Product SiteDocumentation Site

Red Hat Enterprise Linux 6

6.2 Technical Notes

Detailed notes on the changes implemented in Red Hat Enterprise Linux 6.2

Edition 2


Legal Notice

Copyright © 2011 Red Hat, Inc.
The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, MetaMatrix, Fedora, the Infinity Logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
Java® is a registered trademark of Oracle and/or its affiliates.
XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.
MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.
All other trademarks are the property of their respective owners.


1801 Varsity Drive
RaleighNC 27606-2072 USA
Phone: +1 919 754 3700
Phone: 888 733 4281
Fax: +1 919 754 3701

Abstract
The Red Hat Enterprise Linux 6.2 Technical Notes list and document the changes made to the Red Hat Enterprise Linux 6 operating system and its accompanying applications between Red Hat Enterprise Linux 6.1 and minor release Red Hat Enterprise Linux 6.2.

Preface
1. Technology Previews
1.1. Storage and File Systems
1.2. Networking
1.3. Clustering
1.4. Security
1.5. Devices
1.6. Kernel
1.7. Virtualization
2. Known Issues
2.1. Installation
2.2. Entitlement
2.3. Deployment
2.4. Virtualization
2.5. Storage and File Systems
2.6. Networking
2.7. Clustering
2.8. Authentication
2.9. Devices
2.10. Kernel
2.11. Desktop
3. New Packages
3.1. RHEA-2011:1729 — new package: fcoe-target-utils
3.2. RHEA-2011:1653 — new package: libunistring
3.3. RHEA-2011:1636 — new package: libvirt-qmf
3.4. RHEA-2011:1609 — new package: libvirt-snmp
3.5. RHBA-2011:1628 — new package: openslp
3.6. RHEA-2011:1545 — new package: passsync
3.7. RHEA-2011:1731 — new package: perl-Test-Inter
3.8. RHEA-2011:1725 — new package: python-configshell
3.9. RHEA-2011:1724 — new package: python-ipaddr
3.10. RHEA-2011:1728 — new package: python-rtslib
3.11. RHEA-2011:1727 — new package: python-simpleparse
3.12. RHEA-2011:1726 — new package: python-urwid
3.13. RHEA-2011:1622 — new package: python-suds
3.14. RHEA-2011:1590 — new package: sanlock
3.15. RHEA-2011:1633 — new package: tboot
3.16. RHEA-2011:1752 — new package: vios-proxy
3.17. RHEA-2011:1757 — new package: virt-who
3.18. RHEA-2011:1625 — new package: wdaemon
3.19. RHEA-2011:1610 — new packages: spice-gtk
3.20. RHEA-2011:1627 — new packages: btparser
3.21. RHEA-2011:1640 — new packages: sgabios
3.22. RHEA-2011:1714 — new packages: mesa-libGLw
3.23. RHEA-2011:1442 — new packages: tdb-tools
4. Package Updates
4.1. 389-ds-base
4.2. abrt
4.3. acl
4.4. alsa-lib
4.5. anaconda
4.6. apr
4.7. atlas
4.8. attr
4.9. audit
4.10. augeas
4.11. autofs
4.12. autotrace
4.13. bacula
4.14. bfa-firmware
4.15. bind
4.16. bind-dyndb-ldap
4.17. binutils
4.18. biosdevname
4.19. blktrace
4.20. bltk
4.21. boost
4.22. ca-certificates
4.23. cachefilesd
4.24. certmonger
4.25. cifs-utils
4.26. cjkuni-fonts
4.27. cluster
4.28. clustermon
4.29. coolkey
4.30. coreutils
4.31. corosync
4.32. cpufrequtils
4.33. crash
4.34. crontabs
4.35. cryptsetup-luks
4.36. ctdb
4.37. cups
4.38. curl
4.39. cyrus-imapd
4.40. cyrus-sasl
4.41. dbus
4.42. device-mapper-multipath
4.43. DeviceKit-power
4.44. dhcp
4.45. dmidecode
4.46. dnsmasq
4.47. dosfstools
4.48. dovecot
4.49. doxygen
4.50. dracut
4.51. dump
4.52. e2fsprogs
4.53. ecryptfs-utils
4.54. esc
4.55. fakechroot
4.56. fcoe-utils
4.57. fence-agents
4.58. fence-virt
4.59. file
4.60. filesystem
4.61. fipscheck
4.62. firefox
4.63. firstaidkit
4.64. firstboot
4.65. foomatic
4.66. freetype
4.67. fuse
4.68. gcc
4.69. gdb
4.70. gdm
4.71. ghostscript
4.72. gimp
4.73. glibc
4.74. gnome-screensaver
4.75. gnome-session
4.76. gnome-system-monitor
4.77. gnome-terminal
4.78. gpm
4.79. gpxe
4.80. graphviz
4.81. grub
4.82. guile
4.83. httpd
4.84. hwdata
4.85. ibus
4.86. ibus-anthy
4.87. ibus-table-erbi
4.88. icedtea-web
4.89. initscripts
4.90. ipa
4.91. ipa-pki-theme
4.92. ipmitool
4.93. iproute
4.94. iprutils
4.95. iscsi-initiator-utils
4.96. isdn4k-utils
4.97. iwl1000-firmware
4.98. iwl5000-firmware
4.99. iwl6000g2a-firmware
4.100. java-1.6.0-openjdk
4.101. jss
4.102. jwhois
4.103. kabi-whitelists
4.104. kdeaccessibility
4.105. kdeadmin
4.106. kdebase
4.107. kdebase-workspace
4.108. kdelibs
4.109. kdepim-runtime
4.110. kdeutils
4.111. kernel
4.112. kexec-tools
4.113. keyutils
4.114. krb5
4.115. krb5-appl
4.116. ksh
4.117. less
4.118. libarchive
4.119. libcacard
4.120. libcap
4.121. libcgroup
4.122. libcmpiutil
4.123. libesmtp
4.124. libgcrypt
4.125. libgpg-error
4.126. libguestfs
4.127. libhbaapi
4.128. libhbalinux
4.129. libhugetlbfs
4.130. libica
4.131. libnih
4.132. libpng
4.133. librsvg2
4.134. libselinux
4.135. libsemanage
4.136. libsepol
4.137. libsndfile
4.138. libsoup
4.139. libssh2
4.140. libtirpc
4.141. libvirt
4.142. libvirt-cim
4.143. libXfont
4.144. libxml2
4.145. lldpad
4.146. lohit-assamese-fonts
4.147. lohit-bengali-fonts
4.148. lohit-gujarati-fonts
4.149. lohit-kannada-fonts
4.150. lohit-malayalam-fonts
4.151. lohit-oriya-fonts
4.152. lohit-punjabi-fonts
4.153. lohit-tamil-fonts
4.154. lohit-telugu-fonts
4.155. lsof
4.156. luci
4.157. lvm2
4.158. m17n-contrib
4.159. m17n-lib
4.160. mailcap
4.161. mailman
4.162. man-pages-ja
4.163. man-pages-overrides
4.164. matahari
4.165. mcelog
4.166. mdadm
4.167. mesa
4.168. microcode_ctl
4.169. mingetty
4.170. mingw32
4.171. mingw32-qpid-cpp
4.172. mksh
4.173. mod_nss
4.174. mod_revocator
4.175. mutt
4.176. nautilus
4.177. nautilus-open-terminal
4.178. net-snmp
4.179. net-tools
4.180. netcf
4.181. NetworkManager
4.182. NetworkManager-openswan
4.183. newt
4.184. nfs-utils
4.185. nfs-utils-lib
4.186. nmap
4.187. nspr, nss, nss-softokn, and nss-util
4.188. nss
4.189. nss-pam-ldapd
4.190. nss_db
4.191. omping
4.192. opencryptoki
4.193. openldap
4.194. openmotif
4.195. openscap
4.196. openssh
4.197. openssl
4.198. openssl-ibmca
4.199. openswan
4.200. oprofile
4.201. pacemaker
4.202. pam
4.203. pam_krb5
4.204. pam_ldap
4.205. papi
4.206. parted
4.207. pciutils
4.208. perl
4.209. perl-Date-Manip
4.210. perl-Net-DNS
4.211. perl-NetAddr-IP
4.212. perl-Sys-Virt
4.213. perl-Test-Spelling
4.214. php-pear
4.215. php53 and php
4.216. pinentry
4.217. piranha
4.218. pki-core
4.219. plymouth
4.220. policycoreutils
4.221. portreserve
4.222. postfix
4.223. postgresql
4.224. powerpc-utils
4.225. powertop
4.226. prelink
4.227. procps
4.228. pykickstart
4.229. pyparted
4.230. python
4.231. python-dmidecode
4.232. python-meh
4.233. python-netaddr
4.234. python-psycopg2
4.235. python-qpid
4.236. python-rhsm
4.237. python-virtinst
4.238. qemu-kvm
4.239. ql2400-firmware
4.240. ql2500-firmware
4.241. qpid-cpp
4.242. qpid-qmf
4.243. qpid-tests
4.244. qpid-tools
4.245. qt
4.246. qt3
4.247. RDMA
4.248. Release Notes
4.249. redhat-release
4.250. redhat-rpm-config
4.251. resource-agents
4.252. rgmanager
4.253. rhn-client-tools
4.254. rhnlib
4.255. ricci
4.256. rng-tools
4.257. rpm
4.258. rsyslog
4.259. ruby
4.260. s390utils
4.261. sabayon
4.262. samba
4.263. sblim-cmpi-base
4.264. sblim-cmpi-fsvol
4.265. sblim-cmpi-nfsv3
4.266. sblim-gather
4.267. sblim-sfcb
4.268. sblim-sfcc
4.269. sblim-smis-hba
4.270. scsi-target-utils
4.271. seabios
4.272. sed
4.273. seekwatcher
4.274. selinux-policy
4.275. setroubleshoot
4.276. setup
4.277. sg3_utils
4.278. shadow-utils
4.279. sigar
4.280. slapi-nis
4.281. smartmontools
4.282. sos
4.283. spice-client
4.284. spice-protocol
4.285. spice-server
4.286. spice-vdagent
4.287. squid
4.288. sssd
4.289. star
4.290. subscription-manager
4.291. subversion
4.292. sudo
4.293. swig
4.294. system-config-firewall
4.295. system-config-kickstart
4.296. system-config-lvm
4.297. system-config-printer
4.298. system-switch-java
4.299. systemtap
4.300. tcp_wrappers
4.301. tcsh
4.302. telnet
4.303. texlive-texmf
4.304. tftp
4.305. thunderbird
4.306. tigervnc
4.307. tmpwatch
4.308. tog-pegasus
4.309. tomcatjss
4.310. tsclient
4.311. tuned
4.312. udev
4.313. udisks
4.314. unicap
4.315. usbutils
4.316. util-linux-ng
4.317. valgrind
4.318. virt-manager
4.319. virt-top
4.320. virt-v2v
4.321. virt-viewer
4.322. virt-what
4.323. virtio-win
4.324. vte
4.325. which
4.326. wireshark
4.327. wpa_supplicant
4.328. X.Org
A. Revision History

