0696: bug fix update

Updated compat-dapl packages that fix a bug are now available.
The DAT programming API provides a means of utilizing high performance network technologies, such as InfiniBand and iWARP, without needing to write your program to use those technologies directly. compat-dapl contains the libraries that implement version 1.2 of the DAT API. compat-dapl is provided solely for backward compatibility.
This update provides the following bug fix:
  • Fixes an issue in which, under certain error conditions, dapl could fail to properly clean up its internal state, potentially resulting in subsequent incorrect operation. (BZ#635155)
Users should upgrade to these updated packages, which resolve this issue.

1.25. coolkey

1.25.1. RHBA-2011:0765: bug fix update

An updated coolkey package that fixes a bug is now available.
The coolkey package contains driver support for CoolKey and Common Access Card (CAC) smart card products.
This updated coolkey package fixes the following bug:
  • Previous versions of coolkey would fail to operate correctly if the pcscd daemon in the pcsc-lite package was restarted. Proper operation could be restored by restarting the application which was using coolkey, for example, the Gnome screensaver or the Gnome login screen when used with a smart card login. With this update, applications no longer need to be restarted to function properly when the pcscd daemon is restarted. (BZ#210200)
All users of coolkey are advised to upgrade to this updated package, which resolves this issue.

1.26. coreutils

1.26.1. RHBA-2011:0646: bug fix update

Updated coreutils packages that fix several bugs are now available.
The coreutils package contains the core GNU utilities. It is the combination of the old GNU fileutils, sh-utils, and textutils packages.
These updated packages fix the following bugs:
  • The su utility was previously not built with PIE and RELRO enabled, as they were in Red Hat Enterprise Linux 5. In this update, it is built as a PIE executable and is using RELRO protection. (BZ#630017)
  • Previously, when reading a line longer than 16KiB, the tac utility reallocated its primary buffer. Before exiting, the tac utility tried to free the already freed original buffer, which caused a utility crash after a double free error displayed. This was fixed and the tac utility no longer frees an already freed buffer. (BZ#628212)
  • Previously, the hardware control flow, DTRDSR, was implemented via TC{SG}ETX. This was changed to TC{SG}ET ioctl, which caused the CDTRDSR support in stty to fail. This was fixed to allow stty to correctly handle CDTRDSR control flow. (BZ#598631)
  • Previously, the internalization patch for coreutils had an unsafe initialization of charbufops that left bufops uninitialized or initialized to NULL on the first usage. This behavior called memmove from an incorrect address, namely from address 0 and size 0. This is now fixed and bufops is correctly initialized for the first use. (BZ#683799)
  • Previously, when the multibyte LC_TIME differed from LC_CTYPE, an assertion failure caused the sort utility to crash irrespective of the parameters provided to it. This is fixed to prevent a crash when the sort utility is run and now works as expected. (BZ#649224)
  • Previously, the coreutils information page regarding 8-bit octal values did not mention checking if the value was lower than 256. Due to this, when a command like "/bin/echo -e '\0610'" was used, the results were not accurate. This affected the echo, stat and printf utilities. This is now fixed to provide more accurate information about the behavior of octal values. (BZ#660033)
  • Previously, when the dd utility used pipes, it read and wrote partial blocks. When the size of the block written was shorter than the specified maximum output block size, the "oflag=direct" would turn off, which resulted in degraded I/O performance. The workaround for this behavior, which involves the addition of "iflag=fullblock" is now available in the information documentation. (BZ#614605)
  • Previously, the coreutils information page was not sufficiently clear about behavior when multiple parent and leaf node directories are created. This is now fixed to incorporate additional information in the coreutils information page about the @option mode and its behavior when combined with the --parents option. (BZ609262)
  • Previously, documentation for tail command's --sleep-interval option did not outline the results of inotify support. This is now fixed and the documentation states that with inotify support, the --sleep-interval option is only relevant when the tail command reverts to the old polling-based method. (BZ#662900)
All coreutils users are advised to upgrade to these updated packages, which resolve these issues.

1.27. corosync

1.27.1. RHBA-2011:0360: bug fix update

Updated corosync packages that fix a bug are now available for Red Hat Enterprise Linux 6.
The corosync packages provide the Corosync Cluster Engine and C Application Programming Interfaces (APIs) for Red Hat Enterprise Linux cluster software.
This update fixes the following bug:
  • Compared to a unicast token, certain network switches add an extra delay to the transmission of a multicast packet. Consequent to this, multicast messages may have been retransmitted, even though the message was not lost and the retransmission was therefore not necessary. This update introduces the "miss_count_const" constant that allows a user to specify the maximum number of times a message is checked for retransmission before the retransmission is performed. (BZ#683592)
All users of corosync are advised to upgrade to these updated packages, which resolve this issue.

1.27.2. RHBA-2011:0764: bug fix update

Updated corosync packages that add features and fix bugs are now available for Red Hat Enterprise Linux 6.
The corosync packages provide the Corosync Cluster Engine and C Application Programming Interfaces (APIs) for Red Hat Enterprise Linux cluster software.
This update fixes the following bugs:
  • Multicast emulation caused an extra delay to the multicast packet transmission, causing unnecessary retransmission of the packet. This update adds the "miss_count_const" constant allowing the user to specify how many times a message is checked before retransmission occurs. (BZ#619496)
  • When denied permissions from SELinux, corosync failed with a segmentation fault. Corosync now passes an error back to the API user when it is unable to create a connection between the server and client instead of causing a segmentation fault. (BZ#619918)
  • When provided an invalid multicast address, corosync failed without errors. This is now fixed, thus corosync displays an error when given an invalid multicast address. (BZ#613836)
  • Corosync client libraries delayed for 2 seconds before they displayed an error on a shut down. This is now fixed, thus the exited flag value before and after sem_wait is checked. If the value is true, ERR_LIBRARY displays. (BZ#639023)
  • The default TTL value in multicast was 1, preventing use on a routed network. The TTL value is now configurable in the corosync configuration file, thus multicast can now be used on a routed network. (BZ#640311)
  • BZ#640311 introduced a regression. (BZ#684920) (BZ#684930)
  • Shared memory no longer is leaked if the corosync server unexpectedly exits while connected to corosync clients. (BZ#665165)
  • Running multiple instances of corosync simultaneously would succeed, causing local node errors. This is now fixed to prevent initialization of multiple instances of corosync. (BZ#626962)
  • If cman ran the corosync init script, it would cause the corosync init script to be blocked. This is now fixed to allow corosync to create a Pid file and to allow cman to run corosync. (BZ#614104)
  • Corosync was unable to capture system events and notify the user about them. With this fix, SNMP MIB and daemon are added for system event notification via DBUS and SNMP. (BZ#629380)
  • Member objects in corosync were not found due to validation failure. This is fixed with an addition to the objdb file, thus validation for SNMP/DBUS integration is now successful. (BZ#675859)
  • The corosync build contained invalid version information, which caused rpmdiff to warn the user about version information changes. This was fixed, thus pkgconfig files are now correctly configured to display version as 1.2.3. (BZ#675741)
  • Corosync rebuilds succeeded only on fresh installations due to a regression issue. This is now fixed, thus corosync now rebuilds on existing installations as well. (BZ#680258)
  • A ring id file smaller than 8 bytes caused corosync to abort. This was fixed by recreating the ring id file, thus corosync now does not abort due to the ring id file. (BZ#675099)
  • Inconsistent cluster.conf files amongst nodes caused a memory leak. This is now fixed, thus a configuration reload via cman_tool no longer causes a memory leak. (BZ#677975)
  • During the recovery phase, aisexec exited unexpectedly, resulting in a lost network token. This is now fixed, thus aisexec no longer exits due to a lost token. (BZ#675783)
  • UDPU transport is added, which simulates multicast via UDP unicast. This adds a third transport option to broadcast and multicast in a cluster. (BZ#568164)
  • Fix abort that happens in rare circumstances during shutdown. (BZ#688691)
All users of corosync are advised to upgrade to these updated packages, which resolve this issue.

1.28. cracklib

1.28.1. RHBA-2011:0202: bug fix update

Updated cracklib packages that fix two bugs are now available for Red Hat Enterprise Linux 6.
CrackLib is a password-checking library that is used to help enforce password quality controls.
This update fixes the following bugs:
  • Manual pages for the cracklib-check, cracklib-format, and create-cracklib-dict utilities have been added. (BZ#583932)
  • The Simplified Chinese (zh_CN) translation of one of the error messages the library can produce has been corrected, and no longer contains untranslated strings. (BZ#627449)
All users of cracklib are advised to upgrade to these updated packages, which resolve these issues.

1.29. crash

1.29.1. RHBA-2011:0561: bug fix and enhancement update

An updated crash package that fixes various bugs and adds two enhancements is now available for Red Hat Enterprise Linux 6.
The crash package provides a self-contained tool that can be used to investigate live systems, and kernel core dumps created from the netdump, diskdump, kdump, and Xen/KVM "virsh dump" facilities from Red Hat Enterprise Linux.
This update fixes the following bugs:
  • The crash package has been upgraded to upstream version 5.1.1, which provides a number of bug fixes over the previous version. (BZ#649070)
  • On 64-bit x86 architectures, using the "bt" command to analyze core dumps from kernel 2.6.27 or later caused it to display an invalid "vgettimeofday" frame above the topmost "system_call_fastpath" frame, followed by two read error messages similar to the following:
    bt: read error: kernel virtual address: ffffffffff600000  type:
    "gdb_readmem_callback"
    
    This error no longer occurs, and the "bt" command now produces correct results for these kernels. (BZ#637735)
  • When analyzing a KVM dump file from a 64-bit x86 guest system, the crash utility failed to determine the starting RIP and RSP hooks. This rendered it unable to produce a correct backtrace for tasks that were either running in user space when the "virsh dump" operation was performed on a live guest, or that were running on interrupt or exception stacks. With this update, the RIP and RSP hooks for a particular dump file are now determined by using the content of the per-CPU registers in the CPU device format. As a result, the "bt" command no longer produces incorrect backtraces for such dump files. (BZ#649050)
  • When analyzing a KVM dump file from an x86 guest system, the crash utility was unable to determine the starting EIP and ESP hooks, and produced an invalid backtrace. With this update, the crash utility has been updated to use the 64-bit CPU device format in x86 KVM dump files by default, and only use the 32-bit format when it is determined that the host machine was running a 32-bit kernel. As a result, running the "bt" command when analyzing such a dump file now produces a correct backtrace. (BZ#649051)
  • When creating a KVM dump file, the "virsh dump" operation marks all non-crashing CPUs as offline. Due to an incorrect use of the "cpu_online_map" mask to determine the CPU count, previous version of the crash utility may have reported a wrong number of CPUs when analyzing dumps created by the "virsh dump" command on x86 guest systems. With this update, the underlying source code has been adapted to use the "cpu_present_map" mask instead, so that the crash utility reports the correct number of CPUs. (BZ#649053)
  • Prior to this update, an attempt to display a backtrace of a non-active swapper task on a 32-bit x86 architecture could cause the crash utility to display the following message:
    bt: cannot resolve stack trace:
    #0 [c09f1ef4] ia32_sysenter_target at c08208ce
    
    This update applies a patch that resolves this issue, and the crash utility now resolves such backtraces as expected. Additionally, this update ensures that the crash utility is no longer negatively affected by the changes that were introduced in kernel 2.6.32-112. (BZ#682129)
As well, this update adds the following enhancements:
  • The crash utility has been updated to provide support for dump files created on the IBM System z architecture. (BZ#633449)
  • The crash utility now supports compressed and/or filtered dump files generated by the makedumpfile utility on IBM System z. (BZ#637197)
All users of crash are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.

1.30. crda

1.30.1. RHEA-2011:0550: enhancement update

An updated crda package that adds one enhancement is now available for Red Hat Enterprise Linux 6.
The crda package contains the Central Regulatory Domain Agent, which provides the kernel with the wireless regulatory rules for a given jurisdiction.
This updated crda package enhances the kernel with the most current information with regard to wireless regulatory rules, and ensures that these updated rules are enforced. (BZ#654066)
All users are advised to upgrade to this updated package, which adds this enhancement.

1.31. cronie

1.31.1. RHBA-2011:0788: bug fix update

Updated cronie packages that fix various bugs are now available.
Cronie contains the standard UNIX daemon crond that runs specified programs at scheduled times and related tools. It is a fork of the original vixie-cron and has security and configuration enhancements like the ability to use pam and SELinux.
This update fixes the following bugs:
  • The initscript output written to /var/log/boot.log contained a double output of "OK", printed by /etc/init.d/crond and daemon. This error has been corrected: the echo from /etc/init.d/crond is removed, thus the output is now as expected. (BZ#615107)
  • Cronie didn't close file descriptor, which caused other applications such as anacron that are subsequently started by cronie to inherit the file descriptor. This caused SELinux to prevent /bin/bash access. With this update, the file descriptor is no longer inherited by other applications, thus SELinux no longer prevents /bin/bash access. (BZ#624043)
  • An incorrect option in the bash script caused anacron to run daily instead of hourly if the /var/spool/anacron/cron.daily file existed. The error has been corrected: the bash script option is fixed and anacron now runs once a day if the /var/spool/anacron/cron.daily file exists. (BZ#675077)
  • RELRO flags were previously not set by default from crond. This is now fixed so that cronie is compiled with RELRO protection enabled. (BZ#676040)
  • The /usr/bin/crontab was set to use both setuid and setgid permissions, but this was changed to use only setuid. (BZ#676081)
  • Multiple code quality improvements were made, which include:
    • In src/crontab.c, mkstemp expects six X's to be replaced with digits at the end of each filename. This fix removes the extra X's.
    • In src/security.c, ccon was not freed after a return. This is fixed and ccon is now freed using context_free.
    • In anacron/run_job.c, fdin was tested before being initialized. This is fixed to ensure that fdin is now initialized prior to testing.
All users of cronie are advised to upgrade to this updated package, which resolves these issues.

1.32. cryptsetup-luks

1.32.1. RHBA-2011:0597: bug fix and enhancement update

Updated cryptsetup-luks packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The cryptsetup-luks packages provide the utility allowing users to set up encrypted devices with the Device Mapper and the dm-crypt target.
The cryptsetup-luks package has been upgraded to upstream version 1.2.0, which provides a number of bug fixes and enhancements over the previous version. (BZ#658817)
In addition, these updated cryptsetup-luks packages provide fixes for the following bugs:
  • Previously, cryptsetup printed twice the error message notifying the user that the queried device did not exist. With this update, the underlying code was changed and the error message is displayed once. (BZ#612963)
  • Prior to this update, when the user attempted to encrypt a device with the MD4 or MD5 hash algorithm, cryptsetup did not alert the user that the encryption with those algorithms was not supported, had failed, and that therefore the device could not be used. With this update, cryptsetup terminates the process and prints a message advising the user to check if the required encryption method is supported. (BZ#623121)
  • Previously, cryptsetup did not remove keys as soon as possible from device control buffers and therefore did not follow FIPS (Federal Information Processing Standard). With this update, the underlying code has been changed and the keys are removed from the buffers as soon as possible. (BZ#674825)
  • Previously, if the user issued the "cryptsetup luksRemoveKey" command with the "--key-file" parameter, the command removed the key defined in the standard input. With this update, such command removes the key defined in the "--key-file" parameter. (BZ#677634)
  • Prior to this update, when updating with the "yum update" command, the device-mapper-libs package was not updated. This occurred because the previous version of the cryptsetup package was compatible with any version of the package. This update adds the dependency to the cryptsetup package and the device-mapper-libs is updated to provide the compatible device-mapper-libs package. (BZ#692512)
  • Previously, when running in FIPS mode, the salt for PBKDF2 (Password-Based Key Derivation Function) was generated with the /dev/urandom device. According to NIST Special Publication 800-132, all or a portion of the salt must be generated with an approved random number generator. With this update, the salt is generated with the FIPS RNG (Random Number Generator) and the criterion is met. (BZ#693371)
These updated packages provide also the following enhancements:
  • With this update, cryptsetup uses a FIPS certified random number generator for generation of volume keys when running in FIPS mode. (BZ#663869)
  • This update adds the integrity check of the cryptsetup binary and library for FIPS mode. (BZ#663870)
Users are advised to upgrade to these updated cryptsetup-luks packages, which resolve these bugs and add these enhancements.

1.33. cups

1.33.1. RHSA-2010:0866: Important security update

Updated cups packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems.
An invalid free flaw was found in the way the CUPS server parsed Internet Printing Protocol (IPP) packets. A malicious user able to send IPP requests to the CUPS server could use this flaw to crash the CUPS server. (CVE-2010-2941)
Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting this issue.
Users of cups are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the cupsd daemon will be restarted automatically.

1.33.2. RHBA-2011:0715: bug fix update

Updated cups packages resolving several issues are now available for Red Hat Enterprise Linux 6.
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.
These updated cups packages provide fixes for the following bugs:
  • Some printers were incorrectly reporting ink and toner levels via SNMP backend. Support for an SNMP quirk has been added and enabled via the PPD file. (BZ#580604)
  • Previously, lpstat -p always reported job id as '-0'. This was because the jobstate was never IPP_JOB_PROCESSING due to an SVN revision upstream. This patch fixes this issue by adding the attributes needed for jobs. (BZ#614908)
  • The previous 8MB default RIP cache size was insufficient for modern high-resolution (color/photo) printing. This was because filters such as pstoraster could fail. This update increases the default RIP cache size to 128MB to fix this issue. (BZ#616864)
  • If the cupsd daemon was stopped while a job was being sent to a printer using a given backend, that backend was restarted multiple times before the CUPS scheduler actually terminated. In this updated package, the CUPS scheduler tracks whether it is shutting down and does not automatically start new jobs if so. (BZ#624441)
  • The 'restartlog' action was missing in Initscript usage output, preventing its usage. This update adds it. (BZ#632180)
  • Several rpmlint errors and warnings were fixed:
    • fixing the character encoding in CREDITS.txt
    • marking the D-Bus configuration file as config file
    • not marking MIME types and convs files as config files (overrides can be placed as new *.types/*.convs files in /etc/cups)
    • not marking banners as config files, instead new banners are provided
    • not marking initscript as a config file
    • not marking templates and www files as config files, instead a different ServerRoot setting is used to provide local overrides. Please note that a recent security fix required a change to template files
    • providing a versioned LPRng symbol for rpmlint
    • using mode 0755 for binaries and libraries where appropriate
    • moving /etc/cups/pstoraster.convs to /usr/share/cups/mime/
    • moving the cups-config man page to the devel sub-package
  • Red Hat Enterprise Linux 4 CUPS clients use the character set specified in LANG as the charset attribute in CUPS IPP requests, where Red Hat Enterprise Linux 5 and 6 ignore this, leading to incompatibilities. In these updated packages the CUPS server has been adjusted so that non-UTF-8 clients (e.g. Red Hat Enterprise Linux 4 clients) continue to be accepted. (BZ#642448)
  • The subpackage cups-php consumed library libcups.so2 from subpackage cups-libs even though it did not have an explicit package version requirement. In this update cups-php subpackage now explicitly requires cups-libs of the same version and release. (BZ#646814)
  • The ipp, socket and lpd backends were treating name resolution failures as a permanent error. Because these types of failures can be temporary, the tolerance for DNS failures has been added. (BZ#654667)
  • Previously, the CUPS service did not stop normally if it was running when halting the system or a reboot was performed. Instead, it had to be killed in the final stage of reboot or shut down. This update fixes Initscript so the service is correctly stopped on reboot or halt. (BZ#659692)
  • When the cupsd daemon was running with SELinux features enabled, the file descriptor count was increasing over time until its resources ran out. With this update, the resources are allocated only once so they do not leak file descriptors. (BZ#668010)
  • There was a small typo in sample snmp.conf file. It is fixed in this update. (BZ#672614)
All users of cups are advised to upgrade to these updated packages, which resolve these issues.