Preface

The Red Hat Enterprise Linux 6.2 Technical Notes list and document the changes made to the Red Hat Enterprise Linux 6 operating system and its accompanying applications between minor release Red Hat Enterprise Linux 6.1 and minor release Red Hat Enterprise Linux 6.2.
For system administrators and others planning Red Hat Enterprise Linux 6.2 upgrades and deployments, the Technical Notes provide a single, organized record of the bugs fixed in, features added to, and Technology Previews included with this new release of Red Hat Enterprise Linux.
For auditors and compliance officers, the Red Hat Enterprise Linux 6.2 Technical Notes provide a single, organized source for change tracking and compliance testing.
For every user, the Red Hat Enterprise Linux 6.2 Technical Notes provide details of what has changed in this new release.

Note

The Package Manifest is available as a separate document.

Chapter 1. Technology Previews

Technology Preview features are currently not supported under Red Hat Enterprise Linux subscription services, may not be functionally complete, and are generally not suitable for production use. However, these features are included as a customer convenience and to provide the feature with wider exposure.
Customers may find these features useful in a non-production environment. Customers are also free to provide feedback and functionality suggestions for a Technology Preview feature before it becomes fully supported. Errata will be provided for high-severity security issues.
During the development of a Technology Preview feature, additional components may become available to the public for testing. It is the intention of Red Hat to fully support Technology Preview features in a future release.

1.1. Storage and File Systems

Parallel NFS
Parallel NFS (pNFS) is a part of the NFS v4.1 standard that allows clients to access storage devices directly and in parallel. The pNFS architecture eliminates the scalability and performance issues associated with NFS servers in deployment today.
pNFS supports 3 different storage protocols or layouts: files, objects and blocks. The Red Hat Enterprise Linux 6.2 NFS client supports the files layout protocol.
To automatically enable the pNFS functionality, create the /etc/modprobe.d/dist-nfsv41.conf file with the following line and reboot the system:
alias nfs-layouttype4-1 nfs_layout_nfsv41_files
Now when the -o minorversion=1 mount option is specified, and the server is pNFS-enabled, the pNFS client code is automatically enabled.
For more information on pNFS, refer to http://www.pnfs.com/.
Open multicast ping (Omping), BZ#657370
Open Multicast Ping (Omping) is a tool to test the IP multicast functionality, primarily in the local network. This utility allows users to test IP multicast functionality and assists in the diagnosing if an issues is in the network configuration or elsewhere (that is, a bug). In Red Hat Enterprise Linux 6 Omping is provided as a Technology Preview.
Matahari
Matahari provides a set of Application Programming Interfaces (APIs) for operating systems management for remote access over QMF/QPID. Matahari in Red Hat Enterprise Linux 6.2 is fully supported only for Intel 64 and AMD64 architectures. Builds for other architectures are considered a Technology Preview.
System Information Gatherer and Reporter (SIGAR)
The System Information Gatherer and Reporter (SIGAR) is a library and command-line tool for accessing operating system and hardware level information across multiple platforms and programming languages. In Red Hat Enterprise Linux 6.2, SIGAR is considered a Technology Preview package.
fsfreeze
Red Hat Enterprise Linux 6 includes fsfreeze as a Technology Preview. fsfreeze is a new command that halts access to a file system on a disk. fsfreeze is designed to be used with hardware RAID devices, assisting in the creation of volume snapshots. For more details on the fsfreeze utility, refer to the fsfreeze(8) man page.
DIF/DIX support
DIF/DIX, is a new addition to the SCSI Standard and a Technology Preview in Red Hat Enterprise Linux 6. DIF/DIX increases the size of the commonly used 512-byte disk block from 512 to 520 bytes, adding the Data Integrity Field (DIF). The DIF stores a checksum value for the data block that is calculated by the Host Bus Adapter (HBA) when a write occurs. The storage device then confirms the checksum on receive, and stores both the data and the checksum. Conversely, when a read occurs, the checksum can be checked by the storage device, and by the receiving HBA.
The DIF/DIX hardware checksum feature must only be used with applications that exclusively issue O_DIRECT I/O. These applications may use the raw block device, or the XFS file system in O_DIRECT mode. (XFS is the only file system that does not fall back to buffered I/O when doing certain allocation operations.) Only applications designed for use with O_DIRECT I/O and DIF/DIX hardware should enable this feature.
For more information, refer to section Block Devices with DIF/DIX Enabled in the Storage Administration Guide
File system in user space
Filesystem in Userspace (FUSE) allows for custom file systems to be developed and run in user space.
Btrfs, BZ#614121
Btrfs is under development as a file system capable of addressing and managing more files, larger files, and larger volumes than the ext2, ext3, and ext4 file systems. Btrfs is designed to make the file system tolerant of errors, and to facilitate the detection and repair of errors when they occur. It uses checksums to ensure the validity of data and metadata, and maintains snapshots of the file system that can be used for backup or repair. The btrfs Technology Preview is only available on AMD64 and Intel 64 architectures.

Btrfs is still experimental

Red Hat Enterprise Linux 6 includes Btrfs as a technology preview to allow you to experiment with this file system. You should not choose Btrfs for partitions that will contain valuable data or that are essential for the operation of important systems.
LVM Application Programming Interface (API)
Red Hat Enterprise Linux 6 features the new LVM application programming interface (API) as a Technology Preview. This API is used to query and control certain aspects of LVM.
LVM RAID support, BZ#729712
In Red Hat Enterprise Linux 6.2, support for MD's RAID personalities has been added to LVM as a Technology Preview. The following basic features are available: create, display, rename, use, and remove RAID logical volumes. Automated fault tolerance is not yet available.
FS-Cache
FS-Cache is a new feature in Red Hat Enterprise Linux 6 that enables networked file systems (e.g. NFS) to have a persistent cache of data on the client machine.

1.2. Networking

vios-proxy, BZ#721119
vios-proxy is a stream-socket proxy for providing connectivity between a client on a virtual guest and a server on a Hypervisor host. Communication occurs over virtio-serial links.
IPv6 support in IPVS
The IPv6 support in IPVS (IP Virtual server) is considered a Technology Preview.

1.3. Clustering

Support for redundant ring for standalone Corosync, BZ#722469
Red Hat Enterprise Linux 6.2 introduces support for redundant ring with autorecovery feature as a Technology Preview. Refer to Section 2.7, “Clustering” for a list of known issues associated with this Technology Preview.
corosync-cpgtool, BZ#688260
The corosync-cpgtool now specifies both interfaces in a dual ring configuration. This feature is a Technology Preview.
Disabling rgmanager in /etc/cluster.conf, BZ#723925
As a consequence of converting the /etc/cluster.conf configuration file to be used by pacemaker, rgmanager must be disabled. The risk of not doing this is high; after a successful conversion, it would be possible to start rgmanager and pacemaker on the same host, managing the same resources.
Consequently, Red Hat Enterprise Linux 6.2 includes a feature (as a Technology Preview) that forces the following requirements:
  • rgmanager must refuse to start if it sees the <rm disabled="1"> flag in /etc/cluster.conf.
  • rgmanager must stop any resources and exit if the <rm disabled="1"> flag appears in /etc/cluster.conf during a reconfiguration.
pacemaker, BZ#456895
Pacemaker, a scalable high-availability cluster resource manager, is included in Red Hat Enterprise Linux 6 as a Technology Preview. Pacemaker is not fully integrated with the Red Hat cluster stack.

1.4. Security

Trusted boot
Red Hat Enterprise Linux 6.2 includes a trusted boot mechanism (provided by the tboot package) as Technology Preview. Trusted boot is an install-time optional component that allows for Intel's Trusted Execution Technology (TXT) to perform a measured and verified launch of the operating system kernel. Trusted boot is supported on 32-bit Intel x86, and 64-bit Intel EM64T and AMD64 architectures.
TPM
TPM hardware can create, store and use RSA keys securely (without ever being exposed in memory), verify a platform's software state using cryptographic hashes and more. The user space libraries, trousers and tpm-tools, are considered a Technology Preview.

1.5. Devices

Brocade BFA driver
The Brocade BFA driver is considered a Technology Preview feature in Red Hat Enterprise Linux 6. The BFA driver supports Brocade FibreChannel and FCoE mass storage adapters.
SR-IOV on the be2net driver, BZ#602451
The SR-IOV functionality of the Emulex be2net driver is considered a Technology Preview in Red Hat Enterprise Linux 6.

1.6. Kernel

Support for Fiber Channel over Ethernet (FCoE) target mode
Red Hat Enterprise Linux 6.2 includes support for Fiber Channel over Ethernet (FCoE) target mode as a Technology Preview. This kernel feature is configurable via targetadmin, supplied by the fcoe-target-utils package. FCoE is designed to be used on a network supporting Data Center Bridging (DCB). Further details are available in the dcbtool(8) and targetadmin(8) man pages.

Important

This feature uses the new SCSI target layer, which falls under this Technology Preview, and should not be used independently from the FCoE target support. This package contains the AGPL license.
Kernel Media support
The following features are presented as Technology Previews:
  • The latest upstream video4linux
  • Digital video broadcasting
  • Primarily infrared remote control device support
  • Various webcam support fixes and improvements
Remote audit logging
The audit package contains the user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux 2.6 kernel. Within the audispd-plugins subpackage is a utility that allows for the transmission of audit events to a remote aggregating machine. This remote audit logging application, audisp-remote, is considered a Technology Preview in Red Hat Enterprise Linux 6.
Linux (NameSpace) Container [LXC]
Linux containers provide a flexible approach to application runtime containment on bare-metal systems without the need to fully virtualize the workload. Red Hat Enterprise Linux 6.2 provides application level containers to separate and control the application resource usage policies via cgroup and namespaces. This release introduces basic management of container life-cycle by allowing creation, editing and deletion of containers via the libvirt API and the virt-manager GUI. Linux Containers are a Technology Preview.
Error Detection And Correction (EDAC) driver interface
The Error Detection And Correction (EDAC) driver interface for processors based on the Intel microarchitecture codename Nehalem is considered a Technology Preview in this release of Red Hat Enterprise Linux 6.
Diagnostic pulse for the fence_ipmilan agent, BZ#655764
A diagnostic pulse can now be issued on the IPMI interface using the fence_ipmilan agent. This new Technology Preview is used to force a kernel dump of a host if the host is configured to do so. Note that this feature is not a substitute for the off operation in a production cluster.
EDAC driver support, BZ#647700
Red Hat Enterprise Linux 6.2's EDAC driver support for the latest Intel chipset is available as a Technical Preview.

1.7. Virtualization

System monitoring via SNMP, BZ#642556
This feature provides KVM support for stable technology that is already used in data center with bare metal systems. SNMP is the standard for monitoring and is extremely well understood as well as computationally efficient. System monitoring via SNMP in Red Hat Enterprise Linux 6.2 allows the KVM hosts to send SNMP traps on events so that hypervisor events can be communicated to the user via standard SNMP protocol. This feature is provided through the addition of a new package: libvirt-snmp. This feature is introduced as a Technology Preview.
Wire speed requirement in KVM network drivers
Virtualization and cloud products that run networking work loads need to run wire speeds. Up until Red Hat Enterprise Linux 6.1, the only way to reach wire speed on a 10 GB Ethernet NIC with a lower CPU utilization was to use PCI device assignment (passthrough), which limits other features like memory overcommit and guest migration
The macvtap/vhost zero-copy capabilities allows the user to use those features when high performance is required. This feature improves performance for any Red Hat Enterprise Linux 6.x guest in the VEPA use case. This feature is introduced as a Technology Preview.
KVM Live Snapshots
Red Hat Enterprise Linux 6.2 introduces the Live Snapshot feature as a Technology Preview. The live snapshots feature provides automatic backup of virtual machine images on the hard drive, and provides a per drive snapshot of the virtual disks transparently, using external qcow2 images. Multi-disk live snapshot creation helps with maintaining data integrity by pausing qemu prior to taking as many snapshots as there are disks. Thus, a multi-disk snapshot will have all disks containing data from the same point in time.
It is important to know that there is a limitation with file system consistency. However, the re-use of the snapshot image is crash-consistent. A user would have to run a file system check (fsck) or replay journal entries, which is similar to booting after pulling the power cord.

Chapter 2. Known Issues

2.1. Installation

anaconda component, BZ#676025
Users performing an upgrade using the Anaconda's text mode interface who do not have a boot loader already installed on the system, or who have a non-GRUB boot loader, need to select Skip Boot Loader Configuration during the installation process. Boot loader configuration will need to be completed manually after installation. This problem does not affect users running Anaconda in the graphical mode (graphical mode also includes VNC connectivity mode).
anaconda component
Anaconda fails to install to partitions of size 2.2 TB and larger.
anaconda component
On s390x systems, you cannot use automatic partitioning and encryption. If you want to use storage encryption, you must perform custom partitioning. Do not place the /boot volume on an encrypted volume.
anaconda component
The order of device names assigned to USB attached storage devices is not guaranteed. Certain USB attached storage devices may take longer to initialize than others, which can result in the device receiving a different name than you expect (for example, sdc instead of sda).
During installation, verify the storage device size, name, and type when configuring partitions and file systems.
kernel component
Dell systems based on a future Intel processor with graphics acceleration require the selection of the install system with basic video driver installation option. A future Red Hat Enterprise Linux 6.2.z Extended Update Support update will remove this requirement.
kernel component
Recent Red Hat Enterprise Linux 6 releases use a new naming scheme for network interfaces on some machines. As a result, the installer may use different names during an upgrade in certain scenarios (typically em1 is used instead of eth0 on new Dell machines). However, the previously used network interface names are preserved on the system and the upgraded system will still use the previously used interfaces. This is not the case for Yum upgrades.
anaconda component
The kdump default on feature currently depends on Anaconda to insert the crashkernel= parameter to the kernel parameter list in the boot loader's configuration file.
firstaidkit component
The firstaidkit-plugin-grub package has been removed from Red Hat Enterprise Linux 6.2. As a consequence, in rare cases, the system upgrade operation may fail with unresolved dependencies if the plug-in has been installed in a previous version of Red Hat Enterprise Linux. To avoid this problem, the firstaidkit-plugin-grub package should be removed before upgrading the system. However, in most cases, the system upgrade completes as expected.
anaconda component, BZ#623261
In some circumstances, disks that contain a whole disk format (for example, a LVM Physical Volume populating a whole disk) are not cleared correctly using the clearpart --initlabel kickstart command. Adding the --all switch—as in clearpart --initlabel --all—ensures disks are cleared correctly.
squashfs-tools component
During the installation on POWER systems, error messages similar to:
attempt to access beyond end of device
loop0: rw=0, want=248626, limit=248624
may be returned to sys.log. These errors do not prevent installation and only occur during the initial setup. The file system created by the installer will function correctly.
anaconda component
When installing on the IBM System z architecture, if the installation is being performed over SSH, avoid resizing the terminal window containing the SSH session. If the terminal window is resized during the installation, the installer will exit and the installation will terminate.
yaboot component, BZ#613929
The kernel image provided on the CD/DVD is too large for Open Firmware. Consequently, on the POWER architecture, directly booting the kernel image over a network from the CD/DVD is not possible. Instead, use yaboot to boot from a network.
anaconda component
The Anaconda partition editing interface includes a button labeled Resize. This feature is intended for users wishing to shrink an existing file system and an underlying volume to make room for an installation of a new system. Users performing manual partitioning cannot use the Resize button to change sizes of partitions as they create them. If you determine a partition needs to be larger than you initially created it, you must delete the first one in the partitioning editor and create a new one with the larger size.
system-config-kickstart component
Channel IDs (read, write, data) for network devices are required for defining and configuring network devices on IBM S/390 systems. However, system-config-kickstart—the graphical user interface for generating a kickstart configuration—cannot define channel IDs for a network device. To work around this issue, manually edit the kickstart configuration that system-config-kickstart generates to include the desired network devices.
dracut component
During FCoE BFS installation, when an Ethernet interface goes offline after discovering the targets, FCoE link will never come up. This is because Anaconda creates an FCoE configuration file under/etc/fcoe/ using biosdevname (new style interface naming scheme) for all the available Ethernet interfaces for FCoE BFS. However, it does not add the ifname kernel command line for the FCoE interface that stays offline after discovering FCoE targets during installation. Because of this, during subsequent reboots, the system tries to find the old style ethX interface name in the /etc/fcoe directory, which does not match with the file created by Anaconda using biosdevname. Therefore, due to the missing FCoE configuration file, an FCoE interface is never created on the Ethernet interface.
To avoid this problem, ensure that the Ethernet interface does not go offline during FCoE BFS installation.
If the Ethernet interface does go offline during installation after discovering the targets, add the following parameter to the kernel command line:
ifname=<biosdevname_interface_name>:<mac_address>

2.2. Entitlement

subscription manager component
When registering a system with firstboot, the RHN Classic option is checked by default in the Subscription part.