1.34. curl

1.34.1. RHBA-2011:0573: bug fix update

Updated curl packages that fix bugs in HTTPS, FTP, LDAP and proxy kerberos authentication are now available.
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, FTP upload, HTTP post, and file transfer resume.
This update fixes the following bugs:
  • libcurl introduced a segfault where a RHEL 6.1 machine registered at RHN would result in a segmentation fault (core dumped) after running "yum clean all" and "yum update" respectively. "CERT_GetDefaultCertDB" is now used to prevent a segmentation fault after the "yum clean all" and "yum update" sequence. (BZ#690273)
  • libcurl HTTPS connections failed with a CURLE_OUT_OF_MEMORY error when given a certificate file name without a "/". This is now fixed to treat such a string as certificate nickname and if a file with the same name exists and libcurl runs in verbose mode, a warning is issued. The updated documentation now suggests to use the "./" prefix to load a file from the current directory. (BZ#623663)
  • A rebuild operation for curl failed if the libnih-devel package was installed. This is now fixed to allow a rebuild whether libnih-devel is installed, not installed or has a broken installation. (BZ#669048)
  • libcurl ignored the CA path provided in CURLOPT_CAPATH and consequently curl ignored the "--capath" argument provided. This is fixed so that libcurl now uses the value provided with the the "--capath" argument. (BZ#669702)
  • libcurl leaked memory and eventually resulted in a failed NSS shutdown when more than one CA certificate was loaded. This is now fixed so that libcurl works as expected when more than one CA certificates is loaded. (BZ#670802)
  • libcurl leaked memory when an SSL connection failed. This is now fixed to prevent the memory leak during an SSL connection failure. (BZ#678594)
  • libcurl's FTP protocol implementation was unable to handle server session timeouts correctly. This is now fixed so that libcurl drops the connection when a 421 timeout response is received. (BZ#651592)
  • libcurl failed when an LDAP request was sent using curl through a HTTP proxy in tunnel mode (curl option "-p" or "--proxytunnel"). Curl tried to connect directly to the LDAP server via the proxy port and consequently failed. This is now fixed to allow libcurl LDAP connections through HTTP proxies to work as expected. (BZ#655134)
  • libcurl was unable to authenticate http proxies via Kerberos. This is now fixed and libcurl can successfully authenticate http proxies via Kerberos. (BZ#625685)
  • When libcurl connected a second time to an SSL server with the same server certificate, the server's certificate was not re-authenticated because libcurl confirmed authenticity before the first connection to the server. This is fixed by disabling the SSL cache when it is not verifying a certificate to force the verification of the certificate on the second use. (BZ#678580)
  • Kerberos authentication was broken for reused curl handles, which prevented "git clone"' from working with Kerberos authenticated web servers. This is now fixed to allow "git clone" operations to successfully authenticate and carry out operations. (BZ#684892)
  • It was not possible to use two distinct client certificates to connect two times in a row to the same SSL server. This is now fixed to allow two different client certifications to connect to the same SSL server. (BZ#694294)
Users of curl should upgrade to these updated packages, which contain back-ported patches to correct these issues. All running applications using libcurl must be restarted for the update to take effect.

1.35. cvs

1.35.1. RHSA-2010:0918: Moderate security update

An updated cvs package that fixes one security issue is now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Concurrent Version System (CVS) is a version control system that can record the history of your files.
An array index error, leading to a heap-based buffer overflow, was found in the way CVS applied certain delta fragment changes from input files in the RCS (Revision Control System file) format. If an attacker in control of a CVS repository stored a specially-crafted RCS file in that repository, and then tricked a remote victim into checking out (updating their CVS repository tree) a revision containing that file, it could lead to arbitrary code execution with the privileges of the CVS server process on the system hosting the CVS repository. (CVE-2010-3846)
Red Hat would like to thank Ralph Loader for reporting this issue.
All users of cvs are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

1.36. dapl

1.36.1. RHBA-2011:0354: bug fix and enhancement update

Updated dapl packages that fix several bugs and add provider entries to the dat.conf are now available.
dapl provides a userspace implementation of the DAT 2.0 API and is built to natively support InfiniBand and iWARP network technology.
This update addresses the following bugs:
  • Under certain error conditions dapl did not allow the cp_ptr entry to be cleaned up correctly in the internal link list. This could cause new connections to fail. With this update, the entry is cleaned up correctly and subsequent connections work as expected. (BZ#673989)
  • Under certain error conditions dapl could fail to free allocated memory. The consequent memory leak could, potentially, result in an out of memory condition for the application. This update frees allocated memory correctly, closing the leak. (BZ#673993)
  • Under certain circumstances, when a thread was waiting on dapls_evd_dto_wait() and the thread received a signal, the function would return an incorrect error code, resulting in the application failing rather than retrying the request. (BZ#675198)
  • On systems with multiple InfiniBand (IB) adapters, especially if some were configured and some not, the dat_ia_open() function could hang when the driver queried the IB devices listed in /etc/dat.conf. This primarily presented as IBM DB2 installations hanging before they completed. With this update, the dat_ia_open() hang has been fixed and IBM DB2 installations, in particular, now succeed as expected. (BZ#675205)
This update also adds the following enhancement:
  • New provider entries for Mellanox RDMA over Converged Ethernet (RoCE) devices were added to the dat.conf file. (BZ#675202)
Users should upgrade to these updated packages, which fix these issues.

1.36.2. RHBA-2011:0695: bug fix update

Updated dapl packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
The dapl package provides a user space implementation of the DAT 2.0 API, and is built to natively support InfiniBand/iWARP network technology.
This update fixes the following bugs:
  • Under certain circumstances, when a thread was waiting on dapls_evd_dto_wait() and the thread received a signal, the function would return an incorrect error code, resulting in the application failing rather than retrying the request. (BZ#626541)
  • Previously, the function dapls_evd_dto_wait() returned, under certain circumstances, an error code when a thread was waiting on the function and the thread received a signal. Due to this behavior, the application failed. With this update, the application retries the request. (BZ#626541)
  • Red Hat Enterprise Linux 6 already supports a feature called "RoCE" (RDMA over converged Ethernet). Previously, applications that utilize uDAPL could not use the RDMA over converged Ethernet (RoCE) feature. This update adds these additional entries to the dat.conf file. (BZ#636596)
  • The dat_ia_open() function could, under under certain circumstances, fail to return. With this update, the function returns as expected. (BZ#649360)
  • Under certain circumstances dapl could fail to clean up its internal state, resulting in subsequent usage of the library to fail. With this update, the internal state is cleaned up as expected and the library can be used without further problems. (BZ#667742)
  • Previously, dapl could, under certain circumstances, fail to free allocated memory, potentially causing the application to run out of memory and fail. Now, dapl frees all allocated memory. (BZ#637980)
All dapl users should upgrade to these updated packages, which fix these bugs.

1.37. dbus

1.37.1. RHSA-2011:0376: Moderate security update

Updated dbus packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.
A denial of service flaw was discovered in the system for sending messages between applications. A local user could send a message with an excessive number of nested variants to the system-wide message bus, causing the message bus (and, consequently, any process using libdbus to receive messages) to abort. (CVE-2010-4352)
All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using the libdbus library must be restarted, or the system rebooted.

1.38. device-mapper-multipath

1.38.1. RHBA-2011:0173: bug fix update

Updated device-mapper-multipath packages that resolve an issue are now available for Red Hat Enterprise Linux 6.
The device-mapper-multipath packages provide tools to manage multipath devices by giving the "dm-multipath" kernel module instructions on what to do, as well as by managing the creation and removal of partitions for Device-Mapper devices.
These updated device-mapper-multipath packages fix the following bug:
  • When all paths of a pathgroup with set group_by_prio were restored after a failure, multipathd could place some paths into a wrong pathgroup. This issue occurred, because the daemon checked if pathgroups needed reconfiguration only if a path priority changed. When the original paths were restored, they could have been assigned the same priority as before the failure. In such case the paths were incorrectly left in a wrong pathgroup. With this update, when checking if it needs to recalculate the pathgroups, the multipathd daemon refreshes and checks all priorities once a new path becomes available and places recovered paths into the correct pathgroup. (BZ#658937)
All users of device-mapper-multipath are advised to upgrade to these updated packages, which resolve this issue.

1.38.2. RHBA-2011:0294: bug fix update

Updated device-mapper-multipath packages that resolve an issue are now available for Red Hat Enterprise Linux 6.
The device-mapper-multipath packages provide tools to manage multipath devices by giving the "dm-multipath" kernel module instructions on what to do, as well as by managing the creation and removal of partitions for Device-Mapper devices.
These updated device-mapper-multipath packages fix the following bug:
  • Multipathd caches the value of sysfs attribute lookups for the path devices that make up a multipath device. Previously, these weren't being removed when the path devices were removed. As well, in some cases the cache was not helpful and not used. This occasionally caused memory leaks when path devices were removed and restored. With this update, the unnecessary caching has been completely removed and the cached values are now removed when the corresponding path device is removed. Consequently, the occasional memory leaks no longer occur. (BZ#672151)
All device-mapper-multipath users are advised to upgrade to these updated packages, which resolve this issue.

1.38.3. RHBA-2011:0384: bug fix update

Updated device-mapper-multipath packages that resolve an issue are now available for Red Hat Enterprise Linux 6.
The device-mapper-multipath packages provide tools to manage multipath devices by giving the "dm-multipath" kernel module instructions on what to do, as well as by managing the creation and removal of partitions for Device-Mapper devices.
These updated device-mapper-multipath packages fix the following bug:
  • Prior to this update, multipathd did not always remove a path's sysfs device from cache when the path was removed. Also, multipathd searched the cache and created sysfs devices without the 'vecs' lock held. As a result, paths would occasionally have invalid sysfs devices, causing multipathd crashes and other errors. With this update, multipathd always removes the sysfs device from cache when deleting the path, and it only accesses the cache with the 'vecs' lock held. (BZ#684684)
All users of device-mapper-multipath are advised to upgrade to these updated packages, which resolve this issue.

1.38.4. RHBA-2011:0725: bug fix and enhancement update

Updated device-mapper-multipath packages that fix several bugs and add various enhancements are now available for Red Hat Linux 6.
The device-mapper-multipath packages provide tools for multipath device management with the device-mapper multipath kernel module.
Bug fixes:
BZ#611779
If you sent the multipathd daemon a command consisting only of spaces, the daemon terminated unexpectedly with a segmentation fault. With this update, the daemon is able to handle such commands and no longer crashes in this circumstance.
BZ#635088
Prior to this update, the daemon occasionally grouped paths incorrectly because the multipathd daemon did not recalculate path groups when restoring paths. Now, when a new path goes online, the multipathd daemon verifies whether it needs to recalculate path groups, and refreshes and reads all priorities.
BZ#636071
Previously, if the user edited configuration information with the mpathconf command, the process could have failed. This happened when the user ran the command without any additional arguments due to a conflict of the environment variable DISPLAY with the program variable DISPLAY. With this update, all variables are unset when the script is started and the DISPLAY program variable is renamed. The environment variable DISPLAY remains unchanged when the mpathconf is issued and the command works as expected.
BZ#645605
The DM-Multipath application marked paths as failed if it was unable to determine if a path was offline. With this update, multipath calls the path_checker function to determine the path state in such cases and the problem no longer occurs.
BZ#650797
Previously, multipathd displayed no tgt_node_name value for iSCI devices. This occurred because multipath used the FC (Fibre Channel) path from the sysfs file system to obtain tgt_node_name for iSCI devices. With this update, multipath first tries to acquire the FC path. If it fails, it uses the iSCI target name for the device.
BZ#651389
Previously, if you set dev_loss_tmo to a value greater than 600 in multipath.conf without setting the fast_io_fail_tmo value, the multipathd daemon failed to apply the setting. With this update, the multipathd daemon sets dev_loss_tmo for values over 600 correctly, as long as fast_io_fail_tmo is also set in the /etc/multipath.conf file.
BZ#662731
DM-Multipath could have terminated unexpectedly if the multipath.conf file contained parameters with no value. This occurred because it was trying to acquire the string length of an optional value before verifying that a value was actually defined. With this update, multipathd first checks if the value exists and the bug is fixed.
BZ#622569
On a non-disruptive upgrade (NDU), all paths to EMC Symmetrix arrays could have failed, which caused multipathd to fail all outstanding input/output. DM-Multipath now has a new default configuration for EMC Symmetrix arrays that queues input/output for up to 30 seconds if all paths are down and the problem no longer occurs.
BZ#623644
The multipathd daemon consumed excessive memory when iSCI devices were unloaded and reloaded. This occurred because the daemon was caching unnecessary sysfs data, which caused memory leaks. With this update, multipathd no longer caches these data; it frees the data when the associated device is removed.
BZ#680480
During a double path failure, the sysfs device file is removed and the sysdev path attribute is set to NULL. The sysfs device cache is indexed by the actual sysfs directory, and /sys/block/pathname is a symlink. Prior to this update, if the path was deleted, multipathd was not able to find the actual directory, which /sys/block/pathname pointed to, and searched the cache. With this update, multipathd verifies that sysdev has NULL value before updating it.
BZ#681144
When a path was removed, the multipathd daemon did not always remove the path sysfs device from its cache. The daemon kept searching the cache for the device and created sysfs devices without the vecs lock held. Because of this, paths could have pointed to invalid sysfs devices and caused multipathd to crash. The multipathd daemon now always removes the sysfs device from cache when deleting a path and accesses the cache only with the vecs lock held.
Enhancements:
BZ#576919
The log_checker_err option was added to the multipath.conf defaults section. By default, the option is set to always and a path checker error is logged continuously. If set to once, multipathd logs a path checker error once at logging level 2. Any later errors are logged at level 3 until the device is restored.
BZ#599690
Previously, the defaults section of the multipath.conf man page implied that the settings defined in the section became default and overrode the implied settings. Since the HWTABLE cannot be overridden, the wording of the man page has been changed.
BZ#628095
Previously, DM-Multipath did not print any messages when errors were detected in the multipath.conf file. With this update, multipath prints warning messages that inform the user that the configuration files contains invalid or duplicate options and the bug is fixed.
BZ#632734
This update adds the default configuration for Virtual SCSI disks.
BZ#633643
This update adds the default configuration for NEC Storage M.
BZ#636213
This update adds the default configuration for HP P2000.
BZ#636246
This update adds the default configuration for HP OPEN devices.
BZ#644111
If the initramfs file system was not rebuilt when a new storage device was added to the system, the new device could have been assigned a user_friendly_names value that matched the user_friendly_names value already-assigned to another device. This device then stopped working correctly. The multipathd daemon now accepts a -B option, which makes the user_friendly_names bindings file read-only. When initramfs calls multipath with the -B option, devices without a binding to a user_friendly_names use their World Wide Identifier (WWID).
BZ#650664
Previously, the DM-Multipath did not prompt the user to increase the maximum number of open file descriptors (max_fds) if it failed to open a file descriptor due to receiving an EMFILE error. With this update, it prints out a message advising the user to do so.
BZ#602883
Previously, the multipathd deamon printed add map messages whenever it received a change uevent. In order not to clutter logs, multipathd now only prints add map messages for the change uevents of the devices that are not yet monitored.
BZ#639037
Previously, DM-Multipath did not set a default value for the no_path_retry parameter for Hitachi R700 devices. With this update, the parameter value for the devices is set to 6 by default.
BZ#696157
The multipathd daemon could have terminated unexpectedly with a segmentation fault on a multipath device with the path_grouping_policy option set to the group_by_prio value. This occurred when a device path came online after another device path failed because the multipath daemon did not manage to remove the restored path correctly. With this update multipath removes and restores such paths correctly.
Users are advised to upgrade to these updated device-mapper-multipath packages, which resolve these issues and add these enhancements.

1.39. dhcp

1.39.1. RHSA-2011:0428: Important security update

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.
It was discovered that the DHCP client daemon, dhclient, did not sufficiently sanitize certain options provided in DHCP server replies, such as the client hostname. A malicious DHCP server could send such an option with a specially-crafted value to a DHCP client. If this option's value was saved on the client system, and then later insecurely evaluated by a process that assumes the option is trusted, it could lead to arbitrary code execution with the privileges of that process. (CVE-2011-0997)
Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting this issue.
All dhclient users should upgrade to these updated packages, which contain a backported patch to correct this issue.

1.39.2. RHSA-2010:0923: Moderate security update

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol version for IPv6 networks.
A NULL pointer dereference flaw was discovered in the way the dhcpd daemon parsed DHCPv6 packets. A remote attacker could use this flaw to crash dhcpd via a specially-crafted DHCPv6 packet, if dhcpd was running as a DHCPv6 server. (CVE-2010-3611)
Users running dhcpd as a DHCPv6 server should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, all DHCP servers will be restarted automatically.

1.39.3. RHSA-2011:0256: Moderate security update

Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol version for IPv6 networks.
A flaw was found in the way the dhcpd daemon processed certain DHCPv6 messages for addresses that had previously been declined and marked as abandoned internally. If a remote attacker sent such messages to dhcpd, it could cause dhcpd to crash due to an assertion failure if it was running as a DHCPv6 server. (CVE-2011-0413)
Red Hat would like to thank Internet Systems Consortium for reporting this issue.
Users running dhcpd as a DHCPv6 server should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, all DHCP servers will be restarted automatically.

1.39.4. RHBA-2011:0697: bug fix and enhancement update

Updated dhcp packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol version for IPv6 networks.
This update fixes the following bugs:
  • Previously, it was impossible to configure the dhcrelay service to run the dhcrelay daemon with additional arguments. With this update, a DHCRELAYARGS variable is available for the /etc/sysconfig/dhcrelay configuration file, which allows additional arguments to be passed to the dhcrelay daemon properly. (BZ#625846)
  • Previously, the dhclient utility did not log its PID (process identifier) in syslog entries, making troubleshooting in systems with multiple running dhclients difficult. Now, the dhclient utility logs its PID properly. (BZ#627257)
  • Previously, the dhclient utility sometimes parsed date strings in lease files incorrectly, resulting in syntax error messages in its output. This bug has been fixed and the dates in the lease files are now parsed with no error messages given. (BZ#631071)
  • When the dhclient utility was updating a "search" entry in the /etc/resolv.conf file, it sometimes did not add a missing domain part. This was inconsistent with NetworkManager behavior. Now, while updating the "search" entry, the dhclient utility always adds the domain part of the host name given to the client if it is missing. (BZ#637763)
  • Previously, the dhcpd service with IPv6 support sometimes created a lease file that it was unable to parse. Consequently, once the service was restarted, it went into a loop and could not start. This bug has been fixed and now the service is able to properly parse all lease files it generates. (BZ#672551)
  • DHCP servers at some ISPs send to clients the "interface-mtu" option with the value of 576. Such a low MTU (Maximum Transmission Unit) can cause throughput problems with UDP traffic, among other things. With this update, the dhclient utility now sets the interface MTU only if the value obtained from the server is higher than 576. (BZ#681721)
  • Previously, the dhclient package was missing its LICENSE file. With this update, the file has been added. (BZ#613683)
This update adds the following enhancements:
  • The dhcp package now provides an implementation of Classless Static Route Options for DHCPv4 (RFC 3442). It can supply network route configuration to a large number of hosts without individual configuration of each one. (BZ#558641)
  • The dhcp package now provides support for IPoIB (IP over InfiniBand) interfaces. (BZ#660681)
Users of dhcp are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

1.40. dovecot

1.40.1. RHSA-2011:0600: Moderate security and enhancement update

Updated dovecot packages that fix two security issues and add one enhancement are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Dovecot is an IMAP server for Linux, UNIX, and similar operating systems, primarily written with security in mind.
A flaw was found in the way Dovecot handled SIGCHLD signals. If a large amount of IMAP or POP3 session disconnects caused the Dovecot master process to receive these signals rapidly, it could cause the master process to crash. (CVE-2010-3780)
A flaw was found in the way Dovecot processed multiple Access Control Lists (ACL) defined for a mailbox. In some cases, Dovecot could fail to apply the more specific ACL entry, possibly resulting in more access being granted to the user than intended. (CVE-2010-3707)
This update also adds the following enhancement:
  • This erratum upgrades Dovecot to upstream version 2.0.9, providing multiple fixes for the "dsync" utility and improving overall performance. Refer to the "/usr/share/doc/dovecot-2.0.9/ChangeLog" file after installing this update for further information about the changes. (BZ#637056)
Users of dovecot are advised to upgrade to these updated packages, which resolve these issues and add this enhancement. After installing the updated packages, the dovecot service will be restarted automatically.