2.3. Deployment

cpuspeed component, BZ#626893
Some HP Proliant servers may report incorrect CPU frequency values in /proc/cpuinfo or /sys/device/system/cpu/*/cpufreq. This is due to the firmware manipulating the CPU frequency without providing any notification to the operating system. To avoid this ensure that the HP Power Regulator option in the BIOS is set to OS Control. An alternative available on more recent systems is to set Collaborative Power Control to Enabled.
releng component, BZ#644778
Some packages in the Optional repositories on RHN have multilib file conflicts. Consequently, these packages cannot have both the primary architecture (for example, x86_64) and secondary architecture (for example, i686) copies of the package installed on the same machine simultaneously. To work around this issue, install only one copy of the conflicting package.
releng component
The openmpi-psm and openmpi-psm-devel packages are not provided on architectures other than AMD64 and Intel 64 for Red Hat Enterprise Linux 6.2. If the openmpi-psm.i686 or/and openmpi-psm-devel.i686 packages are installed on a AMD64 or an Intel 64 system, remove these packages before you attempt to update Open MPI.
grub component, BZ#695951
On certain UEFI-based systems, you may need to type BOOTX64 rather than bootx64 to boot the installer due to case sensitivity issues.
grub component, BZ#698708
When rebuilding the grub package on the x86_64 architecture, the glibc-static.i686 package must be used. Using the glibc-static.x86_64 package will not meet the build requirements.
parted component
The parted utility in Red Hat Enterprise Linux 6 cannot handle Extended Address Volumes (EAV) Direct Access Storage Devices (DASD) that have more than 65535 cylinders. Consequently, EAV DASD drives cannot be partitioned using parted, and installation on EAV DASD drives will fail. To work around this issue, complete the installation on a non EAV DASD drive, then add the EAV device after the installation using the tools provided in the s390-utils package.
PackageKit component
If you are being asked repeatedly to enter your root password while using PackageKit to update your system via non-Red Hat repositories, you may be affected by the PackageKit issue described in Section 2.11, “Desktop”.

2.4. Virtualization

ovirt-node component, BZ#747102
Upgrades from Beta to the GA version will result in an incorrect partitioning of the host. The GA version must be installed clean. UEFI machines must be set to legacy boot options for RHEV-H to boot successfully after installation.
kernel component
When a system boots from SAN, it starts the libvirtd service, which enables IP forwarding. The service causes a driver reset on both Ethernet ports which causes a loss of all paths to an OS disk. Under this condition, the system cannot load firmware files from the OS disk to initialize Ethernet ports, eventually never recovers paths to the OS disk, and fails to boot from SAN. To work around this issue add the bnx2x.disable_tpa=1 option to the kernel command line of the GRUB menu, or do not install virtualization related software and manually enable IP forwarding when needed.
kernel component
Booting Red Hat Enterprise Linux 6.2 as an HVM guest with more than one vCPU on machines that support SMEP and using Red Hat Enterprise Linux 5.7 and earlier Xen Hypervisors fails. To work around this issue, boot the guest with the nosmep kernel command line option.
vdsm component
If the /root/.ssh directory is missing from a host when it is added to a Red Hat Enterprise Virtualization Manager data center, the directory is created with a wrong SELinux context, and SSH'ing into the host is denied. To work around this issue, manually create the /root/.ssh directory with the correct SELinux context:
~]# mkdir /root/.ssh
~]# chmod 0700 /root/.ssh
~]# restorecon /root/.ssh
vdsm component
VDSM now configures libvirt so that connection to its local read-write UNIX domain socket is password-protected by SASL. The intention is to protect virtual machines from human errors of local host administrators. All operations that may change the state of virtual machines on a Red Hat Enterprise Virtualization-controlled host must be performed from Red Hat Enterprise Virtualization Manager.
libvirt component
In earlier versions of Red Hat Enterprise Linux, libvirt permitted PCI devices to be insecurely assigned to guests. In Red Hat Enterprise Linux 6, assignment of insecure devices is disabled by default by libvirt. However, this may cause assignment of previously working devices to start failing. To enable the old, insecure setting, edit the /etc/libvirt/qemu.conf file, set the relaxed_acs_check = 1 parameter, and restart libvirtd (service libvirtd restart). Note that this action will re-open possible security issues.
virtio-win component, BZ#615928
The balloon service on Windows 7 guests can only be started by the Administrator user.
libvirt component, BZ#622649
libvirt uses transient iptables rules for managing NAT or bridging to virtual machine guests. Any external command that reloads the iptables state (such as running system-config-firewall) will overwrite the entries needed by libvirt. Consequently, after running any command or tool that changes the state of iptables, guests may lose access the network. To work around this issue, use the service libvirt reload command to restore libvirt's additional iptables rules.
virtio-win component, BZ#612801
A Windows virtual machine must be restarted after the installation of the kernel Windows driver framework. If the virtual machine is not restarted, it may crash when a memory balloon operation is performed.
qemu-kvm component, BZ#720597
Installation of Windows 7 Ultimate x86 (32-bit) Service Pack 1 on a guest with more than 4GB of RAM and more than one CPU from a DVD medium often crashes during the final steps of the installation process due to a system hang. To work around this issue, use the Windows Update utility to install the Service Pack.
qemu-kvm component, BZ#612788
A dual function Intel 82576 Gigabit Ethernet Controller interface (codename: Kawela, PCI Vendor/Device ID: 8086:10c9) cannot have both physical functions (PF's) device-assigned to a Windows 2008 guest. Either physical function can be device assigned to a Windows 2008 guest (PCI function 0 or function 1), but not both.
virt-v2v component
In Red Hat Enterprise Linux 6.2, the default virt-v2v configuration is split into two files: /etc/virt-v2v.conf and /var/lib/virt-v2v/virt-v2v.db. The former now contains only local customizations, whereas the latter contains generic configuration which is not intended to be customized. Prior to Red Hat Enterprise Linux 6.2, virt-v2v's -f flag defaulted to /etc/virt-v2v.conf. In Red Hat Enterprise Linux 6.2, it now defaults to both /etc/virt-v2v.conf and /var/lib/virt-v2v/virt-v2v.db. Data from both of these files is required during conversion.
This change has no impact for most users. If a machine is upgraded from Red Hat Enterprise Linux 6.1 to Red Hat Enterprise Linux 6.2, the existing combined /etc/virt-v2v.conf will not be updated. If a user explicitly specifies -f /etc/virt-v2v.conf on the command line, the behavior will be identical to the one prior to update. If the user does not specify the -f command line option, the configuration will use both /etc/virt-v2v.conf and /var/lib/virt-v2v/virt-v2v.db, with the former taking precedence.
However, a freshly-installed Red Hat Enterprise Linux 6.2 machine with a default configuration no longer has all required data in /etc/virt-v2v.conf. If the user explicitly specifies -f /etc/virt-v2v.conf on the command line, virt-v2v will not be able to enable virtio support for any guests.
To work around this issue, do use the -f command line option, as this defaults to using both configuration files. If the -f command line option is used, it must be specified twice: first for /etc/virt-v2v.conf and second for /var/lib/virt-v2v/virt-v2v.conf.
If the virt-v2v command line cannot be altered, the /etc/virt-v2v.conf file must contain a combined configuration file. This can be copied from a Red Hat Enterprise Linux 6.1 system, or created by copying all configuration elements from /var/lib/virt-v2v/virt-v2v.db to /etc/virt-v2v.conf.
virt-v2v component, BZ#618091
The virt-v2v utility is able to convert guests running on an ESX server. However, if an ESX guest has a disk with a snapshot, the snapshot must be on the same datastore as the underlying disk storage. If the snapshot and the underlying storage are on different datastores, virt-v2v will report a 404 error while trying to retrieve the storage.
virt-v2v component, BZ#678232
The VMware Tools application on Microsoft Windows is unable to disable itself when it detects that it is no longer running on a VMware platform. Consequently, converting a Microsoft Windows guest from VMware ESX, which has VMware Tools installed, will result in errors. These errors usually manifest as error messages on start-up, and a "Stop Error" (also known as a BSOD) when shutting down the guest. To work around this issue, uninstall VMware Tools on Microsoft Windows guests prior to conversion.
spice-client component
Sound recording only works when there is no application accessing the recording device at the client start-up.

2.5. Storage and File Systems

device-mapper-multipath component
Multipath's queue_without_daemon yes default option queues I/O even though all iSCSI links have been disconnected when the system is shut down, which causes LVM to become unresponsive when scanning all block devices. As a result, the system cannot be shut down. To work around this issue, add the following line into the defaults section of /etc/multipath.conf:
queue_without_daemon no
initscripts component
Running the file system check (using fsck) on a NFS mounted file system fails, and causes the system to fail to boot and drop into a shell. To work around this issue, disable fsck on any /boot partitions by setting the sixth value of a /boot entry in /etc/fstab to 0.
iscsi-initiator-utils component, BZ#739843
iSCSI discovery via a TOE (TCP Offload Engine) interface fails when the iscsiadm -m iface has never been executed. This is due to the iscsiadm -m discovery command not checking interface settings while the iscsiadm -m iface does. To work around this issue, run the iscsiadm -m iface command at least once after installing the iscsi-initiatio-utils package. Once the interface setting is updated, discoveries are performed with no errors.
vdsm component
Attempting to create/extend a storage domain on/with a device that exposes a block size different than 512 bytes such create/extend request to fail. To work around this issue, the storage must be configured to expose a block size of 512 bytes.
kernel component, BZ#606260
The NFSv4 server in Red Hat Enterprise Linux 6 currently allows clients to mount using UDP and advertises NFSv4 over UDP with rpcbind. However, this configuration is not supported by Red Hat and violates the RFC 3530 standard.
lvm2 component
The dracut utility currently only supports one FiberChannel over Ethernet (FCoE) connection to be used to boot from the root device. Consequently, booting from a root device that spans multiple FCoE devices (for example, using RAID, LVM or similar techniques) is not possible.
lvm2 component
The pvmove command cannot currently be used to move mirror devices. However, it is possible to move mirror devices by issuing a sequence of two commands. For mirror images, add a new image on the destination PV and then remove the mirror image on the source PV:
~]$ lvconvert -m +1 <vg/lv> <new PV>
~]$ lvconvert -m -1 <vg/lv> <old PV>
Mirror logs can be handled in a similar fashion:
~]$ lvconvert --mirrorlog core <vg/lv>
~]$ lvconvert --mirrorlog disk <vg/lv> <new PV>
or
~]$ lvconvert --mirrorlog mirrored <vg/lv> <new PV>
~]$ lvconvert --mirrorlog disk <vg/lv> <old PV>
lvm2 component
Hyphens cannot be used as a part of an LVM volume group name or a logical volume name. Additionally, each name must be less than 64 characters in length, ensuring that the total length of the volume group name plus the logical volume name does not exceed 126 characters in length.

2.6. Networking

NetworkManager component
To ensure that RFC3442-standard classless static routes provided by a DHCP server are processed correctly when using NetworkManager, the following lines should be placed into the /etc/dhclient.conf file or, if using per-interface DHCP options, the /etc/dhclient-<ifname>.conf file:
option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
option ms-classless-static-routes code 249 = array of unsigned integer 8;
also request rfc3442-classless-static-routes;
also request ms-classless-static-routes;
The above lines will ensure that RFC3442 classless static routes are requested from the DHCP server, and that they are properly processed by NetworkManager.
iprutils component
Users of the IBM PCI-E Gen2 6GB SAS RADI adapter (FC 5913) in Red Hat Enterprise Linux 6.2 may encounter the following issues:
  • Updating firmware on a storage drawer that is connected to the adapter mentioned above using the iprconfig command fails.
  • Attempting to change the asymmetric access for an array results in a failure. Additionally, not specifying asymmetric access as an option to the iprconfig command results in a failure as well.

2.7. Clustering

corosync component, BZ#722469
A double ring failure results in the spinning of the corosync process. Also, because DLM relies on SCTP, which is non-functional, many features of the cluster software that rely on DLM do not work properly.
luci component, BZ#615898
luci will not function with Red Hat Enterprise Linux 5 clusters unless each cluster node has ricci version 0.12.2-14

2.8. Authentication

Identity Management component
When transitioning to a fully supported Identity Management version in Red Hat Enterprise Linux 6.2, uninstall any previous beta version of Identity Management or Technology Preview parts of Red Hat Enterprise Identity (IPA) available in the Red Hat Enterprise Linux 6.1 Technology Preview and install Identity Management again.
Identity Management component
When an Identity Management server is installed with a custom hostname that is not resolvable, the ipa-server-install command should add a record to the static hostname lookup table in /etc/hosts and enable further configuration of Identity Management integrated services. However, a record is not added to /etc/hosts when an IP address is passed as an CLI option and not interactively. Consequently, Identity Management installation fails because integrated services that are being configured expect the Identity Management server hostname to be resolvable. To work around this issue, complete one of the following:
  • Run the ipa-server-install without the --ip-address option and pass the IP address interactively.
  • Add a record to /etc/hosts before the installation is started. The record should contain the Identity Management server IP address and its full hostname (the hosts(5) man page specifies the record format).
As a result, the Identity Management server can be installed with a custom hostname that is not resolvable.
sssd component, BZ#750922
Upgrading SSSD from the version provided in Red Hat Enterprise Linux 6.1 to the version shipped with Red Hat Enterprise Linux 6.2 may fail due to a bug in the dependent library libldb. This failure occurs when the SSSD cache contains internal entries whose distinguished name contains the \, character sequence. The most likely example of this is for an invalid memberUID entry to appear in an LDAP group of the form:
memberUID: user1,user2
memberUID is a multi-valued attribute and should not have multiple users in the same attribute.
If the upgrade issue occurs, identifiable by the following debug log message:
(Wed Nov  2 15:18:21 2011) [sssd] [ldb] (0): A transaction is still active in
ldb context [0xaa0460] on /var/lib/sss/db/cache_<DOMAIN>.ldb
remove the /var/lib/sss/db/cache_<DOMAIN>.ldb file and restart SSSD.

Removing the /var/lib/sss/db/cache_<DOMAIN>.ldb file

Removing the /var/lib/sss/db/cache_<DOMAIN>.ldb file purges the cache of all entries (including cached credentials).
sssd component, BZ#751314
When a group contains certain incorrect multi-valued memberUID values, SSSD fails to sanitize the values properly. The memberUID value should only contain one username. As a result, SSSD creates incorrect users, using the broken memberUID values as their usernames. This, for example, causes problems during cache indexing.
Identity Management component, BZ#750596
Two Identity Management servers, both with a CA (Certificate Authority) installed, use two replication replication agreements. One is for user, group, host, and other related data. Another replication agreement is established between the CA instances installed on the servers. If the CA replication agreement is broken, the Identity Management data is still shared between the two servers, however, because there is no replication agreement between the two CAs, issuing a certificate on one server will cause the other server to not recognize that certificate, and vice versa.
Identity Management component
The Identity Management (ipa) package cannot be build with a 6ComputeNode subscription.
Identity Management component
On the configuration page of the Identity Management WebUI, if the User search field is left blank, and the search button is clicked, an internal error is returned.
sssd component, BZ#741264
Active Directory performs certain LDAP referral-chasing that is incompatible with the referral mechanism included in the openldap libraries. Notably, Active Directory sometimes attempts to return a referral on an LDAP bind attempt, which used to cause a hang, and is now denied by the openldap libraries. As a result, SSSD may suffer from performance issues and occasional failures resulting in missing information.
To work around this issue, disable referral-chasing by setting the following parameter in the [domain/DOMAINNAME] section of the /etc/sssd/sssd.conf file:
ldap_referrals = false

2.9. Devices

kernel component
iSCSI and FCoE boot support on Broadcom devices is not included in Red Hat Enterprise Linux 6.2. These two new features, which have been added to the bnx2i and bnx2fc Broadcom drivers in Red Hat Enterprise Linux 6.2, remain a Technology Preview until further notice.
kexec-tools component
Starting with Red Hat Enterprise Linux 6.0 and later, kexec kdump supports dumping core to the Brtfs file system. However, note that because the findfs utility in busybox does not support Btrfs yet, UUID/LABEL resolving is not functional. Avoid using the UUID/LABEL syntax when dumping core to Btrfs file systems.
kexec-tools component, BZ#600575
The persistent naming of devices that are dynamically discovered in a system is a large problem that exists both in and outside of kdump. Normally, devices are detected in the same order, which leads to consistent naming. In cases where devices are not detected in the same order, device abstraction layers (for example, LVM) essentially resolve the issue, through the use of metadata stored on the devices to create consistency. In the rare cases where no such abstraction layer is in use, and renaming devices causes issues with kdump, it is recommended that devices be referred to by disk label or UUID in kdump.conf.
trace-cmd component
The trace-cmd service does start on 64-bit PowerPC and IBM System z systems because the sys_enter and sys_exit events do not get enabled on the aforementioned systems.
trace-cmd component
trace-cmd's subcommand, report, does not work on IBM System z systems. This is due to the fact that the CONFIG_FTRACE_SYSCALLS parameter is not set on IBM System z systems.
tuned component
Red Hat Enterprise Linux 6.1 and later enter processor power-saving states more aggressively. This may result in a small performance penalty on certain workloads. This functionality may be disabled at boot time by passing the intel_idle.max_cstate=0 parameter, or at run time by using the cpu_dma_latency pm_qos interface.
libfprint component
Red Hat Enterprise Linux 6 only has support for the first revision of the UPEK Touchstrip fingerprint reader (USB ID 147e:2016). Attempting to use a second revision device may cause the fingerprint reader daemon to crash. The following command returns the version of the device being used in an individual machine:
~]$ lsusb -v -d 147e:2016 | grep bcdDevice
kernel component
The Emulex Fibre Channel/Fibre Channel-over-Ethernet (FCoE) driver in Red Hat Enterprise Linux 6 does not support DH-CHAP authentication. DH-CHAP authentication provides secure access between hosts and mass storage in Fibre-Channel and FCoE SANs in compliance with the FC-SP specification. Note, however that the Emulex driver (lpfc) does support DH-CHAP authentication on Red Hat Enterprise Linux 5, from version 5.4. Future Red Hat Enterprise Linux 6 releases may include DH-CHAP authentication.
kernel component
The recommended minimum HBA firmware revision for use with the mpt2sas driver is "Phase 5 firmware" (that is, with version number in the form 05.xx.xx.xx). Note that following this recommendation is especially important on complex SAS configurations involving multiple SAS expanders.