1.41. dracut

1.41.1. RHBA-2010:0877: bug fix update

Updated dracut packages that fix a bug are now available for Red Hat Enterprise Linux 6.
The dracut package is an event-driven initramfs generator infrastructure based around udev. The initramfs is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.
This update fixes the following bug:
  • Prior to this update, the udev rules used by dracut may have caused the merged logical volume management (LVM) snapshots to be accessed. Consequent to this, I/O errors appeared in the log. With this update, dracut's internal udev rules have been updated to ignore those internal devices, and dracut now works as expected. (BZ#651402)
Users of dracut are advised to upgrade to these updated packages, which resolve this issue.

1.41.2. RHEA-2011:0141: enhancement update

Updated dracut packages that add an enhancement are now available for Red Hat Enterprise Linux 6.
The dracut packages provide an event-driven initramfs generator infrastructure based around udev. The initramfs is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.
This update adds the following enhancement:
  • The dracut packages have been updated to support the new kernel boot option, "rdinsmodpost=[module]", which allows a user to specify a kernel module to be loaded after all device drivers are loaded automatically. (BZ#661298)
Users of dracut are advised to upgrade to these updated packages, which add this enhancement.

1.41.3. RHBA-2011:0523: bug fix and enhancement update

Updated dracut packages that fix several bugs and add some enhancements are now available for Red Hat Enterprise Linux 6.
The dracut package is an event-driven initramfs generator infrastructure based around udev. The initramfs is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.
Bug fixes:
BZ#595096
When attempting to boot with MD RAID, udev issued error messages about a missing label because dracut was in the process of rewriting the udev rules files while udev attempted to parse them. dracut now creates temporary rules files, and creates a file for udev's use when the file is considered complete.
BZ#610466
Running mkinitrd alone does not override an existing initramfs image. When this is attempted, the message stated that the --force parameter should be used, but mkinitrd only supported the short version -f of this parameter. --force was added to mkinitrd as the long version.
BZ#626389
When booting an IMSM/ISW RAID with dmraid, the mdadm package must be added to a system that has a kickstart minimal install with the noiswmd or rd_NO_MDIMSM parameters specified.
BZ#630911
When multipath is configured to use user-friendly names, it stores the binding between the wwid and the alias in /etc/multipath/bindings. multipath uses this file in initramfs when creating devices during early boot, and in the root file system during normal operation. These files were not synchronized during initramfs creation, which resulted in naming conflicts that prevented new multipath devices from being created after boot. To work around this, the bindings for the devices in /etc/multipath/bindings must be included in the initramfs. This can be done by running dracut -f.
BZ#636668
dracut did not include all multipath configuration files needed for multipath to include the root device in the multipath listing. dracut now copies over the entire /etc/multipath directory to the initramfs.
BZ#640979
dracut used all network configuration parameters from the kernel command line, but did not honor any configuration settings in the iBFT. dracut now parses the iBFT settings to set up the network if the ip=ibft parameter is specified on the kernel command line.
BZ#642083
dracut did not include multipath in the generated generic initramfs, if the host on which it was running had no multipath root device. multipath support is now added to the initramfs unconditionally.
BZ#645799
Previously, dracut had a hard-wired dependency on vconfig; this dependency is no longer required, and has been removed.
BZ#650959
When operating with LVM snapshot volumes, I/O errors could occur because the udev rules in the initramfs did not exclude those volumes and kept them busy. The udev rules in the initramfs were updated to honor the DM_UDEV_DISABLE_OTHER_RULES_FLAG, which fixes this issue.
BZ#669438
cryptsetup was required to perform verification when a system attempted to run in FIPS mode. However, the verification check failed because several checksum files were missing from initramfs, which resulted in all encrypted devices not being activated. The missing checksum files have been replaced, and this issue no longer occurs. Note however that the dracut-fips must be installed at initramfs creation time.
BZ#674238
When multipath ran in the initramfs with user_friendly_names set, if it did not find existing mappings in /etc/multipath/bindings, it created new mappings. These mappings could conflict with the user_friendly_names set in the normal filesystem's /etc/multipath/bindings file. dracut now starts the multipathd daemon with the new -B option so that multipath treats the initial bindings file as read-only.
BZ#675118
The USE_BIOSDEVNAME variable in the parse-biosdevname.sh script was not initialized correctly, which caused an unexpected operator error. This issue was discovered and corrected during development, and did not occur in any production system in the field.
BZ#676018
If a user started dracut with the -l or --local parameter, or set the dracut base directory via the dracutbasedir environment variable, dracut wrote its log to /tmp/dracut.log, which could possibly allow local users to overwrite arbitrary files that were writable to the user running dracut, via a symlink attack. dracut now stores the logfile in $HOME/dracut.log, when in -l or --local mode, if /var/log/dracut.log is not writeable.
BZ#678294
The /var/log/dracut.log file was not created automatically, preventing dracut from writing its logs. dracut now creates its log files if they do not exist.
BZ#691419
The boot parameter did not work when the machine was booted in FIPS mode, resulting in numerous mount errors, failed FIPS integrity tests, and dracut refusing to continue. This issue has been corrected, and the boot parameter can now be used to specify a boot device, as expected.
BZ#692843
If FIPS mode is enabled and the root partition is encrypted, /boot must reside on a non-encrypted, plain (no LVM or RAID) partition, which can be specified with boot=<boot partition> as a boot option on the kernel command line.
BZ#692939
After installing to a remote logical unit via Fibre Channel over Ethernet (FCoE), the root device could not be found, resulting in kernel panic. This occurred because the MAC address and interface for the FCoE device was not defined correctly. Installing to a remote logical unit via FCoE now works.
BZ#696131
The fips.sh script did not wait for the boot drive to be created, which resulted in an error because the file system type did not exist yet. This has been corrected, and the script now waits for the boot drive to be identified.
Enhancements:
BZ#634013
Previously all information about the network interfaces to boot from was read from the kernel command line. dracut was extended to use network interface configuration from the OptionROM, if fcoe=edd:nodcb or fcoe=edd:dcb is specified on the kernel command line. ifname= is not needed in this case.
BZ#645648
dracut has been updated to support the new kernel boot option, rdinsmodpost=[module], which allows a user to specify a kernel module to be loaded after all device drivers are loaded automatically.
BZ#670925
dracut now includes the kernel module aes-xts in the initramfs, adding support for FIPS-140.
BZ#677340
A new module, dracut-caps has been added to let users omit selected dracut capabilities, and set one or more sysctl parameters.
BZ#689694
Support has been added for the Emulex Tiger Shark adapter for iSCSI.
BZ#692781
Support for several Broadcom drivers (bnx2, bnx2x and bnx2i) has been added to dracut-network.
All users of dracut are advised to upgrade to these updated packages, which resolve these issues.

1.42. e2fsprogs

1.42.1. RHBA-2011:0702: bug fix and enhancement update

Updated e2fsprogs packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The e2fsprogs packages contain a number of utilities that create, check, modify, and correct inconsistencies in ext2, ext3, and ext4 file systems. This includes e2fsck (which repairs file system inconsistencies after an unclean shutdown), mke2fs (which initializes a partition to contain an empty file system), tune2fs (which modifies file system parameters), and most of the other core file system utilities.
Bug fixes:
BZ#489842
When lsattr or chattr was pointed at a non-existent file, an error was returned in that the exit code was always zero. This was because ls reported an error if any occurred, and lsattr did the same, reporting the last error encountered. This patch fixes this error, and lsattr and chattr provide the correct error.
BZ#491385
After using resize2fs to perform an offline resize of a file system, running e2fsck gave an error, stating the wrong block count for the resize inode. This was because the resize inode was not being properly cleared. This patch checks to see if the file system has grown to the point where the resize_inode is no longer needed, then cleans it so e2fsck does not have to. The correct block count is now given for the resize inode.
BZ#506643
Previously, e2fsprogs libblkid probe_all() could mismatch devices when scanning whole disks without partitions where the name ended in a number. This caused a mount failure. With this patch these disks are also scanned, so the devices are mounted correctly.
BZ#553216
When a host was re-kickstarted, mpath mounts with LABEL failed with the error “mount: /dev/sdk already mounted or /san/intf busy”. This was because the probe_one() function scanned /dev before /dev/mapper. This patch disables all calls from libdevmapper via #undef HAVE_DEVMAPPER, instead using the standard support for “normal” non-dm devices. This results in mpath can mount without errors.
BZ#562044
Running “e2fsck -y -f” on a corrupted file system printed errors even after “e2fsck -y” had previously reported the file system to be clean. This occurred when a file had its i_file_acl block cloned as a duplicate. This duplicate was then cleared because the file system did not have the xattr feature, and the inode was subsequently removed due to an invalid mode. The second e2fsck pass found the cloned xattr block in use but not owned by any file, so had to fix up the block bitmaps. This patch fixes an existing brace misalignment and skips the processing of the duplicat xattr blocks on a non-xattr file system, as these will be cleaned at a later point, allowing the clean to occur properly.
BZ#579836
On 64-bit systems, a sign extension bug in libcom_err caused incorrect error messages to be emitted. This was because an error code as an (int) was passed to error_message as an (unsigned int), especially when using libgssapi_krb5. This meant that error_message() failed to find a matching error table. To fix this, error_message() has been changed to follow the same method error_table_name() does when error_message() calls it. That is, it drops most of the higher bits of the parameter passed before continuing, so now correct error messages are emitted.
BZ#580671
A sparse journal (which indicates corruption) was not fixed by e2fsck, causing file system errors and a shut down after mount. This was because e2fsck marked the file system as clean so it would mount, but did not fix that block, so when the journal reached this point again it failed once more. This patch changes process_journal_block() to clear and recreate the journal inode if it is sparse, that is if it gets block 0, allowing e2fsck to correctly fix a sparse journal.
BZ#606757
Previously, chattr and lsattr would return “error code = 0” even when they have not done anything, which made error checking difficult in scripts. With this patch, if there are errors they will be reported with a non-zero exit code. It will give explicit errors when attempting to set files that are not files or directories (which are not currently supported under Linux). Also, the -f flag will suppress error messages from being printed even though the exit status will still be non-zero.
BZ#607843
When checking a particular volume, e2fsck exited with a signal 11 (segmentation fault). This was caused by floating point errors. This patch edits get_icount_el to prevent point precision errors on large file systems from causing the search interpolation algorithm from performing an infinite loop, allowing e2fsck to check the volume correctly.
BZ#618134
The fsck command returned a 0 status instead of an appropriate error code on an exec() failure, due to an error in the code. This patch fixes the error so that the appropriate error code is now returned.
BZ#637920
Previously, blkid cachine caused a tag search (blkid -l -t ...) to return empty results. This occurred mostly in debug code, where dev->bid_type is not-NULL before dereferencing the pointer. This has been edited and blkid cachine now returns proper results.
BZ#669676
Previously, e2fsprogs failed to build with newer gettext package. This was due to a problem in auto-fu. This patch fixes this allowing the packages to build correctly.
BZ#675694
If more than 128 devices were specified on the blkid command line, the devices[] array overflowed, resulting in a crash. This patch avoids the problem by dynamically allocating the devices[] array based on the number of arguments, resulting in more than 128 devices being able to be specified on the blkid command line.
BZ#696930
Running blkid on IBM System z caused a crash with a signal 11 (segmentation fault) error. This was due to an error in the code regarding floating points. This patch frees a pointer that was not initialized to null, allowing blkid to run correctly on IBM System z.
BZ#678304
It was possible for the UUIDD to generate duplicate UIDs under certain circumstances. This occurred when the socket backlog in the UUIDD daemon was full, therefore the connection was refused and uuid_generate_time() fell back to unsafe ways of generating a UUID, resulting in the duplicates. Also, fcntle(2) did not work for the synchronization of threads belonging to the same process, contributing to the problem. This patch introduces a safe variant of uuid_generate_time() and fixes the locking of the clock state counter file which prevents UUIDD from generating duplicate UIDs.
BZ#681071
Running e2fsck on a corrupted file system gave a “should never happen” error. This occurred when a directory with an htree index had an incorrect and too-large i_size field. This patch prevents e2fsck from crashing and prompts the user to remove the htree index so that it can be rebuilt after pass 3, allowing file systems with this error to be fixed.
Enhancements:
BZ#563909
When running blkid, stale mounts can occasionally be seen within the cache. While running blkid -c /dev/null gets around this, it can become a runtime issue when blkid is run against a machine with several hundred disks. As such this patch adds a garbage collection routine feature. This performs a garbage collection pass on the /etc/blkid.tab file by adding the -g option to the blkid program. The man page has also been updated with more information about what the -g garbge collection option does.
BZ#587778
The mkfs reserved blocks were originally set to 5% by default, with a 1% step size. This was considered excessive for large file systems. With this patch, the reserved blocks amount now accepts a floating point for better accuracy when setting the percent. Also, mke2fs and tune2fs now accept a floating point number from the user to improve the level of accuracy offered.
All users are advised to upgrade to these updated packages, which resolve these issues and include these enhancements.

1.43. ebtables

1.43.1. RHEA-2011:0556: enhancement update

An enhanced ebtables package is now available.
Ethernet bridge tables is a firewalling tool to transparently filter network traffic passing a bridge. The filtering possibilities are limited to link layer filtering and some basic filtering on higher network layers.
Auditing support is added to create a kernel audit record that records the information flow between a host, guest, and other network entities. (BZ#642394)
All users requiring firewalling for Ethernet bridge tables are advised to upgrade to this updated package, which adds this enhancement.

1.44. eclipse

1.44.1. RHSA-2011:0568: Low security, bug fix, and enhancement update

Updated eclipse packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The Eclipse software development environment provides a set of tools for C/C++ and Java development.
A cross-site scripting (XSS) flaw was found in the Eclipse Help Contents web application. An attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially-crafted Eclipse Help URL. (CVE-2010-4647)
The following Eclipse packages have been upgraded to the versions found in the official upstream Eclipse Helios SR1 release, providing a number of bug fixes and enhancements over the previous versions:
In addition, the following updates were made to the dependencies of the Eclipse packages above:
This update includes numerous upstream bug fixes and enhancements, such as:
  • The Eclipse IDE and Java Development Tools (JDT):
    • projects and folders can filter out resources in the workspace
    • new virtual folder and linked files support.
    • the full set of UNIX file permissions is now supported.
    • addition of the stop button to cancel long-running wizard tasks.
    • Java editor now shows multiple quick-fixes via problem hover.
    • new support for running JUnit version 4 tests.
    • over 200 upstream bug fixes.
  • The Eclipse C/C++ Development Tooling (CDT):
    • new Codan framework has been added for static code analysis.
    • refactoring improvements such as stored refactoring history.
    • compile and build errors now highlighted in the build console.
    • switch to the new DSF debugger framework.
    • new template view support.
    • over 600 upstream bug fixes.
This update also fixes the following bugs:
  • Incorrect URIs for GNU Tools in the "Help Contents" window have been fixed. (BZ#622713)
  • The profiling of binaries did not work if an Eclipse project was not in an Eclipse workspace. This update adds an automated test for external project profiling, which corrects this issue. (BZ#622867)
  • Running a C/C++ application in Eclipse successfully terminated, but returned an I/O exception not related to the application itself in the Error Log window. With this update, the exception is no longer returned. (BZ#668890)
  • The eclipse-mylyn package showed a "20100916-0100-e3x" qualifier. The qualifier has been modified to "v20100902-0100-e3x" to match the upstream version of eclipse-mylyn. (BZ#669819)
  • Installing the eclipse-mylyn package failed and returned a "Resource temporarily unavailable" error message due to a bug in the packaging. This update fixes this bug and installation now works as expected. (BZ#673174)
  • Building the eclipse-cdt package could fail due to an incorrect interaction with the local file system. Interaction with the local file system is now prevented and the build no longer fails. (BZ#678364)
  • The libhover plug-in, provided by the eclipse-cdt package, used binary data to search for hover topics. The data location was specified externally as a URL which could cause an exception to occur on a system with no Internet access. This update modifies the plug-in so that it pulls the needed data from a local location. (BZ#679543)
Users of eclipse should upgrade to these updated packages, which correct these issues and add these enhancements.

1.45. edac-utils

1.45.1. RHBA-2011:0768: bug fix and enhancement update

Updated edac-utils packages that fix one bug and add one enhancement are now available for Red Hat Enterprise 6.
EDAC is the current set of drivers in the Linux kernel that handles detection of ECC errors from memory controllers for most chipsets on the x86, AMD64, and Intel 64 architectures. The user-space component consists of an initscript which ensures that EDAC drivers and DIMM labels are loaded at system startup, as well as a library and utility for reporting current error counts from the EDAC sysfs files.
This update fixes the following bug:
  • Previously, the edac-utils initscript did not use the standard error codes of other initscripts because several mandatory actions were missing. This update implements the initscript actions "condrestart", "try-restart", "force-reload" and sets the return values for each action accordingly. Now, the initscript uses the standard error code. (BZ#632665)
This update also adds the following enhancement:
  • This update extends the maximum number of channels from 2 to 6, in order to allow it to work with some designs that have 4 channels on FB-DIMM motherboards, e.g. the ones with Intel 7300 chipset. By default, this update identifies the motherboard via BIOS DMI board information. If not available, it will fallback to use DMI system information. (BZ#640113)
Note: the improvements from upstream version 0.16 are now added to edac-utils, including new motherboard labels, an option to delay the motherboard write labels, and a better parser to retrieve memory and vendor information from the system.
All EDAC users are advised to upgrade to these updated packages, which fix this bug and add this enhancement.

1.46. efibootmgr

1.46.1. RHBA-2011:0674: bug fix update

An updated efibootmgr package that fixes one bug is now available for Red Hat Enterprise Linux 6.
The efibootmgr utility is responsible for the boot loader installation on Unified Extensible Firmware Interface (UEFI) systems.
This update fixes the following bug:
  • Due to missing support for 4KB disk sectors, an attempt to use the efibootmgr utility to create a boot option on such a device caused the utility to fail with the following error message:
    Error: no partition information on disk [device].
    Cowardly refusing to create a boot option.
    
    This update adapts the efibootmgr utility to provide support for 4KB disk sectors, resolving this issue. (BZ#612280)
All users of efibootmgr are advised to upgrade to this updated package, which fixes this bug.

1.47. elfutils

1.47.1. RHBA-2011:0578: bug fix update

Updated elfutils packages that resolve an issue are now available.
The elfutils package contains utilities and libraries for working with compiled binary files. Its libraries are used by the SystemTap instrumentation system found in the systemtap package.
These updated elfutils packages fix the following bug:
  • After prelink had been run on the system, using SystemTap user-space probes that targeted functions or statements in certain shared libraries, or executables based on a separate debuginfo file, caused resolution to the wrong PC location in a linked binary. As a result, the intended probes failed to fire at the correct place in the program, which could have caused the program to crash or misbehave due to a corrupted instruction sequence resulting from incorrect breakpoint insertions. With this update, the libdwfl library code (the libdw.so shared object library) was adjusted to use a more reliable method of compensating for prelink's effect on the address layout of a binary when aligning a runtime PC address with an address computed separately from the separated debuginfo file. SystemTap probes should now work the same on prelinked binaries as they would on binaries that have not been prelinked. (BZ#652858)
All users of SystemTap and elfutils are advised to upgrade to these updated packages, which resolve this issue.

1.48. emacs

1.48.1. RHBA-2011:0717: bug fix update

Updated emacs packages that fix two bugs are now available for Red Hat Enterprise Linux 6.
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read email and news.
This update fixes the following bugs:
  • Prior to this update, Emacs incorrectly displayed Japanese documents using JIS X 0213:2004 (JIS2004) compliant fonts, even though other parts of the system prefer and use older fonts. This update lowers the priority of JIS X 0213:2004 to ensure the consistent use of fonts in the system. (BZ#612385)
  • Previously, the emacs packages required the aspell and hunspell spell checkers to be installed. Since the use of a spell checker is completely optional, this update removes aspell and hunspell from the list of dependencies, so that Emacs can now be installed without these packages. (BZ#613759)
All users of emacs are advised to upgrade to these updated packages, which fix these bugs.

1.49. epydoc

1.49.1. RHBA-2011:0316: bugfix update

An updated epydoc package that fixes a bug is now available for Red Hat Enterprise Linux 6.
Epydoc is a tool for generating API documentation for Python modules, based on their docstrings. A lightweight markup language called epytext can be used to format docstrings, and to add information about specific fields, such as parameters and instance variables. Epydoc also understands docstrings written in ReStructuredText, Javadoc and plaintext.
This update fixes the following bug:
  • Previously, the summary extractor of reStructuredText did not work properly and the documentation process failed. Due to this behavior, building packages could fail. This update resolves this problem. Packages now build successfully. (BZ#657567)
All users of epydoc are advised to upgrade to this updated package, which resolves this issue.

1.50. evince

1.50.1. RHSA-2011:0009: Moderate security update

Updated evince packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Evince is a document viewer.
An array index error was found in the DeVice Independent (DVI) renderer's PK and VF font file parsers. A DVI file that references a specially-crafted font file could, when opened, cause Evince to crash or, potentially, execute arbitrary code with the privileges of the user running Evince. (CVE-2010-2640, CVE-2010-2641)
A heap-based buffer overflow flaw was found in the DVI renderer's AFM font file parser. A DVI file that references a specially-crafted font file could, when opened, cause Evince to crash or, potentially, execute arbitrary code with the privileges of the user running Evince. (CVE-2010-2642)
An integer overflow flaw was found in the DVI renderer's TFM font file parser. A DVI file that references a specially-crafted font file could, when opened, cause Evince to crash or, potentially, execute arbitrary code with the privileges of the user running Evince. (CVE-2010-2643)
Note: The above issues are not exploitable unless an attacker can trick the user into installing a malicious font file.
Red Hat would like to thank the Evince development team for reporting these issues. Upstream acknowledges Jon Larimer of IBM X-Force as the original reporter of these issues.
Users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.

1.51. evolution

1.51.1. RHBA-2011:0714: bug fix update

Updated evolution packages that fix various bugs are now available for Red Hat Enterprise Linux 6.
Evolution is the GNOME email, calendar, contact management and communications application. The components which make up Evolution are tightly integrated with one another and act as a seamless personal information-management (PIM) tool.
This update fixes the following bugs:
  • When a user tried to migrate their mail folder settings after upgrading to Red Hat Enterprise Linux 6, or restore a backup from the previous version of Evolution, Evolution sometimes terminated unexpectedly. This bug has been fixed and no longer occurs during the migration process. (BZ#696881)
  • When a user created or edited a task in Evolution, the tooltip for the print icon in the toolbar was missing. This tooltip has been added and is now correctly displayed when hovering over the print icon. (BZ#585931)
  • When printing the "Day" view of a calendar in Evolution to a Postscript file, the selected day and month name overlapped the line below. The issue has been resolved; overlaps no longer take place. (BZ#628964)
  • When a user selected the "Submit bug report" option in the "Help" menu, a spurious "Bug Buddy is not installed" error message appeared. Because Bug Buddy is not a component of Red Hat Enterprise Linux 6, the menu option to submit a bug was removed. (BZ#632968)
  • When creating a mail account in the Evolution Account Assistant using the POP protocol, the keyboard shortcut for "Delete after 7 days" (Alt+D) did not work. With this update, the GUI widget accepts the keyboard shortcut for the "Delete after 7 days" functionality and entering the shortcut now works as expected. (BZ#633600)
  • The "Create a Memo" item from the "Message" menu was active when it was not supposed to be. As a consequence, Evolution terminated unexpectedly when the user selected this item. With this update, the "Create a Memo" item is deactivated when it is supposed to be, with the result that the user can no longer crash Evolution by selecting it. (BZ#633629)
  • When viewing an email message larger than the maximum value defined in the settings Edit -> Preferences -> Mail Preferences -> "Do not format messages when text size exceeds [n KB]" caused Evolution to terminate unexpectedly. This bug has been fixed and viewing a message larger than the set value no longer causes Evolution to crash. (BZ#666875)
  • When a user created a calendar meeting in Evolution with at least 16 attendees and right-clicked "Reply to all", the application terminated unexpectedly sometimes. The problem was with the reallocation of memory in glib2 and it has been fixed. Replying to all attendees of a calendar meeting now works as expected. (BZ#667083)
  • When a user clicked into the input field under the Summary header in Task or Memo section in Evolution, and switched its input method to any language managed by ibus (such as Chinese), foreign characters could not be entered. The fix involves calling some functions in the correct order so the events for the input method are registered properly. (BZ#633189)
  • When using one of four Asian locales (ml_IN, hi_IN, ta_IN, zh_TW), the following problems occurred in Evolution Assistant: differing translations for the label and button "Forward" and "Finish", a missing and erroneous translation for the "Forward" label, and the ZWJ/ZWNJ characters visible by mistake. With this update, corrected translations has been provided. (BZ#628882, BZ#630316, BZ#632998, BZ#638643)
  • In the "Evolution Appointment" dialog, when using the Chinese Simplified locale (zh_CN), there was an erroneous translation on the "for" button. The translation has been modified and Evolution now displays a proper button text translation. (BZ#633181)
Users are advised to upgrade to these updated packages, which fix these bugs and correct several localization issues.

1.52. evolution-data-server

1.52.1. RHBA-2011:0713: bug fix update

An updated evolution-data-server package that fixes several bugs is now available.
The evolution-data-server package provides a unified back end for applications which interact with contacts, task and calendar information. Evolution Data Server was originally developed as a back end for Evolution, but is now used by various other applications.
This updated evolution-data-server package provides fixes for the following bugs:
  • cannot enter date in New->Appointment dialog with or_IN language (BZ #629919)
  • crash when using Google address book (BZ #634949)
  • folder unread count doesn't update properly on search folders (BZ #657117)
  • crash when receiving On The Web calendar items (BZ #660356)
  • crash when adding contact to a contact list (BZ #666879)
Users are advised to upgrade to this updated evolution-data-server package, which resolves these issues.

1.53. evolution-mapi

1.53.1. RHBA-2011:0800: bug fix update

An updated evolution-mapi package that fixes a crash is now available.
The MAPI extension for Evolution (evolution-mapi) allows Evolution to interact with MS Exchange 2007 servers.
This package fixes the following bug:
  • When accessing an address book on an Exchange 2007 server, a flaw in the MAPI extension caused the evolution-data-server process to occasionally crash. This was because evolution-mapi mistook EDataBookView as a GObject, instead of a bonobo_object, and as a result was reffing/unreffing it with g_object_ref/g_object_unref. This patch uses the proper functions for ref/unref, resolving the issue. (BZ#66642)
Users are advised to upgrade to this updated evolution-mapi package, which resolves this.

1.54. fakechroot

1.54.1. RHBA-2011:0719: bug fix update

Updated fakechroot packages that fix one bug are now available for Red Hat Enterprise Linux 6.
The fakechroot utility allows a user to run programs in an environment that enables the use of the chroot command without the need for root privileges.
This update fixes the following bug:
  • Prior to this update, the fakechroot packages were marked as multilib, which allowed users to install these packages for multiple architectures at the same time. However, this feature is not fully supported by fakechroot. Since the 32-bit version is not actually needed, this update adds the "ExclusiveArch: x86-64" tag to the RPM spec file, so that the fakechroot packages are now available only for the 64-bit x86 architecture. (BZ#598451)
All users of fakechroot are advised to upgrade to these updated packages, which fix this bug.

1.55. fcoe-utils

1.55.1. RHBA-2011:0743: bug fix update

An updated fcoe-utils package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.
The fcoe-utils package allows users to use Fibre Channel over Ethernet (FCoE). The package contains the fcoeadm command line tool for configuring FCoE interfaces, and the fcoemon service to configure DCB (Data Center Bridging) Ethernet QoS filters.
The fcoe-utils package has been upgraded to upstream version 1.0.18, which provides a number of bug fixes and enhancements over the previous version. (BZ#672453, BZ#691613)
This update fixes the following bugs:
  • Previously, in a particular setup with multipath and FCoE services, the system sometimes became unresponsive during shutdown or reboot, and a hard reboot was required to get the system back up. Now, an additional FCoE root filesystem check has been added to the init script and the system no longer hangs during reboot or shutdown in this scenario. (BZ#645917)
  • Sometimes, FCoE devices are not discovered immediately by the system. As a consequence, some FCoE partitions were previously not automounted after a boot. With this update, the FCoE init script waits for a certain amount of time (65 seconds by default), which is enough for most FCoE partitions to be discovered and mounted during the boot. (BZ#658076)
  • Running the fcoeadm tool without the FCoE stack loaded caused the fcoeadm tool to terminate with a backtrace when it tried to free an unallocated pointer. With this update, only successfully allocated pointers are freed and the fcoeadm tool returns a proper error message otherwise. (BZ#678487)
  • After VLAN discovery was tried unsuccessfully 10 times, the default FCoE driver for an interface was used instead of the preferred one. With this update, VLAN discovery is retried indefinitely and FCoE interfaces are now created only upon VLAN discovery, with proper drivers. (BZ#689631)
  • For several fcoe-utils executables, there were minor inconsistencies in the documentation between their command help output and their man pages. With this update, the documentation has been updated and the man pages and help output are now consistent. (BZ#623567)
  • The vconfig package had been marked for removal from the distribution, but the fcoe-utils package required it at runtime. With this update, this dependency has been removed in favor of the iproute package. (BZ#645796)
  • When an FCoE VLAN interface was restarted, the FCoE interface was not re-enabled after the VLAN interface was brought up again. This bug has been fixed and the FCoE interface is now automatically enabled after the VLAN interface is brought up. (BZ#680578)
This update adds the following enhancement:
  • With this update, the fcoe-utils package introduces a new SUPPORTED_DRIVERS configuration option to list all the low-level drivers that can potentially claim a network device. The package also uses the new sysfs module path introduced by the Red Hat Enterprise Linux 6.1 kernel update. (BZ#669211)
Users of fcoe-utils are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.

1.56. febootstrap

1.56.1. RHEA-2011:0587: enhancement update

Updated febootstrap packages that add two enhancements are now available for Red Hat Enterprise Linux 6.
febootstrap is used to create a basic Red Hat Enterprise Linux or Fedora filesystem, and builds initramfs (initrd.img) or filesystem images.
This update adds the following enhancements:
  • The febootstrap packages have been upgraded to upstream version 2.11, which provides a number of bug fixes and one enhancement over the previous version. (BZ#628849)
  • This update provides the subpackage febootstrap-supermin-helper for the runtime helper program. Now, libguestfs runtime depends only on febootstrap-supermin-helper, which reduces the dependencies. (BZ#669839)
All febootstrap users are advised upgrade to these updated packages, which add these enhancements.

1.57. fence-agents

1.57.1. RHBA-2011:0363: bug fix update

An updated fence-agents package that fixes a bug is now available for Red Hat Enterprise Linux 6.
Red Hat fence agents are a collection of scripts to handle remote power management for several devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
This update fixes the following bug:
  • A bug fix for a previous advisory, the RHEA-2010:0904 enhancement update, stated that the Brocade 200E, Brocade 300, Brocade 4100, Brocade 4900, and Brocade 5100 fencing devices are now supported by the fence_brocade agent. However, the fence_brocade agent was not included in the updated package. This update corrects this error, and the fence_brocade agent is now included in the package as expected. (BZ#680522)
All users of fence-agents are advised to upgrade to this updated package, which resolves this issue.

1.57.2. RHBA-2011:0745: bug fix and enhancement update

An updated fence-agents package that fixes bugs, adds support for new hardware and Red Hat Enterprise Virtualization is now available.
Red Hat fence agents are a collection of scripts to handle remote power management for several devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
This update includes the following bug fixes:
  • Metadata generation has been corrected in order to provide information for all known parameters for each fencing agent. (BZ#618703, BZ#623266)
  • Port is now a synonym of module_name for fence_drac5, making it consistent with other fencing agents. (BZ#619096)
  • Information on how to use fence_ipmi with HP iLO version 3 has been added to the manual page. (BZ#648892)
  • The fence_egenera manual page has been improved. (BZ#635824)
  • fence_scsi now works when devices report "Unit Attention". (BZ#640343)
  • fence_scsi now verifies action results. (BZ#644385)
  • fence_scsi now correctly identifies device mapper multipath devices. (BZ#644389)
  • fence_scsi pattern matching has been improved. (BZ#670910)
  • fence_scsi now logs errors whenever a command fails. (BZ#672597)
This update adds the following enhancements:
  • Support for Cisco UCS blade systems is now provided. (BZ#580492, BZ#678904)
  • It is now possible for one node to delay fencing in a two-node cluster. (BZ#614046)
  • Fence_ipmilan can now use the "diag" option. (BZ#655764)
  • The package has been updated to provide a fencing agent that is able to communicate with Red Hat Enterprise Virtualization Manager, allowing virtual machines to be fenced. (BZ#595383)
  • For Intelligent Platform Management Interface (IPMI) devices, the "power_wait" delay can now be adjusted in order to support newer iLO 3 firmware. (BZ#642671)
  • Brocade 200E, Brocade 300, Brocade 4100, Brocade 4900, and Brocade 5100 fencing devices are now supported by the fence_brocade agent, and can be used with both Red Hat High Availability and Red Hat Resilient Storage. (BZ#642235, BZ#680170)
  • An issue with fence_scsi where the key was erroneously reported as 0 has been addressed. (BZ#653504)
  • fence_wti now correctly handles large (>20) port switches. (BZ#678522)
  • fence_rhevm has been updated to the current RHEVM development API. (BZ#681669, BZ#681674)
  • fence_cisco_ucs was missing from the fence-agents package, but is now included. (BZ#682715)
All users requiring any of the changes noted above should upgrade to this new package, which fixes these issues and adds these enhancements.

1.58. fence-virt

1.58.1. RHBA-2011:0731: bug fix and enhancement update

Updated fence-virt packages that provide a bug fix and an enhancement are now available.
The fence-virt packages provide a fencing agent for virtual machines as well as a host agent which processes fencing requests.
This update addresses the following bug:
  • The manual pages now correctly refer to "fence_virt.conf" instead of "fence_virtd.conf." (BZ#667170)
As well, this update adds the following enhancement:
  • Fence-virtd now operates with newer versions of QMF. (BZ#690582)
All users of fence-virt are advised to upgrade to these updated packages, which address these issues.

1.59. file

1.59.1. RHBA-2011:0204: bug fix update

Updated file packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
The file command is used to identify a particular file according to the type of data contained in the file.
This update fixes the following bugs:
  • Prior to this update, the file utility could be unable to recognize Python scripts correctly. This update improves the file type recognition, and Python scripts are now identified as expected. (BZ#594083)
  • In accordance with POSIX standards, when the file utility is used on a file that does not exist, cannot be read, or is of an unknown type, it returns 0 exit code. This update extends the manual page to document this behavior. (BZ#608686)
  • The file utility has been updated to recognize the WebM media container. (BZ#610795)
  • The file utility has been updated to recognize the ZIP64 file format. (BZ#637782)
  • The file utility has been updated to recognize volume_key escrow packets. (BZ#643046)
  • Due to an error in a magic pattern, the file utility incorrectly identified GFS file systems as GFS2. With this update, the magic pattern has been corrected, and GFS file systems are now identified as expected. (BZ#670125)
All users of file are advised to upgrade to these updated packages, which resolve these issues.

1.60. fipscheck

1.60.1. RHEA-2011:0672: enhancement update

Updated fipscheck packages which relocate the library from /usr to /lib or /lib64 are now available.
FIPSCheck is a library used to verify the integrity of modules validated under FIPS-140-2. The fipscheck package provides helper binaries for creating and verifying HMAC-SHA256 checksum files.
These updated fipscheck packages add the following enhancement:
  • The fipscheck library can be linked to binaries (such as cryptsetup) which have to operate when /usr is not mounted. With this update, the fipscheck library relocates from /usr to /lib or /lib64 (depending on the underlying architecture) to allow linking to such binaries. (BZ#669077)
All fipscheck users are advised to upgrade to these updated packages, which add this enhancement.

1.61. firefox

1.61.1. RHSA-2010:0861: Critical security update

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
A race condition flaw was found in the way Firefox handled Document Object Model (DOM) element properties. Malicious HTML content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-3765)
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-3175, CVE-2010-3176, CVE-2010-3179, CVE-2010-3183, CVE-2010-3180)
A flaw was found in the way the Gopher parser in Firefox converted text into HTML. A malformed file name on a Gopher server could, when accessed by a victim running Firefox, allow arbitrary JavaScript to be executed in the context of the Gopher domain. (CVE-2010-3177)
A same-origin policy bypass flaw was found in Firefox. An attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim had loaded with Firefox. (CVE-2010-3178)
A flaw was found in the script that launches Firefox. The LD_LIBRARY_PATH variable was appending a "." character, which could allow a local attacker to execute arbitrary code with the privileges of a different user running Firefox, if that user ran Firefox from within an attacker-controlled directory. (CVE-2010-3182)
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.11 and 3.6.12. You can find links to the Mozilla advisories in the References section of this erratum.
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.12, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

1.61.2. RHSA-2010:0966: Critical security update

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Mozilla Firefox is an open source web browser.
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-3766, CVE-2010-3767, CVE-2010-3772, CVE-2010-3776, CVE-2010-3777)
A flaw was found in the way Firefox handled malformed JavaScript. A website with an object containing malicious JavaScript could cause Firefox to execute that JavaScript with the privileges of the user running Firefox. (CVE-2010-3771)
This update adds support for the Sanitiser for OpenType (OTS) library to Firefox. This library helps prevent potential exploits in malformed OpenType fonts by verifying the font file prior to use. (CVE-2010-3768)
A flaw was found in the way Firefox loaded Java LiveConnect scripts. Malicious web content could load a Java LiveConnect script in a way that would result in the plug-in object having elevated privileges, allowing it to execute Java code with the privileges of the user running Firefox. (CVE-2010-3775)
It was found that the fix for CVE-2010-0179 was incomplete when the Firebug add-on was used. If a user visited a website containing malicious JavaScript while the Firebug add-on was enabled, it could cause Firefox to execute arbitrary JavaScript with the privileges of the user running Firefox. (CVE-2010-3773)
A flaw was found in the way Firefox presented the location bar to users. A malicious website could trick a user into thinking they are visiting the site reported by the location bar, when the page is actually content controlled by an attacker. (CVE-2010-3774)
A cross-site scripting (XSS) flaw was found in the Firefox x-mac-arabic, x-mac-farsi, and x-mac-hebrew character encodings. Certain characters were converted to angle brackets when displayed. If server-side script filtering missed these cases, it could result in Firefox executing JavaScript code with the permissions of a different website. (CVE-2010-3770)
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.13. You can find a link to the Mozilla advisories in the References section of this erratum.
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.13, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

1.61.3. RHSA-2011:0310: Critical security and bug fix update

Updated firefox packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
A flaw was found in the way Firefox sanitized HTML content in extensions. If an extension loaded or rendered malicious content using the ParanoidFragmentSink class, it could fail to safely display the content, causing Firefox to execute arbitrary JavaScript with the privileges of the user running Firefox. (CVE-2010-1585)
A flaw was found in the way Firefox handled dialog boxes. An attacker could use this flaw to create a malicious web page that would present a blank dialog box that has non-functioning buttons. If a user closes the dialog box window, it could unexpectedly grant the malicious web page elevated privileges. (CVE-2011-0051)
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0053, CVE-2011-0055, CVE-2011-0058, CVE-2011-0062)
Several flaws were found in the way Firefox handled malformed JavaScript. A website containing malicious JavaScript could cause Firefox to execute that JavaScript with the privileges of the user running Firefox. (CVE-2011-0054, CVE-2011-0056, CVE-2011-0057)
A flaw was found in the way Firefox handled malformed JPEG images. A website containing a malicious JPEG image could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0061)
A flaw was found in the way Firefox handled plug-ins that perform HTTP requests. If a plug-in performed an HTTP request, and the server sent a 307 redirect response, the plug-in was not notified, and the HTTP request was forwarded. The forwarded request could contain custom headers, which could result in a Cross Site Request Forgery attack. (CVE-2011-0059)
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.14. You can find a link to the Mozilla advisories in the References section of this erratum.
This update also fixes the following bug:
  • On Red Hat Enterprise Linux 4 and 5, running the "firefox -setDefaultBrowser" command caused warnings such as the following:
    libgnomevfs-WARNING **: Deprecated function.  User modifications to the
    MIME database are no longer supported.
    