2.10. Kernel

kernel component
When booted off a qla4xxx device, upgrading from Red Hat Enterprise Linux 6.1 to Red Hat Enterprise Linux 6.2 will cause the system to fail to boot up with the new kernel. There are various ways to work around this issue:
  1. You have upgraded to Red Hat Enterprise Linux 6.2 and want the qla4xxx device firmware to manage discovering and logging in to iSCSI targets.
    1. Boot up the system with the Red Hat Enterprise Linux 6.1 kernel.
    2. Disable SysfsBoot for the qla4xxx device:
      ~]# echo "options qla4xxx ql4xdisablesysfsboot=1" >> /etc/modprobe.d/qla4xxx.conf
    3. Rebuild initramfs for the Red Hat Enterprise Linux 6.2 kernel by re-installing the kernel:
      ~]# yum -y reinstall kernel
  2. You have not upgraded to Red Hat Enterprise Linux 6.2 and want the qla4xxx device firmware to manage discovering and logging in to iSCSI targets.
    1. Boot up the system with the Red Hat Enterprise Linux 6.1 kernel.
    2. Disable SysfsBoot for the qla4xxx device:
      ~]# echo "options qla4xxx ql4xdisablesysfsboot=1" >> /etc/modprobe.d/qla4xxx.conf
    3. Proceed with the upgrade to Red Hat Enterprise Linux 6.2.
  3. You have upgraded to Red Hat Enterprise Linux 6.2 and want to use open-iscsi to manage the qla4xxx discovery and login process.
    1. Boot up the system with the Red Hat Enterprise Linux 6.1 kernel.
    2. Install the iscsi-initiator-utils and dracut-network packages:
      ~]# yum install -y dracut-network iscsi-initiator-utils
    3. Rebuild initramfs for the Red Hat Enterprise Linux 6.2 kernel by re-installing the kernel:
      ~]# yum -y reinstall kernel
    4. Add the iscsi_firmware kernel option into GRUB's configuration: /boot/grub/menu.lst (for LILO, the Linux Loader, modify the /etc/lilo.conf file).
  4. You have not upgraded to Red Hat Enterprise Linux 6.2 and want to use open-iscsi to manage the qla4xxx discovery and login process.
    1. Install the iscsi-initiator-utils and dracut-network packages:
      ~]# yum install -y dracut-network iscsi-initiator-utils
    2. Proceed with the upgrade to Red Hat Enterprise Linux 6.2.
    3. Add the iscsi_firmware kernel option into GRUB's configuration: /boot/grub/menu.lst (for LILO, the Linux Loader, modify the /etc/lilo.conf file).
kernel component, BZ#679262
In Red Hat Enterprise Linux 6.2, due to security concerns, addresses in /proc/kallsyms and /proc/modules show all zeros when accessed by a non-root user.
kernel component
Red Hat Enterprise Linux 6.1 PCI-Express Adapters may fail to configure on October 2011 GA IBM Power 7 systems. For more information, refer to https://access.redhat.com/kb/docs/DOC-66231.
kernel component
Superfluous information is displayed on the console due to a correctable machine check error occurring. This information can be safely ignored by the user. Machine check error reporting can be disabled by using the nomce kernel boot option, which disables machine check error reporting, or the mce=ignore_ce kernel boot option, which disables correctable machine check error reporting.
kernel component
The order in which PCI devices are scanned may change from one major Red Hat Enterprise Linux release to another. This may result in device names changing, for example, when upgrading from Red Hat Enterprise Linux 5 to 6. You must confirm that a device you refer to during installation, is the intended device.
One way to assure the correctness of device names is to, in some configurations, determine the mapping from the controller name to the controller's PCI address in the older release, and then compare this to the mapping in the newer release, to ensure that the device name is as expected.
The following is an example from /var/log/messages:
kernel: cciss0: <0x3230> at PCI 0000:1f:00.0 IRQ 71 using DAC
…
kernel: cciss1: <0x3230> at PCI 0000:02:00.0 IRQ 75 using DAC
If the device name is incorrect, add the pci=bfsort parameter to the kernel command line, and check again.
kernel component
Enabling CHAP (Challenge-Handshake Authentication Protocol) on an iSCSI target for the be2iscsi driver results in kernel panic. To work around this issue, disable CHAP on the iSCSI target.
kernel component
Newer VPD (Vital Product Data) blocks can exceed the size the tg3 driver normally handles. As a result, some of the routines that operate on the VPD blocks may fail. For example, the nvram test fails when running the ethtool –t command on BCM5719 and BCM5720 Ethernet Controllers.
kernel component
Running the ethtool -t command on BCM5720 Ethernet controllers causes a loopback test failure because the tg3 driver does not wait long enough for a link.
kernel component
The tg3 driver in Red Hat Enterprise Linux 6.2 does not include support for Jumbo frames and TSO (TCP Segmentation Offloading) on BCM5719 Ethernet controllers. As a result, the following error message is returned when attempting to configure, for example, Jumbo frames:
SIOCSIFMTU: Invalid argument
kernel component
The default interrupt configuration for the Emulex LPFC FC/FCoE driver has changed from INT-X to MSI-X. This is reflected by the lpfc_use_msi module parameter (in /sys/class/scsi_host/host#/lpfc_use_msi) being set to 2 by default, instead of the previous 0.
Two issues provide motivation for this change: SR-IOV capability only works with the MSI-X interrupt mode, and certain recent platforms only support MSI or MSI-X.
However, the change to the LPFC default interrupt mode can bring out host problems where MSI/MSI-X support is not fully functional. Other host problems can exist when running in the INT-X mode.
If any of the following symptoms occur after upgrading to, or installing Red Hat Enterprise Linux 6.2 with an Emulex LPFC adapter in the system, change the value of the lpfc module parameter, lpfc_use_msi, to 0:
  • The initialization or attachment of the lpfc adapter may fail with mailbox errors. As a result, the lpfc adapter is not configured on the system. The following message appear in /var/log/messages:
    lpfc 0000:04:08.0: 0:0:0443 Adapter failed to set maximum DMA length mbxStatus x0
    lpfc 0000:04:08.0: 0:0446 Adapter failed to init (255), mbxCmd x9 CFG_RING, mbxStatus x0, ring 0
    lpfc 0000:04:08.0: 0:1477 Failed to set up hba
    ACPI: PCI interrupt for device 0000:04:08.0 disabled
    
  • While the lpfc adapter is operating, it may fail with mailbox errors, resulting in the inability to access certain devices. The following message appear in /var/log/messages:
    lpfc 0000:0d:00.0: 0:0310 Mailbox command x5 timeout Data: x0 x700 xffff81039ddd0a00
    lpfc 0000:0d:00.0: 0:0345 Resetting board due to mailbox timeout
    lpfc 0000:0d:00.0: 0:(0):2530 Mailbox command x23 cannot issue Data: xd00 x2
    
  • Performing a warm reboot causes any subsequent boots to halt or stop because the BIOS is detecting the lpfc adapter. The system BIOS logs the following messages:
    Installing Emulex BIOS ......
    Bringing the Link up, Please wait...
    Bringing the Link up, Please wait...
    
kernel component
The minimum firmware version for NIC adapters managed by netxen_nic is 4.0.550. This includes the boot firmware which is flashed in option ROM on the adapter itself.
kernel component
The kdump kernel occasionally panics on a DELL PowerEdge R810 system with the i686 architecture.
kernel component
Running the LTP (Linux Testing Project) cgroup test suite on certain AMD systems causes NMI Watchdog to detect a hard LOCKUP and cause kernel panic.
kernel component, BZ#683012
High stress on 64-bit IBM POWER series machines prevents kdump from successfully capturing the vmcore. As a result, the second kernel is not loaded, and the system becomes unresponsive.
kernel component
Loading and unloading edac modules in a loop on certain HP systems may cause kernel panic.
kernel component
If the storage driver is loaded before multipathd is started, I/O errors occur. To work around this issue, use one of the following kernel command line parameters which are consumed by dracut:
rdloaddriver=scsi_dh_emc
or
rdloaddriver=scsi_dh_rdac
or
rdloaddriver=scsi_dh_emc,scsi_dh_rdac
The above command line parameters will cause the scsi_dh module to load before multipath is started.
kernel component
Triggering kdump to capture a vmcore through the network using the Intel 82575EB ethernet device in a 32 bit environment causes the networking driver to not function properly in the kdump kernel, and prevent the vmcore from being captured.
kernel component, BZ#701857
Attempting to hibernate certain laptops, including Lenovo ThinkPad T400 and Lenovo ThinkPad X200, can cause kernel panic.
kernel component
On a system configured with an HP Smart Array controller, during the kdump process, the capturing kernel can become unresponsive and the following error message is logged:
NMI: IOCK error (debug interrupt?)
As a workaround, the system can be configured by blacklisting the hpsa module in a configuration file such as /etc/modules.d/blacklist.conf, and specifying the disk_timeout option so that saving the vmcore over the network is possible.
kernel component
Memory Type Range Register (MTRR) setup on some hyperthreaded machines may be incorrect following a suspend/resume cycle. This can cause graphics performance (specifically, scrolling) to slow considerably after a suspend/resume cycle.
To work around this issue, disable and then re-enable the hyperthreaded sibling CPUs around suspend/resume, for example:
#!/bin/sh
# Disable hyper-threading processor cores on suspend and hibernate, re-enable
# on resume.
# This file goes into /etc/pm/sleep.d/

case $1 in
        hibernate|suspend)
                echo 0 > /sys/devices/system/cpu/cpu1/online
                echo 0 > /sys/devices/system/cpu/cpu3/online
                ;;

        thaw|resume)
                echo 1 > /sys/devices/system/cpu/cpu1/online
                echo 1 > /sys/devices/system/cpu/cpu3/online
                ;;
esac
kernel component
In Red Hat Enterprise Linux 6.2, nmi_watchdog registers with the perf subsystem. Consequently, during boot, the perf subsystem grabs control of the performance counter registers, blocking OProfile from working. To resolve this, either boot with the nmi_watchdog=0 kernel parameter set, or run the following command to disable it at run time:
echo 0 > /proc/sys/kernel/nmi_watchdog
To re-enable nmi-watchdog, use the following command
echo 1 > /proc/sys/kernel/nmi_watchdog
kernel component, BZ#603911
Due to the way ftrace works when modifying the code during start-up, the NMI watchdog causes too much noise and ftrace can not find a quiet period to instrument the code. Consequently, machines with more than 512 CPUs will encounter issues with the NMI watchdog. Such issues will return error messages similar to BUG: NMI Watchdog detected LOCKUP and have either ftrace_modify_code or ipi_handler in the backtrace. To work around this issue, disable NMI watchdog by setting the nmi_watchdog=0 kernel parameter, or using the following command at run time:
echo 0 > /proc/sys/kernel/nmi_watchdog
kernel component
On 64-bit POWER systems the EHEA NIC driver will fail when attempting to dump a vmcore via NFS. To work around this issue, utilize other kdump facilities, for example dumping to the local file system, or dumping over SSH.
kernel component, BZ#587909
A BIOS emulated floppy disk might cause the installation or kernel boot process to hang. To avoid this, disable emulated floppy disk support in the BIOS.
kernel component
The preferred method to enable nmi_watchdog on 32-bit x86 systems is to use either nmi_watchdog=2 or nmi_watchdog=lapic parameters. The parameter nmi_watchdog=1 is not supported.
kernel component
The kernel parameter, pci=noioapicquirk, is required when installing the 32-bit variant of Red Hat Enterprise Linux 6 on HP xw9300 workstations. Note that the parameter change is not required when installing the 64-bit variant.