    This update disables the "setDefaultBrowser" option. Red Hat Enterprise Linux 4 users wishing to set a default web browser can use Applications -> Preferences -> More Preferences -> Preferred Applications. Red Hat Enterprise Linux 5 users can use System -> Preferences -> Preferred Applications. (BZ#463131, BZ#665031)
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.14, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

1.61.4. RHSA-2011:0471: Critical security update

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Several flaws were found in the processing of malformed web content. A web page containing malicious content could possibly lead to arbitrary code execution with the privileges of the user running Firefox. (CVE-2011-0080, CVE-2011-0081)
An arbitrary memory write flaw was found in the way Firefox handled out-of-memory conditions. If all memory was consumed when a user visited a malicious web page, it could possibly lead to arbitrary code execution with the privileges of the user running Firefox. (CVE-2011-0078)
An integer overflow flaw was found in the way Firefox handled the HTML frameset tag. A web page with a frameset tag containing large values for the "rows" and "cols" attributes could trigger this flaw, possibly leading to arbitrary code execution with the privileges of the user running Firefox. (CVE-2011-0077)
A flaw was found in the way Firefox handled the HTML iframe tag. A web page with an iframe tag containing a specially-crafted source address could trigger this flaw, possibly leading to arbitrary code execution with the privileges of the user running Firefox. (CVE-2011-0075)
A flaw was found in the way Firefox displayed multiple marquee elements. A malformed HTML document could cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0074)
A flaw was found in the way Firefox handled the nsTreeSelection element. Malformed content could cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0073)
A use-after-free flaw was found in the way Firefox appended frame and iframe elements to a DOM tree when the NoScript add-on was enabled. Malicious HTML content could cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0072)
A directory traversal flaw was found in the Firefox resource:// protocol handler. Malicious content could cause Firefox to access arbitrary files accessible to the user running Firefox. (CVE-2011-0071)
A double free flaw was found in the way Firefox handled "application/http-index-format" documents. A malformed HTTP response could cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0070)
A flaw was found in the way Firefox handled certain JavaScript cross-domain requests. If malicious content generated a large number of cross-domain JavaScript requests, it could cause Firefox to execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0069)
A flaw was found in the way Firefox displayed the autocomplete pop-up. Malicious content could use this flaw to steal form history information. (CVE-2011-0067)
Two use-after-free flaws were found in the Firefox mObserverList and mChannel objects. Malicious content could use these flaws to execute arbitrary code with the privileges of the user running Firefox. (CVE-2011-0066, CVE-2011-0065)
A flaw was found in the Firefox XSLT generate-id() function. This function returned the memory address of an object in memory, which could possibly be used by attackers to bypass address randomization protections. (CVE-2011-1202)
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.17. You can find a link to the Mozilla advisories in the References section of this erratum.
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.17, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

1.61.5. RHSA-2011:0373: Important security update

Updated firefox packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
This erratum blacklists a small number of HTTPS certificates. (BZ#689430)
All Firefox users should upgrade to these updated packages, which contain a backported patch. After installing the update, Firefox must be restarted for the changes to take effect.

1.61.6. RHBA-2011:0359: bug fix update

Updated firefox packages that resolve an issue are now available.
Mozilla Firefox is an open source Web browser.
These updated firefox packages fix the following bug:
  • Prior to this update, some Java applets would fail to load in the 3.6.14 version of Firefox. In this newly-released version (Firefox 3.6.15), Java applets no longer fail to load. (BZ#682251, BZ#682252, BZ#682253)
All users of firefox are advised to upgrade to these updated packages, which resolve this issue.

1.62. firstaidkit

1.62.1. RHEA-2011:0166: enhancement update

Updated firstaidkit packages that add an enhancement are now available for Red Hat Enterprise Linux 6.
FirstAidKit is a tool that runs automated diagnostics of an installed Red Hat Enterprise Linux system.
This update adds the following enhancement:
  • These updated packages introduce a new manual page with an outline of the basic concepts and format of the main configuration file (that is, /etc/firstaidkit/firstaidkit.conf by default). Note that this manual page does not replace a detailed description of available configuration options in the configuration file itself. (BZ#584677)
Users of firstaidkit are advised to upgrade to these updated packages, which add this enhancement.

1.63. firstboot

1.63.1. RHBA-2011:0742: bug fix and enhancement update

Updated firstboot packages that fix two bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.
The firstboot utility runs after installation. It guides the user through a series of steps that allows for easier configuration of the machine.
This update fixes the following bugs:
  • Previously, no screen was provided to change the root password in firstboot. Due to this lack, users had to change the settings of system-config-users to the root password within the Advanced window of firstboot's create user screen. This update adds a module to change the root password. Now, users can view a set the root password in firstboot, if run with the option "the --reconfig". (BZ#658869)
  • Previously, users could not skip the user creation screen. Due to this lack, users had to create a user account with an UID number above or equal to 500 to continue to the next step of the first boot process. With this update, the check for valid user accounts in the system checks whether a user account with a valid login shell is present and not only user accounts with an UID number above or equal to 500. If there's no such user account present firstboot shows a warning, but allows the user to go to the next step. Now, users can skip the user creation part of firstboot. (BZ#659451)
This update also adds the following enhancement:
  • Previously, the firstboot utility did not run automatically after installation on IBM's System/390 architecture. Due to this issue, users had to run firstboot manually. This update adds automatic execution. Now, the firstboot utility runs automatically when the root user logs in to the system for the first time with a capable terminal. (BZ#463564)
All firstboot users are advised to upgrade to these updated packages, which fix these bugs and adds this enhancement.

1.64. freeradius

1.64.1. RHBA-2011:0610: bug fix and enhancement update

Updated freeradius packages that fix two bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.
FreeRADIUS is an open source RADIUS server which allows RADIUS clients to perform authentication against the RADIUS server. The RADIUS server may optionally perform accounting of it's operations via the RADIUS protocol.
This update fixes the following bugs:
  • The FreeRADIUS packages have been upgraded to upstream version 2.1.10, which provides a number of bug fixes over the previous version. (BZ#644100)
  • Previously, the FreeRADIUS server failed to start when the rlm_perl or rlm_python modules were used due to unresolved symbols encountered by the dynamic loader. This update uses the dynamic loader option which must be explicitly turned on via lt_dladvise to allow loaded modules to globally export their symbols. Now, rlm_perl and rlm_python FreeRADIUS modules are successfully loaded and the FreeRADIUS server successfully starts in this configuration.(BZ#689045)
This update also adds the following enhancement:
  • This update makes the radtest script available for testing with IPv6. (BZ#599528)
All FreeRADIUS users are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

1.65. freetype

1.65.1. RHSA-2010:0864: Important security update

Updated freetype packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide the FreeType 2 font engine.
It was found that the FreeType font rendering engine improperly validated certain position values when processing input streams. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2805, CVE-2010-3311)
A stack-based buffer overflow flaw was found in the way the FreeType font rendering engine processed some PostScript Type 1 fonts. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2808)
An array index error was found in the way the FreeType font rendering engine processed certain PostScript Type 42 font files. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-2806)
Note: All of the issues in this erratum only affect the FreeType 2 font engine.
Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

1.65.2. RHSA-2010:0889: Important security update

Updated freetype packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 and 6 provide only the FreeType 2 font engine.
A heap-based buffer overflow flaw was found in the way the FreeType font rendering engine processed certain TrueType GX fonts. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2010-3855)
Note: This issue only affects the FreeType 2 font engine.
Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The X server must be restarted (log out, then log back in) for this update to take effect.

1.66. gcc

1.66.1. RHBA-2011:0663: bug fix update

A gcc update that resolves several compiler bugs is now available.
The gcc packages include C, C++, Java, Fortran, Objective C, Objective C++ and Ada 95 GNU compilers, along with related support libraries.
This update applies the following bug fixes:
  • These updated packages provide support for the "-mcmodel=medium" and "-mcmodel=large" options on the 64-bit PowerPC architecture. These new options provide the ability to extend the TOC addressing space up to 2GB. (BZ#630166)
  • gcc now has the ability to emit pre-fetch instructions for "memcmp", "memcpy" and "memset" in-line expansions when optimizing for IBM System z10 CPUs. (BZ#632366)
  • Previously, leaf functions that accessed TLS variables in the global or local dynamic model were not generating a large enough stack frame on PowerPC 64-bit. In this updated package, the generated stack frame is now larger than 112 bytes, resolving this issue. (BZ#624889)
  • Previously a regression in the gfortran compiler was causing the "-M" option to not be recognized. In these updated packages the "-M" option is now recognized and functions as expected. (BZ#675132)
  • Previously, the optimizations performed when calculating induction variables during the induction variable optimization (ivopts) pass were not as efficient as previous releases. In these updated packages, the optimizations performed during the the induction variable optimization (ivopts) pass is improved. (BZ#592502)
  • Previously, if a Java application built with gcj attempted to submit a print job to a print queue that was disabled, the process would enter a busy loop. This update fixes this issue by first checking if the print queue is null before attempting to send it a print job. (BZ#618258)
  • Previously, using "always_inline" on a function when compiling with "-g" without any "-O" options would cause the compiler to insert debugging annotations in unexpected locations. Consequently, the unexpected annotations caused the compiler to crash with an internal error. In these updated packages, the compiler is modified to properly handle attributes which change optimization levels, such as always_inline, properly. (BZ#659582)
  • This update provides code optimizations for the IBM System z architecture. (BZ#632370)
  • The mask operand for the AVX mask load/store is fixed. (BZ#635015)
In addition, the following enhancements are provided by this update
  • IBM z196 new instruction support and optimizations
  • IBM z10 prefetch instruction support and optimizations
All users of gcc are advised to upgrade to these updated packages which address these issues.

1.67. gdb

1.67.1. RHBA-2011:0145: bug fix update

Updated gdb packages that resolve an issue are now available.
The GNU debugger, gdb, allows the debugging of programs written in C, C++, and other languages by executing them in a controlled fashion and then printing out their data.
These updated gdb packages fix the following bug:
  • After you issued the command 'info program', GDB could have terminated unexpectedly, because a change of the shared library list corrupted the data in the internal GDB structure 'bpstat'. With this update, the 'bpstat' structure contains after a change in the shared library list the correct data and the command 'info program' works as expected. (BZ#662218)
All users of gdb are advised to upgrade to these updated packages, which resolve this issue.

1.67.2. RHBA-2011:0638: bug fix and enhancement update

Updated gdb packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The GNU debugger, gdb, is a debugger for programs written in C, C++, and other languages.
This update fixes these bugs:
  • GDB crashed when reading a kernel core dump file because the value of temporary current inferior process was set to minus_one_ptid (all processes). The value is now set to null_ptid (no processes) and GDB displays the vmcore file. (BZ#611435)
  • When the gcore utility created a core file for an executable compiled with the "-Wl,-z,relro" parameter, GDB was unable to open it. This occurred because the file did not contain the list of shared libraries. Such core files now contain the shared library list and can be opened. (BZ#625239)
  • GDB Python's pretty-printing feature provides an easily-readable view on complex C++ STL data structures. GDB crashed when displaying such structures. This occurred when the pretty printer threw a Python exception and GDB crashed due to a NULL pointer dereference. GDB now displays the easily-readable view of any C++ STL data structure correctly. (BZ#629236)
  • GDB aborted unexpectedly if you set breakpoints on GNU-IFUNC functions and started the debugged program because the breakpoints could not resolve the target functions of the GNU-IFUNC functions at program startup. Breakpoints on GNU-IFUNC functions are now resolved when the program calls the target function. (BZ#632259)
  • With GDB, you can modify VSX registers on PowerPC platforms. Changing some VSX registers corrupted other VSX registers. GDB now sets VSX registers independently. (BZ#636298)
  • GDB aborted unexpectedly when an inferior shared library list changed during an inferior function call. This occurred because GDB reset all breakpoints including the temporary breakpoint, which was created by the call, and attempted to delete the breakpoint again after the call finished. The temporary breakpoint now remains valid during the entire inferior function call. (BZ#639645)
  • GDB could have hung when debugging multithreaded programs with the setuid() function because the siginfo_t information associated with a signal number got lost. GDB now no longer resubmits or reorders signals and the siginfo_t value is preserved. (BZ#639647)
  • GDB terminated unexpectedly after user run the "info program" command because a change of the shared library list corrupted the data in the internal GDB structure "bpstat". The structure now contains correct data even after a change in the shared library list and "info program" works as expected. (BZ#661773)
  • Test suite file break-interp.exp reported for PowerPC platforms several FAIL results. A number of fixes have been applied to address these issues and the test suite for PowerPC now runs successfully. (BZ#663449)
  • GDB crashed when attempting to access dynamic types, such as variable length arrays, using the GDB/MI interface. GDB now no longer crashes under these circumstances. (BZ#682891)
  • On the i686 architecture, the awatch and rwatch commands printed an error when entered before the program-to-be-debugged started. GDB now by default debugs on the native architecture and the commands can be used before the program-to-be-debugged starts. (BZ#688788)
This update adds these enhancements:
  • Debugged programs may use C++ templates. C++ templates provide template symbols for instantiation of classes and functions. GDB debugged the template instances but the template symbols were not accessible. GDB now displays the template symbols while debugging the template instances. (BZ#562758)
  • Fortran supports array slicing. GDB could not slice multidimensional arrays. GDB now supports slicing of such arrays. (BZ#609782)
  • The gdb package has been upgraded to upstream version 7.2, which provides a number of bug fixes and enhancements over the previous version. (BZ#649030)
  • GDB did not display pthread_t for threads found in the core. GDB now displays pthread_t for the threads. (BZ#673696)
Users are advised to upgrade to these packages, which resolve the bugs and add the enhancements.

1.68. gdm

1.68.1. RHSA-2011:0395: Moderate security update

Updated gdm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The GNOME Display Manager (GDM) provides the graphical login screen, shown shortly after boot up, log out, and when user-switching.
A race condition flaw was found in the way GDM handled the cache directories used to store users' dmrc and face icon files. A local attacker could use this flaw to trick GDM into changing the ownership of an arbitrary file via a symbolic link attack, allowing them to escalate their privileges. (CVE-2011-0727)
Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting this issue.
All users should upgrade to these updated packages, which contain a backported patch to correct this issue. GDM must be restarted for this update to take effect. Rebooting achieves this, but changing the runlevel from 5 to 3 and back to 5 also restarts GDM.

1.69. ghostscript

1.69.1. RHBA-2011:0527: bug fix update

Updated ghostscript packages that fix various bugs are now available for Red Hat Enterprise Linux 6.
The Ghostscript suite provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language), and an interpreter for PDF files. Ghostscript translates PostScript code into many common, bitmapped formats, like those understood by most printers and displays. This enables users to display PostScript files and print them on non-PostScript printers.
This update fixes the following bugs:
  • Previously, including a large JBIG2 compressed image in the PDF input file could cause the pdf2ps conversion utility to terminate unexpectedly with a segmentation fault. This was caused by the fact that the result of the "jbig2_image_new" function call was not always checked properly. This error has been fixed, and the inclusion of JBIG2 images no longer causes pdf2ps to crash. (BZ#621118)
  • Due to incorrect object management, Ghostscript could attempt to read from uninitialized memory, which could lead to a segmentation fault. This update applies a backported patch that addresses this issue, and Ghostscript no longer crashes. (BZ#629562)
  • The Fontmap.local file installed with the ghostscript package allows a system administrator to override font substitutions. However, previous versions of the Ghostscript suite did not use this file at all. This error has been fixed, and the file is now used as expected. (BZ#629941)
  • Previously, using the ps2pdf utility to convert a PostScript file to the PDF format caused the resulting document to be created without working hyperlinks. This update applies an upstream patch that resolves this issue, and ps2pdf now crates PDF files with correct hyperlinks. (BZ#675692)
All users of ghostscript are advised to upgrade to these updated packages, which fix these bugs.

1.70. git

1.70.1. RHSA-2010:1003: Moderate security update

Updated git packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Git is a fast, scalable, distributed revision control system.
A cross-site scripting (XSS) flaw was found in gitweb, a simple web interface for Git repositories. A remote attacker could perform an XSS attack against victims by tricking them into visiting a specially-crafted gitweb URL. (CVE-2010-3906)
All gitweb users should upgrade to these updated packages, which contain a backported patch to correct this issue.

1.71. glib2

1.71.1. RHBA-2011:0535: bug fix update

Updated glib2 packages that fix one bug are now available for Red Hat Enterprise Linux 6.
GLib is a low-level core library that forms the basis for projects such as GTK+ and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system.
This update fixes the following bug:
  • Previously, snapshots from the Network File System (NFS) mounted home directories located on Network Appliance (NetApp) filers were treated as real mounts and were displayed on the desktop. Due to this behavior, users could not hide or unmount these items. By default, the GNOME desktop treated all mounts under user home directories as custom and put their icons on the desktop. This update follows common practice and hides mounts with path elements that start with a dot. (BZ#648498)
All users are advised to upgrade to these updated packages, which fix this bug.

1.72. glibc

1.72.1. RHSA-2010:0872: Important security and bug fix update

Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.
It was discovered that the glibc dynamic linker/loader did not handle the $ORIGIN dynamic string token set in the LD_AUDIT environment variable securely. A local attacker with write access to a file system containing setuid or setgid binaries could use this flaw to escalate their privileges. (CVE-2010-3847)
It was discovered that the glibc dynamic linker/loader did not perform sufficient safety checks when loading dynamic shared objects (DSOs) to provide callbacks for its auditing API during the execution of privileged programs. A local attacker could use this flaw to escalate their privileges via a carefully-chosen system DSO library containing unsafe constructors. (CVE-2010-3856)
Red Hat would like to thank Tavis Ormandy for reporting the CVE-2010-3847 issue, and Ben Hawkes and Tavis Ormandy for reporting the CVE-2010-3856 issue.
This update also fixes the following bugs:
  • Previously, the generic implementation of the strstr() and memmem() functions did not handle certain periodic patterns correctly and could find a false positive match. This error has been fixed, and both functions now work as expected. (BZ#643341)
  • The "TCB_ALIGNMENT" value has been increased to 32 bytes to prevent applications from crashing during symbol resolution on 64-bit systems with support for Intel AVX vector registers. (BZ#643343)
All users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

1.72.2. RHSA-2011:0413: Important security update

Updated glibc packages that fix three security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.
The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536)
It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071)
It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095)
All users should upgrade to these updated packages, which contain backported patches to correct these issues.

1.72.3. RHBA-2011:0321: bug fix update

Updated glibc packages that fix a bug in the dynamic linker are now available for Red Hat Enterprise Linux 6.
The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.
This update fixes the following bug:
  • Due to an error in glibc libraries, a race condition could occur when traversing a list of currently loaded shared libraries, causing an application to terminate with an error. This error has been fixed, the race condition no longer occurs, and the list of shared libraries can now be traversed as expected. (BZ#661396)
All users are advised to upgrade to these updated packages, which resolve this issue.

1.72.4. RHBA-2011:0584: bug fix and enhancement update

Updated glibc packages that fix numerous bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.
Bug fixes:
BZ#646954
Due to an error in glibc libraries, a race condition could occur when traversing a list of currently loaded shared libraries, causing an application to terminate with an error. This error has been fixed, the race condition no longer occurs, and the list of shared libraries can now be traversed as expected.
BZ#642584
On 64-bit x86 systems with support for AVX vector registers, an insufficient alignment of the thread descriptor could cause an application to crash during symbol resolution. With this update, the "TCB_ALIGNMENT" value has been increased to 32 bytes, and applications no longer crash.
BZ#641128
Previously, the generic implementation of the strstr() and memmem() functions did not handle certain periodic patterns correctly and could find a false positive match. This error has been fixed, and both functions now work as expected.
BZ#656530
The long double square root function, sqrtl, sometimes returned an incorrect result if the relative magnitude difference between the high and low halves of the long double exceeded a certain number. This occurred because one of the variables used in the calculation was an unsigned integer. The integer is now signed and the function works correctly.
BZ#623187
The futex(FUTEX_WAKE_OP) method did not default to futex(FUTEX_WAKE) when FUTEX_WAKE_OP was not supported by the kernel. This resulted in the method always failing on these systems. The code change in glibc pthread_cond_signal() that caused this issue has now been corrected.
BZ#661982
The memmove, wmemmove and wmemset operations contained incorrect "__restrict" qualifiers, even though their arguments could overlap. This issue has now been corrected.
BZ#656014
The name service cache daemon (nscd) cached the results of lookups for DNS records even when the DNS records had a time-to-live of 0. nscd now respects DNS time-to-live values, and does not cache the results in this situation.
BZ#653905
Attempting to build the glibc RPM failed when %_enable_debug_packages was either not set, or set to 0. This has been corrected so that debug packages need not be set or enabled in order to build the glibc RPM.
BZ#652661
An uninitialized variable prevented glibc from compiling with the G++ compiler when "sys/timex.h" was included. This has been corrected.
BZ#647448
strchr did not handle its second parameter correctly when %rdi was aligned to a 16-byte boundary and glibc was enabled for multiple architectures on AMD64 or Intel 64 systems with CPUs that supported Supplemental Streaming SIMD Extension (SSE) 4.2. The method would therefore output incorrect results. This has been corrected, and strchr now gives the expected output.
BZ#615701
glibc did not load nosegneg libraries in a 32-bit Xen domain U environment when hwcap 1 nosegneg was set in /etc/ld.so.conf.d/nosegneg.conf, causing the incorrect library to be used. This has been corrected so that the nosegneg libraries are loaded.
BZ#692177
Previously, the sysconf(_SC_*CACHE) method returned 0 for all caches on systems with Intel Xeon processors. This occurred because glibc used cpuid leaf 2 rather than cpuid leaf 4. This update uses cpuid leaf 4 where possible, resolving this issue.
BZ#689471
The strncmp method failed with a segmentation fault when used with Supplemental Streaming SIMD Extension 4 (SSE4). Several checks have been implemented to prevent this.
Enhancements:
BZ#601686
Several aspects of glibc code have been optimized for Supplemental Streaming SIMD Extension (SSE), including memcpy(), strcasecmp(), strnlen(), strcasestr() and strncasestr().
BZ#615090
Details about the MALLOC_PERTURB_ (M_PERTURB) operation, which can be used to debug the use of uninitialized or freed heap memory, have been added to the documentation.
BZ#676076
Support for forthcoming AMD processors has been added to glibc's memset operation.
All users of glibc are advised to upgrade to these updated packages, which resolve these issues.

1.73. gnome-panel

1.73.1. RHBA-2011:0710: bug fix and enhancement update

Updated gnome-panel and libwnck packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The GNOME panel provides the window list, workspace switcher, menus, and other features for the GNOME desktop. libwnck allows applications to monitor information about open windows, workspaces, their names/icons, and so forth.
This update fixes the following bugs:
  • Previously, when a user connected two monitors to a computer and set the GNOME Panel to show hide buttons, the panel did not hide but moved to the adjacent monitor instead. This bug has been fixed, moving the panel to the adjacent monitor no longer takes place. (BZ#607665)
  • Previously, there was the untranslated text label "Top Panel" in the GNOME Panel's "Add to Panel" dialog. The problem applied to all non-English locales. The problem has been resolved so that the untranslated text label does not appear anymore in the "Add to Panel" dialog. (BZ#633853)
  • Previously, there was a conflicting accelerator key in the GNOME Panel's Date/Time context menu under the kn_IN locale. The fix for this bug has been provided so that there is no more a conflicting accelerator key in the Date/Time context menu. (BZ#633870)
In addition, the following enhancements have been made:
  • When windows were grouped by the GNOME Panel in the taskbar, they were grouped in an alphabetical order. Such behavior presented a problem when window title changed. This release introduces an option to disable grouping window alphabetically. The fix to enable the option has been applied both in the gnome-panel and the libwnck package. (BZ#509061, BZ#673231)
  • Previously, when an external monitor was connected to a computer, a user was able to move a panel between monitors by pressing the Alt key and dragging a blank area of the panel. This update introduces an enhancement in that the user can now change the settings with regard to moving the panel between monitors in the GNOME Panel "Properties" dialog. (BZ#585312)
All users requiring gnome-panel and libwnck should upgrade to these updated packages, which resolve these issues and add these enhancements.

1.74. gnome-power-manager

1.74.1. RHBA-2011:0722: bug fix update

Updated gnome-power-manager packages that fix several bugs are now available.
GNOME Power Manager uses the information and facilities provided by HAL to display icons and handle user callbacks in an interactive GNOME session.
These updated gnome-power-manager packages provide fixes for the following bugs:
  • Previously, the Help page for GNOME Power Manager was not displayed when users pressed F1 or selected Help from the menu bar. This has been corrected and the Help page now appears as expected. (BZ#581525)
  • The "do nothing" option, which allowed users to work on external monitors even when their laptop lid was closed, was removed. This prevented users from using external monitors while their laptop was closed. The "do nothing" option has been reinstated to allow this. (BZ#623674)
  • A bug in the docbook2man tool caused the GNOME Power Manager man page (man gnome-power-manager) to appear incorrectly. The man page has been manually corrected while this bug is in effect. (BZ#624422)
  • When an attempt to hibernate failed, an alert was displayed prompting users to check a help file. However, there was no link to the help file, which caused confusion. The alert no longer refers to the help file. (BZ#640296)
All users of GNOME Power Manager are advised to upgrade to these updated packages, which resolve these issues.

1.75. gnome-terminal

1.75.1. RHBA-2011:0700: bug fix update

Updated gnome-terminal packages that fix one bug are now available for Red Hat Enterprise Linux 6.
Gnome-terminal is a terminal emulator for GNOME. It supports translucent backgrounds, opening multiple terminals in a single window (tabs) and clickable URLs.
This update fixes the following bug:
  • Changes made to check boxes in the search dialog were not reflected in the terminal engine (vte). This led to confusion and wrong functionality. Problem has been fixed and users should get expected behaviour.(BZ#669113)
All gnome-terminal users are advised to upgrade to these updated packages, which resolve these issues.

1.76. gpxe

1.76.1. RHBA-2011:0415: bug fix update

Updated gpxe packages that fix one bug are now available for Red Hat Enterprise Linux 6.
The gpxe packages provide an open source Preboot Execution Environment (PXE) implementation and bootloader. gPXE also supports additional protocols such as DNS, HTTP, iSCSI and ATA over Ethernet.
This update fixes the following bug:
  • Previously, the virtIO gPXE driver padded all packets to maximum length. This could confuse some gateways because the Ethernet standard is to pad only packets of up to 64 bytes in length. Due to this issue, virtual machines with a virtIO NIC (network interface card) failed to connect to the PXE server behind a gateway. Subsequently, the PXE boot failed. This update pads only packets of up to 64 bytes in length. Now, virtual machines with a virtIO NIC connect to the same PXE server without further problems. (BZ#680148)
All gPXE users are advised to upgrade to these updated packages which fix this bug.

1.76.2. RHBA-2011:0694: bug fix update

Updated gpxe packages that fix two bugs are now available for Red Hat Enterprise Linux 6.
The gpxe packages provide an open source Preboot Execution Environment (PXE) implementation and bootloader. gPXE also supports additional protocols such as DNS, HTTP, iSCSI and ATA over Ethernet.
This update fixes the following bugs:
  • Devices that did not allow interrupts or required polling were not supported by gPXE UNDI code. This meant that booting did not work when using gPXE images on bare metal with some NICs, such as Emulex 10g. This patch allows the gPXE UNDI code to use polling for underlying devices that do not support interrupts. As a result it is now possible to use gPXE images to boot bare metal hosts using UNDI where it was not possible in some cases. (BZ#661840)
  • Virtual Machines (VM) with virtIO NIC could not access the PXE server, reaching a time out. This was because even though the VM could get an IP address from the DHCP server, it could not reach its own default gateway. The ARP requests that the VM sends were too large and thus not valid, so the default gateway did not answer those ARP requests. A patch has been added that sets the size of the transmitted Ethernet frame to header + data length, allowing the VM to boot via PXE. (BZ#672529)
All gPXE users are advised to upgrade to these updated packages, which fix these bugs.

1.77. grub

1.77.1. RHEA-2011:0633: enhancement update

An updated grub package that adds two enhancements is now available for Red Hat Enterprise Linux 6.
The GRUB utility is responsible for booting the operating system kernel.
This update adds the following enhancements:
  • Prior to this update, GRUB only supported the MD5 password encryption. This update introduces support for the SHA-2 cryptographic algorithms, allowing users to encrypt passwords using SHA-256 and SHA-512 hash functions as well. (BZ#553741)
  • GRUB has been updated to allow booting from disk drives with 4KB sector size on UEFI systems. (BZ#654869)
All users of grub are advised to upgrade to this updated package, which adds these enhancements.

1.78. gtk2

1.78.1. RHBA-2011:0693: bug fix update

Updated gtk2 packages that fix two file chooser bugs and two translation problems are now available for Red Hat Enterprise Linux 6.
GTK+ is a multi-platform toolkit for creating graphical user interfaces.
These updated packages fix the following bugs:
  • In the "Open Files" dialog box, the file selected by default failed to be opened upon hitting Enter if the "Location" field was displayed. Users had to select the file manually to actually open it. This update provides a fix to address this issue and the file selected by default now opens correctly. (BZ#647922)
  • The "Open Files" dialog box failed to show contents of the directory selected by default upon hitting Enter if the "Location" field was displayed. Users had to select the directory manually to actually show its contents. This update provides a fix for this issue and the directory selected by default now shows its contents correctly. (BZ#647923)
  • There was a typo in the Marathi (mr_IN) and Telugu (te_IN) translations. Erroneous "calender:MY" string was part of those translations. This update provides corrected translations. (BZ#625440)
  • There was an inconsistency in the Guarati (gu_IN) translation. In ibus's Language Selection Tab, titles for "Up" and "Down" buttons and help labels at the bottom of the dialog box did not match. This update provides an updated translation. (BZ#636476)
Users should upgrade to these updated packages, which resolve these issues.

1.79. gvfs

1.79.1. RHBA-2011:0536: bug fix and enhancement update

Updated gvfs packages that fix multiple bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.
GVFS is the GNOME desktop's virtual file system layer, which allows users to easily access local and remote data, including via the FTP, SFTP, WebDAV, CIFS and SMB protocols, among others. GVFS integrates with the GIO (GNOME I/O) abstraction layer.
This update fixes the following bugs:
  • A flaw in the GVFS client code prevented D-Bus communications from being parsed correctly. Due to this problem, Nautilus became unresponsive when the user attempted to view Trash if a folder with an attached emblem was moved to Trash. This update corrects an error in the enumeration code which resolves this problem. Now, Nautilus no longer becomes unresponsive in such cases. (BZ#616145)
  • Previously, an unused file descriptor was not closed after a fork. Due to this behavior, SELinux prevented /usr/bin/ssh access to the leaked /dev/ptmx file descriptor. This update closes the leaked file descriptor. Now, SELinux alerts no longer appear. (BZ#616838)
  • Previously, the gnome-disk-utility packages did not reflect current version requirements. Due to this lack, potential problems could arise with custom compiled packages. This update requires the correct version of gnome-disk-utility packages. (BZ#636540)
  • Previously, the gvfsd-archive command was unexpectedly aborted when the user attempted to mount an archive file a second time. This update changes the way the gvfsd-archive backend is finalized. Now, gvfsd-archive no longer aborts when the same archive files are mounted for the second time. (BZ#645630)
  • Running the "gvfs-mkdir --help" command caused "--delete-files" to appear instead of "--create-directories". This update fixes the gvfs-mkdir command's help output so that the correct options are displayed. (BZ#667367)
This update also adds the following enhancement:
  • Previously, snapshots from the Network File System (NFS) mounted home directories located on Network Appliance (NetApp) filers were treated as real mounts and were displayed on the desktop. This behavior could cause confusion. This update checks and hides mounts with a path element starting with a dot. With this update, these mounts are hidden. Now, snapshot directories are no longer shown in the GUI. To apply this enhancement, the updated glib2 packages must be installed as well. (BZ#624795)
Users of GVFS are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

1.80. hal

1.80.1. RHBA-2011:0724: bug fix update

An updated hal package that fixes two bugs is now available for Red Hat Enterprise Linux 6.
HAL is daemon for collecting and maintaining information from several sources about the hardware on a system.
  • Previously, the init script for hald did not parse a config file in /etc/sysconfig. This meant that the only way to pass extra parameters to the hald was to start them manually without the init script, or to modify the line that launches hald in the init script itself. This update changes the startup script to parse a config file in /etc/sysconfig for extra configuration parameters. (BZ#576048)
  • When checking hal-device on a device that did not exist, an error in dbus/hal communication was displayed. In this update, hal no longer tries to close shared DBus connections, and therefore avoids printing a warning. (BZ#676618)
Users are advised to upgrade to this updated hal package, which resolves these issues.

1.81. hivex

1.81.1. RHBA-2011:0588: bug fix and enhancement update

Updated hivex packages that fix a bug and add an enhancement are now available for Red Hat Linux 6.
Hive files are undocumented binary blobs that Windows uses to store the Windows Registry on the disk. Hivex is a library that can read and write to these files.
These updated hivex packages provide the following enhancement:
  • The hivex package was updated to the upstream version 1.2.3. This enhancement provides several stability improvements. (BZ#642631)
In addition, these updated hivex packages fix the following bug:
  • Due to a problem with the Perl hivex bindings in the spec file, rebuilding of source packages could have failed if compiled from the source RPM. With this update, the issue no longer occurs. (BZ#657017)
All hivex users are advised to upgrade to these updated hivex packages, which resolve this issue and add this enhancement.

1.82. hplip

1.82.1. RHSA-2011:0154: Moderate security update

Updated hplip packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Hewlett-Packard Linux Imaging and Printing (HPLIP) provides drivers for Hewlett-Packard printers and multifunction peripherals, and tools for installing, using, and configuring them.
A flaw was found in the way certain HPLIP tools discovered devices using the SNMP protocol. If a user ran certain HPLIP tools that search for supported devices using SNMP, and a malicious user is able to send specially-crafted SNMP responses, it could cause those HPLIP tools to crash or, possibly, execute arbitrary code with the privileges of the user running them. (CVE-2010-4267)
Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting this issue.
Users of hplip should upgrade to these updated packages, which contain a backported patch to correct this issue.

1.82.2. RHBA-2011:0574: bug fix update

Updated hplip packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP) which provides drivers for Hewlett-Packard printers and multi-function peripherals.
This update fixes the following bugs:
  • Previously, certain Python scripts used the interpreter line "#!/usr/bin/env python". Due to this issue, these scripts used an incorrect version during the execution. With this update, the interpreter line is changed and uses the path /usr/bin/python. (BZ#608003)
  • Previously, the license text was missing. This update adds the license text to the hplip-common sub-package. (BZ#613707)
  • Previously, the hp-toolbox utility failed to add new printers due to incorrect handling of CUPS authentication in the cupsext Python extension. This update corrects the handling. Now, new printers can be added successfully. (BZ#616569)
  • Previously, the CUPS Web Interface button, displayed in hp-toolbox when no connected devices were shown, led to an incorrect URL. This update corrects this URL so that there is no error message shown. (BZ#633899)
  • This update upgrades HPLIP to the current version to allow support for a wider range of HP printers. (BZ#652255)
All HPLIP users are advised to upgrade to these updated packages, which fix these bugs.

1.83. httpd

1.83.1. RHBA-2011:0706: bug fix update

Updated httpd packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
The Apache HTTP Server is a popular web server.
This update fixes the following bugs:
  • Due to a bug in the filter initialization process, filters configured using the mod_filter module were not handled correctly if a "sub-request" took place. For example, using the "FilterChain" directive to configure the "DEFLATE" compression filter with a Server-Side-Include page could result in pages which were only partially compressed. With this update, filters used with mod_filter operate correctly. (BZ#631849)
  • If arguments passed to the ab benchmarking program triggered a memory allocation failure, ab could terminate unexpectedly with a segmentation fault. With this update, the memory allocation failure is now trapped earlier, and the program exits gracefully with an error message. (BZ#645846)
  • * When executing the "service httpd stop" command, a 10-seconds timeout is used before terminating the httpd parent process in case of error. If this timeout was insufficient, resources did not allow the parent process to terminate cleanly and could be leaked. This update introduces the "STOP_TIMEOUT" environment variable, which can be used in the /etc/sysconfig/httpd configuration file to change the timeout. This can be used to allow a longer delay and fix resource leaks if the httpd parent is slow to terminate. (BZ#657480)
  • When configuring the httpd service, using a mod_ldap directive in the "VirtualHost" container caused the HTTP server to stop caching requests to a directory server. This update applies a patch that corrects this error, and the use of mod_ldap directives in the "VirtualHost" context no longer prevents the httpd service from caching LDAP requests. (BZ#676635)
  • Prior to this update, an attempt to use configuration with multiple virtual hosts sharing the same ID and private key file could prevent the httpd service from starting with an error message written to the error_log file. With this update, the underlying source code has been modified to address this issue, and the httpd service now starts as expected. (BZ#676831)
  • When using the prefork Multi-Processing Module (MPM), children processes with persistent connections (that is, with the "KeepAlive" directive set to "On") kept processing new requests even when a graceful restart had been issued. This update applies a patch that corrects this error, and children processes with the persistent connections no longer process new requests when a graceful restart is requested. (BZ#679476)
  • Previously, an attempt to start the httpd service with the mod_ssl module in FIPS mode failed. With this update, an upstream patch has been applied to implement support for the FIPS mode in the mod_ssl module, and httpd no longer fails to start. (BZ#684144)
All users of httpd are advised to upgrade to these updated packages, which fix these bugs.

1.84. hwdata

1.84.1. RHEA-2011:0701: enhancement update

An updated hwdata package that adds various enhancements is now available for Red Hat Enterprise Linux 6.1.
The hwdata package contains tools for accessing and displaying hardware identification and configuration data.
This update adds the following enhancements:
  • The pci.ids database has been updated to include the information about the MegaRAID SAS Thunderbolt device. (BZ#662673)
  • The pci.ids database has been updated to include the information about the Matrox IMMv2 management controller and integrated MatroxG200eR video controller. (BZ#633837)
Users of hwdata are advised to upgrade to this updated package, which adds these enhancements.