2.11. Desktop

PackageKit component
Installing or updating packages signed with a GPG key not known or accessible to the system may throw PackageKit in a loop of password dialogues, repeatedly asking the user to confirm the installation of these packages from an untrusted source.
This issue may occur if additional third party repositories are configured on the system for which the GPG public key is not imported into the RPM database, nor specified in the respective Yum repository configuration. Official Red Hat Enterprise Linux repositories and packages should not be affected by this issue.
To work around this issue, import the respective GPG public key into the RPM database by executing the following command as root:
~]# rpm --import <file_containing_the_public_key>
gnome-power-manager component, BZ#748704
After resuming the system or re-enabling the display, an icon may appear in the notification area with a tooltip that reads:
Session active, not inhibited, screen idle. If you see this test, your display server is broken and you should notify your distributor. Please see http://blogs.gnome.org/hughsie/2009/08/17/gnome-power-manager-and-blanking-removal-of-bodges/ for more information.
This error message is incorrect, has no effect on the system, and can be safely ignored.
acroread component
Running a AMD64 system without the sssd-client.i686 package installed, which uses SSSD for getting information about users, causes acroread to fail to start. To work around this issue, manually install the sssd-client.i686 package.
kernel component, BZ#681257
With newer kernels, such as the kernel shipped in Red Hat Enterprise Linux 6.1, Nouveau has corrected the Transition Minimized Differential Signaling (TMDS) bandwidth limits for pre-G80 nVidia chipsets. Consequently, the resolution auto-detected by X for some monitors may differ from that used in Red Hat Enterprise Linux 6.0.
fprintd component
When enabled, fingerprint authentication is the default authentication method to unlock a workstation, even if the fingerprint reader device is not accessible. However, after a 30 second wait, password authentication will become available.
evolution component
Evolution's IMAP backend only refreshes folder contents under the following circumstances: when the user switches into or out of a folder, when the auto-refresh period expires, or when the user manually refreshes a folder (that is, using the menu item FolderRefresh). Consequently, when replying to a message in the Sent folder, the new message does not immediately appear in the Sent folder. To see the message, force a refresh using one of the methods describe above.
anaconda component
The clock applet in the GNOME panel has a default location of Boston, USA. Additional locations are added via the applet's preferences dialog. Additionally, to change the default location, left-click the applet, hover over the desired location in the Locations section, and click the Set... button that appears.
xorg-x11-server component, BZ#623169
In some multi-monitor configurations (for example, dual monitors with both rotated), the cursor confinement code produces incorrect results. For example, the cursor may be permitted to disappear off the screen when it should not, or be prevented from entering some areas where it should be allowed to go. Currently, the only workaround for this issue is to disable monitor rotation.

Chapter 3. New Packages

A new fcoe-target-utils package is now available as a Technology Preview for Red Hat Enterprise Linux 6.
The fcoe-target-utils package is a command line interface for configuring FCoE LUNs (Fibre Channel over Ethernet Logical Unit Numbers) and backstores.
This enhancement update adds a new fcoe-target-utils package to Red Hat Enterprise Linux 6 as a Technology Preview. (BZ#724035)
More information about Red Hat Technology Previews is available here:
All users who want to use the fcoe-target-utils Technology Preview should install this newly-released package, which adds this enhancement.
A new libunistring package is now available for Red Hat Enterprise Linux 6.
This portable C library implements the UTF-8, UTF-16 and UTF-32 Unicode string types, together with functions for character processing (names, classifications, and properties) and functions for string processing (iteration, formatted output, width, word breaks, line breaks, normalization, case folding, and regular expressions).
This enhancement update adds the libunistring package to Red Hat Enterprise Linux 6. The libunistring package has been added as a dependency for the System Security Services Daemon (SSSD) in order to process internationalized HBAC rules on FreeIPA servers. (BZ#726463)
All users who require libunistring should install this new package.
A new libvirt-qmf package is now available for Red Hat Enterprise Linux 6.
The libvirt-qmf package contains a daemon to allow remote control of the libvirt API through the Qpid Management Framework (QMF).
With this update, the libvirt-qmf package obsoletes the libvirt-qpid package, which provided similar functionality. The new package uses the matahari library to provide an interface consistent with that of other Matahari agents. (BZ#688194)

Note

After installation, it is advisable to convert existing QMF consoles, that previously connected to libvirt-qpid, to use libvirt-qmf as their interface. Also, when creating a new QMF console, it is recommended to use libvirt-qmf to communicate with libvirt.
All users requiring libvirt-qmf are advised to install this new package, which adds this enhancement.
A new libvirt-snmp package is now available for Red Hat Enterprise Linux 6.
The new package libvirt-snmp allows to control and monitor libvirt virtualization management tool by the way of the SNMP protocol. SNMP is an Internet-standard protocol for managing devices on IP networks, its modular structure allows it to be used in new fields and this new package allow virtualization management by bridging the SNMP protocol and the libvirt API.
This enhancement update adds the libvirt-snmp package to Red Hat Enterprise Linux 6. (BZ#642556, BZ#706114)
All users who require libvert-snmp are advised to install this new package.
A new openslp package is now available for Red Hat Enterprise Linux 6.
OpenSLP is an open source implementation of the Service Location Protocol (SLP) which is an Internet Engineering Task Force (IETF) standards track protocol and provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks.
This enhancement update adds the openslp package to Red Hat Enterprise Linux 6. (BZ#518286)
All users who require OpenSLP are advised to install this new package.
A new wdaemon package is now available for Red Hat Enterprise Linux 6.
The new wdaemon package contains a daemon to wrap input driver hotplugging in the X.Org implementation of the X Window System server. The wdaemon package emulates virtual input devices to avoid otherwise non-persistent configuration of Wacom tablets to persist across device removals.
This enhancement update adds the wdaemon package to Red Hat Enterprise Linux 6. (BZ#688003)
All users who require wdaemon should install this new package.
A new perl-Test-Inter package is now available for Red Hat Enterprise Linux 6.
The Test::Inter module provides a framework for writing interactive test scripts in Perl. It is inspired by the Test::More framework.
This enhancement update adds the perl-Test-Inter package to Red Hat Enterprise Linux 6. (BZ#705752)
All users who require perl-Test-Inter should install this new package.
A new python-configshell package is now available for Red Hat Enterprise Linux 6.
The python-configshell package provides a library for implementing configuration command line interfaces for the Python programming environment.
This enhancement update adds the python-configshell package to Red Hat Enterprise Linux 6 as part of the Technology Preview of Fibre Channel over Ethernet (FCoE) target mode. (BZ#726774)

Important

This package is provided as a dependency of the fcoe-target-utils package. It is recommended to install it only as a prerequisite for running fcoe-target-utils, and not to use it independently.
All users who want to use the Technology Preview of Fibre Channel over Ethernet target mode should install this newly-released package, which adds this enhancement.
A new python-ipaddr package is now available for Red Hat Enterprise Linux 6.
The python-ipaddr package is a library for working with IPv4 and IPv6 addresses for the Python programming environment.
This enhancement update adds the python-ipaddr package to Red Hat Enterprise Linux 6. (BZ#726773)

Important

This package is provided as a dependency of the fcoe-target-utils package. It is recommended to install it only as a prerequisite for running fcoe-target-utils, and not to use it independently.
All users who want to use the Technology Preview of Fibre Channel over Ethernet target mode should install this newly-released package, which adds this enhancement.
A new python-rtslib package is now available for Red Hat Enterprise Linux 6.
The python-rtslib package provides a library for interacting with storage target-related interfaces for the Python programming environment.
This enhancement update adds the python-rtslib package to Red Hat Enterprise Linux 6 as part of the Technology Preview of Fibre Channel over Ethernet (FCoE) target mode. (BZ#726778)

Important

This package is provided as a dependency of the fcoe-target-utils package. It is recommended to install it only as a prerequisite for running fcoe-target-utils, and not to use it independently.
All users who want to use the Technology Preview of Fibre Channel over Ethernet target mode should install this newly-released package, which adds this enhancement.
A new python-simpleparse package is now available for Red Hat Enterprise Linux 6.
The python-simpleparse package is a simple and fast parser generator for the Python programming environment.
This enhancement update adds the python-simpleparse package to Red Hat Enterprise Linux 6 as part of the Technology Preview of Fibre Channel over Ethernet (FCoE) target mode. (BZ#726776)

Important

This package is provided as a dependency of the fcoe-target-utils package. It is recommended to install it only as a prerequisite for running fcoe-target-utils, and not to use it independently.
All users who want to use the Technology Preview of Fibre Channel over Ethernet target mode should install this newly-released package, which adds this enhancement.
A new python-urwid package is now available for Red Hat Enterprise Linux 6.
The python-urwid package provides a library for development of text user interface applications in the Python programming environment.
This enhancement update adds the python-urwid package to Red Hat Enterprise Linux 6 as part of the Technology Preview of Fibre Channel over Ethernet (FCoE) target mode. (BZ#726775)