1.85. ibus

1.85.1. RHBA-2011:0518: bug fix update

Updated ibus packages that fix various bugs are now available.
The IBus (Intelligent Input Bus for Linux OS) package is an input method platform.
These updated packages provide fixes for the following bugs:
  • ibus-x11 displayed at the incorrect window position and did not follow xterm for X11 applications in big endian 64-bit machines such as ppc64 and s390x. This was caused by the call_data->ic_attr[i].value being able to support only CARD32 data (32-bit) while the problematic machines were 64-bit machines. The code was changed to support 64-bit machines, thus ibus now works as expected. (BZ#651915)
  • ibus displayed incorrect text for the "up" and "down" buttons for the Kannada translation. The translated text was corrected, thus now the buttons display the correct translated text. (BZ#633330)
  • ibus displayed inconsistent translations on "up" and "down" buttons compared to text at the bottom of the window referring to "up" and "down" buttons for the Gujarati translation. Translation was amended for consistency and the button text and descriptive text at the bottom of the window are now the same. (BZ#635541)
Users of ppc64, s390x machines, Gujarati, and Kannada, are advised to upgrade to these updated packages, which resolve these issues.

1.86. ibus-chewing

1.86.1. RHBA-2011:0737: bug fix update

An updated ibus-chewing package that fixes a bug is now available for Red Hat Enterprise Linux 6.
IBus-chewing is an IBus front-end of Chewing, an intelligent Chinese input method for Zhuyin (BoPoMoFo) users.
This updated ibus-chewing package fixes the following bug:
  • Previously, the IBus-chewing did not specify the rank parameter for the zh-TW locale in the input engine description file. This caused the IBus tool not to provide any default input method engine for the locale. This update adds the input method engines to the chewing.xml file and ibus-chewing is selected as the default input method for zh_TW users. (BZ#627794)
All users of ibus-chewing are advised to upgrade to this updated package, which resolves this issue.

1.87. ibus-hangul

1.87.1. RHBA-2011:0538: bug fix update

An updated ibus-hangul package that fixes one bug is now available for Red Hat Enterprise Linux 6.
The ibus-hangul package is a Korean language input engine platform for the IBus input method (IM).
This update fixes the following bug:
  • Previously, preedit was not restored when the candidate window was restored while focusing in. Due to this behavior, the candidate window remained open after focus changes. This update resolves this issue with a change in the code. Now, the candidate window is hidden as expected. (BZ#610075)
Users who require Korean language input are advised to upgrade to this updated package, which fixes this bug.

1.88. ibus-m17n

1.88.1. RHBA-2011:0539: bug fix update

An updated ibus-m17n package that resolves several bugs is now available.
The ibus-m17n is a multilingual input engine for the IBus input method platform.
This updated package provides fixes for the following bugs:
  • When a new user and language were selected during login, ibus-m17n did not load all input methods provided for that language; only one input method was loaded and marked for use as the default input method. The user had to manually search for and add any other input methods that they wanted to use. All input methods for a given language are now loaded upon login, and can be accessed from the ibus-m17n Preferences tab. (BZ#641243)
  • ibus-m17n did not recognize the AltGr (ISO Level 3 Shift) key as a virtual modifier key, making it impossible to input the Rupee Symbol (U+20B9) with an Indic Keyboard. The AltGr key is now recognized by ibus-m17n. (BZ#652201)
All users of ibus-m17n are advised to upgrade to this updated package, which resolves these issues.

1.89. ibutils

1.89.1. RHBA-2011:0814: bug fix update

Updated ibutils packages that resolve an issue are now available.
The ibutils package provides InfiniBand network and path diagnostics.
These updated ibutils packages fix the following bug:
  • Previous releases of the ibutils package were not built for the PowerPC 64-bit architecture. This has been fixed and the ibutils package is now built for the PowerPC 64-bit architecture as well. (BZ#695204)
All users of ibutils are advised to upgrade to these updated packages, which resolve this issue.

1.90. im-chooser

1.90.1. RHBA-2011:0666: bug fix update

An updated im-chooser package that fixes a bug is now available.
im-chooser is a GUI configuration tool to choose the Input Method to be used or disable Input Method usage on the desktop.
This updated package addresses the following issue:
  • The im-chooser window was not re-sizable. This caused the title bar text to run into the right-hand close box in some locales. With this update, the im-chooser window is now re-sizable, ensuring the title bar text displays properly no matter the current locale. (BZ#634146)
All im-chooser users are advised to upgrade to this updated package, which resolves this issue.

1.91. imsettings

1.91.1. RHBA-2011:0521: bug fix update

Updated imsettings packages that fix a bug are now available for Red Hat Enterprise Linux 6.
The imsettings packages provide a library and command line tools to configure and control input-methods settings. Users normally access it through the "im-chooser" GUI tool.
This update fixes the following bug:
  • It was not possible to turn off the GTK XIM input-method module from imsettings. As a consequence, users were unable to enter Unicode characters using the Ctrl+Shift+U shortcut. With this update, the default GTK input-method is restored to gtk-im-context-simple, which allows Unicode input with the shortcut. Now only desktop locales that normally need X locale compose default to using the GTK XIM input-method module. (BZ#616061)
Users of imsettings should upgrade to these updated packages, which fix this bug.

1.92. initscripts

1.92.1. RHBA-2010:1004: bug fix update

An updated initscripts package that fixes a bug is now available for Red Hat Enterprise Linux 6.
The initscripts package contains system scripts to boot your system, change runlevels, activate and deactivate most network interfaces, and shut the system down cleanly.
This update fixes the following bug:
  • Prior to this update, users were unable to set the VLAN tag to 0 when creating a logical network. With this update, the ifup script has been updated to permit this value, and the VLAN identification number can now be set to 0 as expected. (BZ#660327)
All users are advised to upgrade to this updated package, which resolves this issue.

1.92.2. RHBA-2011:0647: bug fix and enhancement update

An enhanced initscripts package that fixes various bugs and provides an enhancement is now available for Red Hat Enterprise Linux 6.
The initscripts package contains system scripts to boot your system, change runlevels, activate and deactivate most network interfaces, and shut the system down cleanly.
Bug fixes:
BZ#558575
Previously, initscripts used quoted strings as values following the =~ operators and the strings were thus matched as literal strings. However, they should be matched as regular expressions. With this update, the quotes were dropped and the strings are matched as regular expressions as expected.
BZ#598850
Previously, some systems failed to access the harware clock on system shutdown. This happened because the shutdown script ran the hwclock tool, which attempted to access the /dev/rtc device even if it did not exist. With this update, initscripts verifies if the /dev/rtc device exists before attempting to run the hwclock tool.
BZ#612934
The ifdown command could have failed to stop an NIC (Network Interface Controller) with a warning that the connection was unknown. This happened because, in some cases, the function, which verifies whether the NIC is managed by NetworkManager, returned an incorrect result. With this update, the function returns the correct result and the ifdown command stops the NIC correctly.
BZ#620461
Previously, if there was a bind mount for the / directory, the system could have failed to remount the root directory as a read-only file system on shutdown. This occurred because the script attempted to remount the defined bind mount instead of the root directory. With this update, the root directory is remounted successfully.
BZ#629257
Previously, a conflict between the sulogin tool and the login shell could have prevented the user from entering the root password in single-user mode. This occurred when switching from runlevel 3 because the login shell was not terminated and attempted to accept the input for the sulogin tool. With this update, the tty.conf and serial.conf files have been modified to have the login shell stopped when changing to runlevels S and the problem no longer occurs.
BZ#632584
On interactive startup, in some locals, the shortcut of the Continue key in the respective language did not work. This occurred due to an error in the local po files. With this update, the po files have been updated and the shortcuts work as expected.
BZ#633984
Previously, the network service did not support configurations with multiple IP addresses with the new syntax (IPADDRESSn/PREFIXn). This caused conflicts between network configurations set with the network service and network configurations set with the NetworkManager tool. With this update, the network service supports the configurations with multiple IP addresses with the new syntax and the conflicts no longer occur.
BZ#634996
Previously, the tty.conf file contained a comment with a typographical mistake ("sepcified"). With this update, the word is spelled correctly ("specified").
BZ#635360
Previously, the system was not able to create a logical network with the VLAN (virtual local area network) tag value 0. With this update, this tag value is allowed.
BZ#637058
Previously, the /etc/sysconfig/clock file did not document where the user can configure whether the hwclock tool should be using the local time or UTC (Coordinated Universal Time). This update adds comments documenting the setting location into the sysconfig.txt file.
BZ#645861
Previously, the /etc/ppp/ipv6-up and /etc/ppp/ip-up.ipv6to4 scripts used the incorrect alias ipv6_exec_ip and failed to bring up the routes. This update modifies the scripts so that they uses the ip command and the routes are now brought up as expected.
BZ#648966
For IPoIB (IP over InfiniBand) child interfaces, the value of the DEVICETYPE variable was calculated incorrectly. This happened because the calculation preserved the period (.) sign in the device name. This could have caused failure of the ifup-ib and ifdown-ib scripts. With this update, DEVICETYPE is resolved correctly.
BZ#654101
On shutdown, the system tried to deactivate the sit IPv6 over IPv4 tunnel device even though it was not active. With this update, the system verifies if the device is active before attempting to shut it down.
BZ#658138
Previously, the kexec-disable script was run when switching to runlevel 1. Because the kdump service is disabled in runlevel 1, the script freed the memory reserved for kdump. After the user changed from runlevel 1 to runlevel 3, which has kdump enabled, the system had set reserved memory size to 0 and kdump failed to start up. With this update, the kexec-disable job is no longer run in runlevel 1.
BZ#660036
Previously, all architectures used identical shmmax (maximum size of a shared memory segment) and shmall (maximum size of the total shared memory) values. However, the values vary depending on the system architecture. This update provides the settings of these values for various architectures.
BZ#664051
Previously, various errors occurred when some devices were inserted (for example, PCI network card). This happened because the biodevname tool assigned them interface names containing hash (#) signs, which were forbidden in such names. With this update, interface names can contain hash (#) signs and the problem no longer occurs.
BZ#667211
Previously, initscripts did not distinguish between the period (.) signs used by the sysctl device, which were delimiting the paths, and the period (.) signs used by VLANs, which were delimiting IDs. This caused that all sysctl calls to the VLAN interfaces failed. With this update, when calling a sysctl device, initscripts substitutes the periods in its name with forward slash (/) signs and the sysctl calls to a VLAN interface succeed.
BZ#669110
Previously, a slave network interface of a bonded interface failed to start if it defined the setting MASTER in double quotes (for example, as "bond0"). With this update, the respective scripts have been adapted to parse the value definition correctly even if double-quoted.
BZ#670154
The ifdown command could have failed to stop a bridge device with a warning that the connection was unknown. This happened because the function, which verified whether the device is managed by NetworkManager, returned an incorrect result. With this update, the function returns a correct result and the ifdown command stops the bridge device correctly.
BZ#674397
Section 8 of the sys-unconfig manual page contained various typographical mistakes. With this update, the man page is updated and the mistakes are corrected.
BZ#676708
Previously, a name of a VLAN interface had to start with the eth prefix followed by digits. If the user provided a name, which did not follow these requirements, the interface could not be started or stopped. With this update, the user can provide a custom name and the interface can be operated correctly.
BZ#696110
Previously, the netfs startup script attempted to run the mdadm tool always when the /etc/mdadm.conf file existed and could have failed if mdadm was not installed. With this update, the script first verifies if the mdadm tool is installed and only then runs its binary.
BZ#682879
The system could have failed to unmount the NFS (Network File System) shares on shutdown. This occurred because the system failed to unmount the NFS shares if they were in use. With this update, the unmouting of NFS shares on shutdown has been updated and the NFS shares are unmounted successfully even if in use.
Enhancement:
BZ#633323
With this update, the IBM System z profile was updated to allow an optimized performance setting for System z.
All users are advised to upgrade to this updated package, which fixes these bugs and provides this enhancement.

1.93. iok

1.93.1. RHBA-2011:0555: bug fix update

An updated iok package that fixes a bug is now available.
iok is an Indic on-screen virtual keyboard that supports the Assamese, Bengali, Gujarati, Hindi, Kannada, Marathi, Malayalam, Punjabi, Oriya, Sindhi, Tamil and Telugu languages. Currently, iok works with Inscript and xkb keymaps for Indian languages, and is able to parse and display non-Inscript keymaps as well.
The file that contains the Oriya translations for iok contained some entries with Latin text appended to the Oriya text. The Latin text caused the key size to increase, thus the keyboard became too large to fit in the display area.
The Latin text has now been removed from the Oriya translation, causing the Oriya keyboard and keys size to conform to other languages. (BZ#636756)
Users are advised to upgrade to this updated iok package, which resolves this issue.

1.94. ipmitool

1.94.1. RHEA-2011:0775: enhancement update

An enhanced ipmitool package is now available for Red Hat Enterprise Linux 6.
The ipmitool package contains a command line utility for interfacing with devices that support the Intelligent Platform Management Interface specification (IPMI). IPMI is an open standard for machine health, inventory, and remote power control.
This updated ipmitool package adds the following enhancements:
  • The update adds the "delloem" command extensions for Dell OEM hardware, which provide support for Peripheral Component Interconnect Express (PCIe) solutions, LCD setting on panel, NIC setting, and power monitoring. This update also provides manual pages for the "delloem" command extensions. (BZ#631649)
  • This update integrates the Linux Multiple Device (MD) driver with ipmitool to indicate SES (SCSI enclosure services) status and drive activities for PCIe SSD based solutions. (BZ#663793)
Users of ipmitool are advised to upgrade to this updated package, which adds these enhancements.

1.95. iproute

1.95.1. RHBA-2011:0757: bug fix and enhancement update

Updated iproute packages that fix several bugs and add one enhancement are now available.
The iproute packages contain networking utilities designed to use the advanced networking capabilities of the Linux kernel.
These updated packages contain the following bug fixes:
  • If the "ip" command was used to create a veth device pair, and the "peer" parameter was specified but the "name" parameter was not used, a segmentation fault occurred. The "name" parameter was an unnecessary requirement for this operation. The need for this parameter has been removed and the command now works as expected. (BZ#636943)
  • The ss man page contained a reference to a nonexistent file. This reference has been updated with the correct file location. (BZ#641918)
  • Previously, attempting to flush a secondary device with "ip secondary" would fail. This issue has now been corrected and secondary devices are flushed as expected. (BZ#678986)
These updated packages also provide the following enhancement:
  • Support for adding, deleting, and modifying security contexts or security labels in ipsec policies has been added to the "ip xfrm" command. (BZ#670295)
All users of iproute are advised to upgrade to these updated packages, which correct these issues and add this enhancement.

1.96. iprutils

1.96.1. RHEA-2011:0643: enhancement update

An updated iprutils package that adds an enhancement is now available for Red Hat Enterprise Linux 6.
The iprutils package provides utilities to manage and configure SCSI devices that are supported by the "ipr" SCSI storage device driver.
This update adds the following enhancement:
  • The iprutils package has been updated to provide support for the 6Gb SAS RAID storage controller on 64-bit IBM POWER7. (BZ#633328)
All users of iprutils are advised to upgrade to this updated package, which adds this enhancement.

1.97. iptables

1.97.1. RHBA-2011:0557: bug fix and enhancement update

Updated iptables packages that fix two bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.
The iptables utility controls the network packet filtering code in the Linux kernel.
This update fixes the following bugs:
  • Previously, ip6tables did not support Portable Transparent Proxy Solution (TPROXY). Due to this lack, the IPv6 transparent proxy support was missing and IPv6 transparency was not available. This update adds this option. (BZ#590186)
  • Previously, the command "service iptables save" did not restore the context for the save file and the save backup file. It also used /tmp for the temporary file. Due to the wrong context of the save and save backup file, there could be an error the next time the save functionality is used. This update restores the context and also saves the temporary files correctly. (BZ#644273)
This update adds also the following enhancement:
  • Previously, iptables did not support auditing. Due to this issue, information for remote address/port, target address/port, protocol, and result (success/fail) could not be recorded as an audit event. This update adds the required audit support. This enhancement depends on the presence of auditing support in the kernel. (BZ#642393)
All iptables users are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

1.98. iputils

1.98.1. RHBA-2011:0546: bug fix update

An updated iputils package that fixes various bugs is now available for Red Hat Enterprise Linux 6.
The iputils package contains basic utilities for monitoring a network, including ping.
This update fixes the following bugs:
  • The ping and ping6 commands were previously not compiled as position independent executables (PIE). In this update, they are now built as PIE executables. (BZ#630022)
  • Previously, the tracepath6 program that is included in the iputils package failed to resolve a target when using the "-n" option and a hostname as the target. The fix for this problem has been provided so that tracepath6 now works as expected. (BZ#671579)
  • Previously, when the rdisc utility that is included in the iputils package was run on a system with an interface having two IP addresses assigned to the interface, an error was issued and rdisc failed to start. The bug has been fixed and the rdisc start failure no longer occurs. (BZ#688332)
All iputils users should upgrade to this updated package, which resolves these issues.

1.99. irqbalance

1.99.1. RHBA-2011:0804: bug fix update

An updated irqbalance package that fixes one bug is now available for Red Hat Enterprise Linux 6.
irqbalance is a daemon that evenly distributes IRQ load across multiple CPUs for enhanced performance.
This update fixes the following bug:
  • irqbalance was not previously built with PIE and RELRO enabled, as they were in Red Hat Enterprise Linux 5. In this update, irqbalance is built as a PIE executable and is using RELRO protection. (BZ#630023)
Users of irqbalance are advised to upgrade to this updated package, which fixes this bug.

1.100. iscsi-initiator-utils

1.100.1. RHBA-2011:0733: bug fix and enhancement update

Updated iscsi-initiator-utils packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The iscsi package provides the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. iSCSI is a protocol for distributed disk access using SCSI commands sent over Internet Protocol networks.
Bug fixes:
BZ#691902
When performing SendTargets discovery, the "iface" NIC binding was ignored. Instead, iscsiadm used the network device determined by the "route" command. SendTargets discovery now occurs through the NIC specified in the "iface" binding information.
BZ#631821
If SendTargets discovery required multiple TEXT commands because of a long target list, iscsiadm did not set the Initiator Task Tag in compliance with RFC-3720 as published by the Internet Engineering Task Force. This issue has been fixed, and iscsiadm now sets the Initiator Task Tag correctly.
BZ#634021
Attempting to reboot or shut down a system with a running iSCSI daemon caused the system to stop responding because iSCSI sessions remained running. All iSCSI sessions now shut down correctly, so no issues are encountered on shut down or reboot.
BZ#689359
Previously, iSCSI did not work on the Broadcom NetXtreme II 1GbE Quad Port Copper Adapter (BCM57712) when connected to a Data Center Bridging-enabled (DCB-enabled) switch over VLAN. This occurred because VLAN tagging was set twice, once by uIP and once by the DCB firmware. This update corrects this issue with VLAN tagging.
BZ#640115
The ISCSI_ERR_INVALID_HOST error event was not being handled correctly, leaving iSCSI sessions in memory when the iSCSI driver was attempting to shut down. This resulted in the driver failing to respond during shutdown of sessions that used the Broadcom NetXtreme II Network Adapter driver.
BZ#593269
The iscsiadm and iscsid commands depended on files in /usr, but did not require that /usr was mounted when they were used. This resulted in failures without useful error messages when the user attempted to use these commands when /usr was not mounted. This issue has been corrected, and these failures no longer occur.
BZ#658428
Starting or stopping the iSCSI service while accessing the root partition directly through an iSCSI disk could cause iSCSI to become unresponsive and incorrect status information to be reported. Attempting to stop the iSCSI service in this circumstance now warns that iSCSI cannot be shut down while Root is on an iSCSI disk, and all statuses are reported correctly.
BZ#599539
The brcm_iscsiuio usage message displayed in response to the brcm_iscsiuio --help command contained two unsupported options: --foreground and --pid. The man page omitted five supported options: --debug, --help, -h, -p and --version. The unsupported options have been removed from the usage message, and all supported options have been added to the brcm_iscsiuio man page.
BZ#599542
The iscsiadm usage message displayed in response to the iscsiadm --help command omitted 24 supported options. Additionally, the iscsiadm man page omitted one supported option (--host) and contained one unsupported option (--info). These errors have now been corrected.
BZ#624437
iscsiadm did not accept host names or aliases as valid values for the --portal argument when in "node" mode. This resulted in failure, because iscsiadm expected the value returned during discovery as the value for --portal. iscsiadm now attempts to match a host name to the IP address returned during discovery, so this issue no longer occurs.
BZ#688783
If debug message logging was disabled, the iSCSI daemon failed to set the socket priority according to the Data Center Bridging application priority setting, which resulted in packets being sent with the default priority incorrectly. Socket priority is now set based on the Data Center Bridging application priority setting in this situation.
Enhancements:
BZ#640340
When iscsiadm failed or exited incorrectly, it did not output useful error codes. Meaningful error codes now exist for these situations, and are described further in the iscsiadm man page.
BZ#523492
Support for Data Center Bridging has been added to the iSCSI driver.
BZ#635899
brcm_iscsiuio provides the ARP and DHCP functionality to offload iSCSI functionality. Support has been added for IPv6, VLAN, and several new Broadcom network cards.
All users of iscsi-initiator-utils are advised to upgrade to these updated packages, which provide these bug fixes and add these enhancements.

1.101. iwl6000-firmware

1.101.1. RHBA-2011:0549: bug fix update

An updated iwl6000-firmware package is now available for Red Hat Enterprise Linux 6.
The iwl6000-firmware package provides the iwlagn wireless driver with the firmware it requires to function correctly with Intel Wireless WiFi Link 6000 series adapters.
This update upgrades the iwl6000 firmware to upstream version 9.221.4.1, which provides a number of bug fixes over the previous version. (BZ#568034)
Users of wireless devices which use iwl6000 firmware are advised to upgrade to this updated package.

1.102. iwl6050-firmware

1.102.1. RHBA-2011:0551: bug fix update

An updated iwl6050-firmware package is now available for Red Hat Enterprise Linux 6.
The iwl6050-firmware package provides the iwlagn wireless driver with the firmware it requires to function correctly with Intel Wireless WiFi Link 6050 series adapters.
This update upgrades the iwl6050 firmware to upstream version 41.28.5.1, which provides a number of bug fixes over the previous version. (BZ#663748)
Users of wireless devices which use iwl6050 firmware are advised to upgrade to this updated package.

1.103. java-1.6.0-openjdk

1.103.1. RHSA-2010:0865: Important security and bug fix update

Updated java-1.6.0-openjdk packages that fix several security issues and two bugs are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.
defaultReadObject of the Serialization API could be tricked into setting a volatile field multiple times, which could allow a remote attacker to execute arbitrary code with the privileges of the user running the applet or application. (CVE-2010-3569)
Race condition in the way objects were deserialized could allow an untrusted applet or application to misuse the privileges of the user running the applet or application. (CVE-2010-3568)
Miscalculation in the OpenType font rendering implementation caused out-of-bounds memory access, which could allow remote attackers to execute code with the privileges of the user running the java process. (CVE-2010-3567)
JPEGImageWriter.writeImage in the imageio API improperly checked certain image metadata, which could allow a remote attacker to execute arbitrary code in the context of the user running the applet or application. (CVE-2010-3565)
Double free in IndexColorModel could cause an untrusted applet or application to crash or, possibly, execute arbitrary code with the privileges of the user running the applet or application. (CVE-2010-3562)
The privileged accept method of the ServerSocket class in the Common Object Request Broker Architecture (CORBA) implementation in OpenJDK allowed it to receive connections from any host, instead of just the host of the current connection. An attacker could use this flaw to bypass restrictions defined by network permissions. (CVE-2010-3561)
Flaws in the Swing library could allow an untrusted application to modify the behavior and state of certain JDK classes. (CVE-2010-3557)
Flaws in the CORBA implementation could allow an attacker to execute arbitrary code by misusing permissions granted to certain system objects. (CVE-2010-3554)
UIDefault.ProxyLazyValue had unsafe reflection usage, allowing untrusted callers to create objects via ProxyLazyValue values. (CVE-2010-3553)
HttpURLConnection improperly handled the "chunked" transfer encoding method, which could allow remote attackers to conduct HTTP response splitting attacks. (CVE-2010-3549)
HttpURLConnection improperly checked whether the calling code was granted the "allowHttpTrace" permission, allowing untrusted code to create HTTP TRACE requests. (CVE-2010-3574)
HttpURLConnection did not validate request headers set by applets, which could allow remote attackers to trigger actions otherwise restricted to HTTP clients. (CVE-2010-3541, CVE-2010-3573)
The Kerberos implementation improperly checked the sanity of AP-REQ requests, which could cause a denial of service condition in the receiving Java Virtual Machine. (CVE-2010-3564)
The java-1.6.0-openjdk packages shipped with the GA release of Red Hat Enterprise Linux 6 mitigated a man-in-the-middle attack in the way the TLS/SSL protocols handle session renegotiation by disabling renegotiation. This update implements the TLS Renegotiation Indication Extension as defined in RFC 5746, allowing secure renegotiation between updated clients and servers. (CVE-2009-3555)
The NetworkInterface class improperly checked the network "connect" permissions for local network addresses, which could allow remote attackers to read local network addresses. (CVE-2010-3551)
Information leak flaw in the Java Naming and Directory Interface (JNDI) could allow a remote attacker to access information about otherwise-protected internal network names. (CVE-2010-3548)
Note: Flaws concerning applets in this advisory (CVE-2010-3568, CVE-2010-3554, CVE-2009-3555, CVE-2010-3562, CVE-2010-3557, CVE-2010-3548, CVE-2010-3564, CVE-2010-3565, CVE-2010-3569) can only be triggered in OpenJDK by calling the "appletviewer" application.
Bug fixes:
  • One defense in depth patch. (BZ#639922)
  • Problems for certain SSL connections. In a reported case, this prevented the JBoss JAAS modules from connecting over SSL to Microsoft Active Directory servers. (BZ#642779)

1.103.2. RHSA-2011:0281: Important security update

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.
A flaw was found in the Swing library. Forged TimerEvents could be used to bypass SecurityManager checks, allowing access to otherwise blocked files and directories. (CVE-2010-4465)
A flaw was found in the HotSpot component in OpenJDK. Certain bytecode instructions confused the memory management within the Java Virtual Machine (JVM), which could lead to heap corruption. (CVE-2010-4469)
A flaw was found in the way JAXP (Java API for XML Processing) components were handled, allowing them to be manipulated by untrusted applets. This could be used to elevate privileges and bypass secure XML processing restrictions. (CVE-2010-4470)
It was found that untrusted applets could create and place cache entries in the name resolution cache. This could allow an attacker targeted manipulation over name resolution until the OpenJDK VM is restarted. (CVE-2010-4448)
It was found that the Java launcher provided by OpenJDK did not check the LD_LIBRARY_PATH environment variable for insecure empty path elements. A local attacker able to trick a user into running the Java launcher while working from an attacker-writable directory could use this flaw to load an untrusted library, subverting the Java security model. (CVE-2010-4450)
A flaw was found in the XML Digital Signature component in OpenJDK. Untrusted code could use this flaw to replace the Java Runtime Environment (JRE) XML Digital Signature Transform or C14N algorithm implementations to intercept digital signature operations. (CVE-2010-4472)
Note: All of the above flaws can only be remotely triggered in OpenJDK by calling the "appletviewer" application.
This update also provides one defense in depth patch. (BZ#676019)
All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

1.103.3. RHSA-2011:0214: Moderate security update

Updated java-1.6.0-openjdk packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.
A denial of service flaw was found in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause Java-based applications to hang, for instance if they parse Double values in a specially-crafted HTTP request. (CVE-2010-4476)
All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve this issue. All running instances of OpenJDK Java must be restarted for the update to take effect.

1.103.4. RHBA-2011:0632: bug fix and enhancement update

Updated java-1.6.0-openjdk packages that fix various bugs and provide several enhancements are now available for Red Hat Enterprise Linux 6.
These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit.
The java-1.6.0-openjdk package has been upgraded to upstream version 1.9.7, which provides a number of bug fixes and enhancements over the previous version. (BZ#658208)
In addition, these updated java-1.6.0-openjdk packages fix the following bug:
  • In Java GUI (graphical user interface) applications, placeholder characters were displayed when run in the Japanese locale. This happened because the fontconfig file defined a mapping to an unavailable font. With this update, the IPA or VLGothic fonts are mapped instead and Japanese characters are displayed correctly. (BZ#659300)
All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues and add these enhancements.

1.104. jss

1.104.1. RHBA-2011:0621: bug fix update

Updated jss packages that fix two bugs are now available for Red Hat Enterprise 6.
JSS is a Java binding to Network Security Services (NSS), which provides SSL/TLS network protocols and other security services in the Public Key Infrastructure (PKI) suite. JSS is primarily utilized by the Certificate Server.
This update fixes the following bugs:
  • With this update, JSS has been upgraded to upstream version 4.2.6, which provides a number of bug fixes over the previous version. This rebase is necessary to support the Certificate Server. (BZ#656094)
  • Previously, JSS did not release a PK11 slot. Due to this problem, a resource leak occurred and prevented NSS from shutting down because NSS detected that resources were still in use. This update corrects the resource leak and allows NSS to shutdown. (BZ#676179)
All users of JSS are advised to upgrade to these updated packages, which fix these bugs.

1.105. kabi-whitelists

1.105.1. RHBA-2010:0856: bug fix update

An updated kabi-whitelists package that fixes a bug is now available.
The kabi-whitelists package contains reference files documenting interfaces provided by the Red Hat Enterprise Linux 6 kernel that are considered to be stable by Red Hat kernel engineering, and safe for longer term use by third party loadable device drivers, as well as for other purposes.
This update fixes the following bug:
  • Two exported kernel symbols were removed from the final version of the Kernel Application Binary Interface (kABI) whitelists package in Red Hat Enterprise Linux 6. (BZ#643570)
All users are advised to upgrade to this updated package, which resolves this issue.

1.105.2. RHEA-2011:0797: enhancement update

An updated kabi-whitelists package that adds two enhancements is now available for Red Hat Enterprise Linux 6.
The kabi-whitelists package contains reference files documenting interfaces provided by the Red Hat Enterprise Linux 6 kernel that are considered to be stable by Red Hat kernel engineering, and safe for longer term use by third party loadable device drivers, as well as for other purposes.
This update adds the following enhancements:
  • This update removes the "blk_queue_ordered" and the "blk_queue_physical_block_size" symbols from the Red Hat Enterprise Linux 6.0 kernel ABI whitelists. (BZ#636975)
  • This update adds several newly approved interfaces to the kernel ABI whitelists. (BZ#682967)
Note: It is not necessary to install the kabi-whitelists package in order to use Driver Updates. The kabi-whitelists package only provides reference files for use by those creating Driver Update packages, or for those who wish to enable support for verification of kernel ABI compatibility by installing the appropriate Yum plugin.
Users of kabi-whitelists are advised to upgrade to this updated package, which adds these enhancements.

1.106. kdelibs

1.106.1. RHSA-2011:0464: Moderate security update

Updated kdelibs packages that fix two security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
The kdelibs packages provide libraries for the K Desktop Environment (KDE).
A cross-site scripting (XSS) flaw was found in the way KHTML, the HTML layout engine used by KDE applications such as the Konqueror web browser, displayed certain error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially-crafted URL. (CVE-2011-1168)
A flaw was found in the way kdelibs checked the user specified hostname against the name in the server's SSL certificate. A man-in-the-middle attacker could use this flaw to trick an application using kdelibs into mistakenly accepting a certificate as if it was valid for the host, if that certificate was issued for an IP address to which the user specified hostname was resolved to. (CVE-2011-1094)
Note: As part of the fix for CVE-2011-1094, this update also introduces stricter handling for wildcards used in servers' SSL certificates.
Users should upgrade to these updated packages, which contain backported patches to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.

1.107. kdenetwork

1.107.1. RHSA-2011:0465: Important security update

Updated kdenetwork packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
The kdenetwork packages contain networking applications for the K Desktop Environment (KDE).
A directory traversal flaw was found in the way KGet, a download manager, handled the "file" element in Metalink files. An attacker could use this flaw to create a specially-crafted Metalink file that, when opened, would cause KGet to overwrite arbitrary files accessible to the user running KGet. (CVE-2011-1586)
Users of kdenetwork should upgrade to these updated packages, which contain a backported patch to resolve this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.

1.108. kernel

1.108.1. RHSA-2012:0116 – Important: kernel security and bug fix update

Important

This update has already been released as the security errata RHSA-2012:0116.
Updated kernel packages that fix multiple security issues and various bugs are now available for Red Hat Enterprise Linux 6.1 Extended Update Support.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links after each description below.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security fixes:
* The proc file system could allow a local, unprivileged user to obtain sensitive information or possibly cause integrity issues. (CVE-2011-1020, Moderate)
* Non-member VLAN (virtual LAN) packet handling for interfaces in promiscuous mode and also using the be2net driver could allow an attacker on the local network to cause a denial of service. (CVE-2011-3347, Moderate)
* A missing validation flaw was found in the Linux kernel's m_stop() implementation. A local, unprivileged user could use this flaw to trigger a denial of service. (CVE-2011-3637, Moderate)
* A flaw was found in the Linux kernel in the way splitting two extents in ext4_ext_convert_to_initialized() worked. A local, unprivileged user with the ability to mount and unmount ext4 file systems could use this flaw to cause a denial of service. (CVE-2011-3638, Moderate)
* A NULL pointer dereference flaw was found in the way the Linux kernel's key management facility handled user-defined key types. A local, unprivileged user could use the keyctl utility to cause a denial of service. (CVE-2011-4110, Moderate)
Red Hat would like to thank Kees Cook for reporting CVE-2011-1020; Somnath Kotur for reporting CVE-2011-3347; and Zheng Liu for reporting CVE-2011-3638.
Bug fixes:
BZ#722899
Previously, holding the "bond->lock" lock while modifying a VLAN list for a slave caused problems for any driver's ndo_vlan* functions that might sleep. This lock turned out to be unnecessary. With this update, the lock has been dropped from the code and the problem no longer occurs.
BZ#746908
Previously, the fc_eh_host_reset() function was leaving lport offline permanently due to the FLOGI (Fabric Login) response getting handled by the LOGO response from the last reset, as both had the same exchange ID. Now, end-to-end exchanges are cleaned-up using exchange abort along exchanges reset done by fc_eh_host_reset(). This avoids exchange collisions between the sessions across the reset, and the problem no longer occurs.
BZ#746910
When the user called a 'destroy' action on a port that was processing a FLOGI response, a deadlock could occur in the FCoE (Fibre Channel over Ethernet) stack. A backported patch has been provided to address this issue and the deadlock no longer occurs in the described scenario.
BZ#751021
Previously, duplicate MAC addresses were being used on a rack network daughter card that contained a quad-port i350 device. A patch has been provided to address this issue and duplicate MAC addresses are no longer used in the described scenario.
BZ#754458
Due to a regression, the fc_eh_host_reset() function could cause FCoE connections to become unresponsive after a FCoE port had been destroyed. With this update, FLOGI responses have been improved to avoid an lport becoming stuck, code has been fixed to avoid exchanges collision during an lport reset, and the check of the FC_TYPE_BLS value has been fixed, thus resolving this bug.
BZ#768287
Previously, when the schedule() function was run shortly after a boot, the following warning message was sometimes returned once per boot on the console:
5915: WARN_ON_ONCE(test_tsk_need_resched(next));
An upstream patch has been provided to address this issue and the WARN_ON_ONCE() call is no longer present in schedule(), thus fixing this bug.
BZ#768915
On a system with an idle network interface card (NIC) controlled by the e1000e driver, when the card transmitted up to four descriptors, which delayed the write-back and nothing else, the run of the watchdog driver about two seconds later forced a check for a transmit hang in the hardware, which found the old entry in the TX ring. Consequently, a false "Detected Hardware Unit Hang" message was issued to the log. With this update, when the hang is detected, the descriptor is flushed and the hang check is run again, which fixes this bug.
BZ#771869
A bug in the splice code has caused the file position on the write side of the sendfile() system call to be incorrectly set to the read side file position. This could result in the data being written to an incorrect offset. Now, sendfile() has been modified to correctly use the current file position for the write side file descriptor, thus fixing this bug.

Note

Note that in the following common sendfile() scenarios, this bug does not occur: when both read and write file positions are identical and when the file position is not important (e.g. if the write side is a socket).
BZ#783931
Red Hat Enterprise Linux sometimes failed to boot on systems with more than 16 CPU cores that also included an installed QLogic Infiniband HCA device. The bug was due to faulty logic that dimensions a pointer array by the number of CPUs in the server. This logic has been fixed and systems with more than 16 CPU cores now boot properly with QLogic Infiniband HCA devices installed.
BZ#786029
Previously, the sendfile(2) function was reimplemented to use splice infrastructure, but it still checked for f_op.sendpage() instead of f_op.splice_write(). However, f_op.sendpage() is no longer used by file systems. This was causing sendfile(2) to always fail. This bug has been fixed by removing the deprecated check and using f_op.sendpage() instead.
Users should upgrade to these updated packages, which contain backported patches to resolve these issues and fix these bugs. The system must be rebooted for this update to take effect.

1.108.2. RHSA-2011:1465 – Important: kernel security and bug fix update

Important

This update has already been released as the security errata RHSA-2011:1465.
Updated kernel packages that fix multiple security issues and various bugs are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links after each description below.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security fixes:
* IPv6 fragment identification value generation could allow a remote attacker to disrupt a target system's networking, preventing legitimate users from accessing its services. (CVE-2011-2699, Important)
* A signedness issue was found in the Linux kernel's CIFS (Common Internet File System) implementation. A malicious CIFS server could send a specially-crafted response to a directory read request that would result in a denial of service or privilege escalation on a system that has a CIFS share mounted. (CVE-2011-3191, Important)
* A flaw was found in the way the Linux kernel handled fragmented IPv6 UDP datagrams over the bridge with UDP Fragmentation Offload (UFO) functionality on. A remote attacker could use this flaw to cause a denial of service. (CVE-2011-4326, Important)
* The way IPv4 and IPv6 protocol sequence numbers and fragment IDs were generated could allow a man-in-the-middle attacker to inject packets and possibly hijack connections. Protocol sequence numbers and fragment IDs are now more random. (CVE-2011-3188, Moderate)
* A buffer overflow flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) implementation. A local user in the fuse group who has access to mount a FUSE file system could use this flaw to cause a denial of service. (CVE-2011-3353, Moderate)
* A flaw was found in the b43 driver in the Linux kernel. If a system had an active wireless interface that uses the b43 driver, an attacker able to send a specially-crafted frame to that interface could cause a denial of service. (CVE-2011-3359, Moderate)
* A flaw was found in the way CIFS shares with DFS referrals at their root were handled. An attacker on the local network who is able to deploy a malicious CIFS server could create a CIFS network share that, when mounted, would cause the client system to crash. (CVE-2011-3363, Moderate)
* A flaw was found in the way the Linux kernel handled VLAN 0 frames with the priority tag set. When using certain network drivers, an attacker on the local network could use this flaw to cause a denial of service. (CVE-2011-3593, Moderate)
* A flaw in the way memory containing security-related data was handled in tpm_read() could allow a local, unprivileged user to read the results of a previously run TPM command. (CVE-2011-1162, Low)
* A heap overflow flaw was found in the Linux kernel's EFI GUID Partition Table (GPT) implementation. A local attacker could use this flaw to cause a denial of service by mounting a disk that contains specially-crafted partition tables. (CVE-2011-1577, Low)
* The I/O statistics from the taskstats subsystem could be read without any restrictions. A local, unprivileged user could use this flaw