Important

This package is provided as a dependency of the fcoe-target-utils package. It is recommended to install it only as a prerequisite for running fcoe-target-utils, and not to use it independently.
All users who want to use the Technology Preview of Fibre Channel over Ethernet target mode should install this newly-released package, which adds this enhancement.
A new python-suds package is now available for Red Hat Enterprise Linux 6.
The python-suds package provides a lightweight implementation of the Simple Object Access Protocol (SOAP) for the Python programming environment.
This enhancement update adds the python-suds package to Red Hat Enterprise Linux 6. (BZ#681835)
All users who require python-suds are advised to install this new package.
A new sanlock package is now available for Red Hat Enterprise Linux 6.
The sanlock package provides a shared disk lock manager that uses disk paxos to manage leases on shared storage. Hosts connected to a common Storage Area Network (SAN) can use sanlock to synchronize the access to the shared disks. Both libvirt and vdsm can use sanlock to synchronize access to shared virtual machine (VM) images.
This enhancement update adds the sanlock package to Red Hat Enterprise Linux 6. (BZ#658971)
All users who require sanlock are advised to install this new package.
A new tboot package is now available for Red Hat Enterprise Linux 6.
The tboot package provides Trusted Boot (tboot), an open source pre- kernel/VMM module, that uses Intel Trusted Execution Technology (Intel TXT) to initialize the launch of a operating system kernels and virtual machines.
This enhancement update adds tboot to Red Hat Enterprise Linux 6. (BZ#691617)
All users wishing to evaluate trusted boot capabilities are advised to install this new package.
A new vios-proxy package is now available as a Technology Preview for Red Hat Enterprise Linux 6.
The vios-proxy program suite creates a network tunnel between a server in the QEMU host and a client in a QEMU guest. The proxied server and client programs open normal TCP network ports on localhost and the vios-proxy tunnel connects them using QEMU virtioserial channels.
This enhancement update adds a new vios-proxy package to Red Hat Enterprise Linux 6 as a Technology Preview. (BZ#721119)
More information about Red Hat Technology Previews is available here:
All users who want to use the vios-proxy Technology Preview should install this newly-released package, which adds this enhancement.
A new virt-who package is now available for Red Hat Enterprise Linux 6.
The virt-who package provides an agent that collects information about virtual guests present in the system and reports them to the Red Hat Subscription Manager tool.
This enhancement update adds the virt-who package to Red Hat Enterprise Linux 6. (BZ#725832)
All users are advised to install this new package.
A new wdaemon package is now available for Red Hat Enterprise Linux 6.
The new wdaemon package contains a daemon to wrap input driver hotplugging in the X.Org implementation of the X Window System server. The wdaemon package emulates virtual input devices to avoid otherwise non-persistent configuration of Wacom tablets to persist across device removals.
This enhancement update adds the wdaemon package to Red Hat Enterprise Linux 6. (BZ#688003)
All users who require wdaemon should install this new package.
New spice-gtk packages are now available for Red Hat Enterprise Linux 6.
spice-gtk is a GTK2 widget for SPICE clients. Both virt-manager and virt-viewer can make use of this widget to access virtual machines using the SPICE protocol.
This enhancement update adds spice-gtk to Red Hat Enterprise Linux 6. (BZ#708417)
All users of SPICE clients such as virt-manager or virt-viewer are advised to install these new packages.
New btparser packages are now available for Red Hat Enterprise Linux 6.
The btparser is a backtrace parser and analyzer library, which works with backtraces produced by the GNU Project Debugger. It can parse a text file with a backtrace to a tree of C structures, allowing to analyze the threads and frames of the backtrace and process them.
This enhancement update adds the btparser package to Red Hat Enterprise Linux 6. (BZ#708038)
All users who require btparser are advised to install this new package.
New sgabios packages are now available for Red Hat Enterprise Linux 6.
The sgabios packages provide the Google Serial Graphics Adapter BIOS (SGABIOS) for legacy 86-bit software to communicate with an attached serial console.
This enhancement update adds the new sgabios packages to Red Hat Enterprise Linux 6. (BZ#725832)
All users who require SGABIOS are advised to install these new packages.
New mesa-libGLw packages are now available for Red Hat Enterprise Linux 6.
The mesa-libGLw packages provide an Xt/Motif OpenGL Drawing Area Widget.
This enhancement update adds the esa-libGLw package to Red Hat Enterprise Linux 6. (BZ#729243)
All users who require mesa-libGLw are advised to install these new packages.
New tdb-tools packages are now available for Red Hat Enterprise Linux 6.
The tdb-tools packages contain tools that can be used to backup and manage tdb files created by Samba.
This enhancement update adds the tdb-tools packages to Red Hat Enterprise Linux 6. (BZ#717690)
All tdb users who wish to backup and manage tdb files are advised to install these new packages.

Chapter 4. Package Updates

4.1. 389-ds-base
4.2. abrt
4.3. acl
4.4. alsa-lib
4.5. anaconda
4.6. apr
4.7. atlas
4.8. attr
4.9. audit
4.10. augeas
4.11. autofs
4.12. autotrace
4.13. bacula
4.14. bfa-firmware
4.15. bind
4.16. bind-dyndb-ldap
4.17. binutils
4.18. biosdevname
4.19. blktrace
4.20. bltk
4.21. boost
4.22. ca-certificates
4.23. cachefilesd
4.24. certmonger
4.25. cifs-utils
4.26. cjkuni-fonts
4.27. cluster
4.28. clustermon
4.29. coolkey
4.30. coreutils
4.31. corosync
4.32. cpufrequtils
4.33. crash
4.34. crontabs
4.35. cryptsetup-luks
4.36. ctdb
4.37. cups
4.38. curl
4.39. cyrus-imapd
4.40. cyrus-sasl
4.41. dbus
4.42. device-mapper-multipath
4.43. DeviceKit-power
4.44. dhcp
4.45. dmidecode
4.46. dnsmasq
4.47. dosfstools
4.48. dovecot
4.49. doxygen
4.50. dracut
4.51. dump
4.52. e2fsprogs
4.53. ecryptfs-utils
4.54. esc
4.55. fakechroot
4.56. fcoe-utils
4.57. fence-agents
4.58. fence-virt
4.59. file
4.60. filesystem
4.61. fipscheck
4.62. firefox
4.63. firstaidkit
4.64. firstboot
4.65. foomatic
4.66. freetype
4.67. fuse
4.68. gcc
4.69. gdb
4.70. gdm
4.71. ghostscript
4.72. gimp
4.73. glibc
4.74. gnome-screensaver
4.75. gnome-session
4.76. gnome-system-monitor
4.77. gnome-terminal
4.78. gpm
4.79. gpxe
4.80. graphviz
4.81. grub
4.82. guile
4.83. httpd
4.84. hwdata
4.85. ibus
4.86. ibus-anthy
4.87. ibus-table-erbi
4.88. icedtea-web
4.89. initscripts
4.90. ipa
4.91. ipa-pki-theme
4.92. ipmitool
4.93. iproute
4.94. iprutils
4.95. iscsi-initiator-utils
4.96. isdn4k-utils
4.97. iwl1000-firmware
4.98. iwl5000-firmware
4.99. iwl6000g2a-firmware
4.100. java-1.6.0-openjdk
4.101. jss
4.102. jwhois
4.103. kabi-whitelists
4.104. kdeaccessibility
4.105. kdeadmin
4.106. kdebase
4.107. kdebase-workspace
4.108. kdelibs
4.109. kdepim-runtime
4.110. kdeutils
4.111. kernel
4.112. kexec-tools
4.113. keyutils
4.114. krb5
4.115. krb5-appl
4.116. ksh
4.117. less
4.118. libarchive
4.119. libcacard
4.120. libcap
4.121. libcgroup
4.122. libcmpiutil
4.123. libesmtp
4.124. libgcrypt
4.125. libgpg-error
4.126. libguestfs
4.127. libhbaapi
4.128. libhbalinux
4.129. libhugetlbfs
4.130. libica
4.131. libnih
4.132. libpng
4.133. librsvg2
4.134. libselinux
4.135. libsemanage
4.136. libsepol
4.137. libsndfile
4.138. libsoup
4.139. libssh2
4.140. libtirpc
4.141. libvirt
4.142. libvirt-cim
4.143. libXfont
4.144. libxml2
4.145. lldpad
4.146. lohit-assamese-fonts
4.147. lohit-bengali-fonts
4.148. lohit-gujarati-fonts
4.149. lohit-kannada-fonts
4.150. lohit-malayalam-fonts
4.151. lohit-oriya-fonts
4.152. lohit-punjabi-fonts
4.153. lohit-tamil-fonts
4.154. lohit-telugu-fonts
4.155. lsof
4.156. luci
4.157. lvm2
4.158. m17n-contrib
4.159. m17n-lib
4.160. mailcap
4.161. mailman
4.162. man-pages-ja
4.163. man-pages-overrides
4.164. matahari
4.165. mcelog
4.166. mdadm
4.167. mesa
4.168. microcode_ctl
4.169. mingetty
4.170. mingw32
4.171. mingw32-qpid-cpp
4.172. mksh
4.173. mod_nss
4.174. mod_revocator
4.175. mutt
4.176. nautilus
4.177. nautilus-open-terminal
4.178. net-snmp
4.179. net-tools
4.180. netcf
4.181. NetworkManager
4.182. NetworkManager-openswan
4.183. newt
4.184. nfs-utils
4.185. nfs-utils-lib
4.186. nmap
4.187. nspr, nss, nss-softokn, and nss-util
4.188. nss
4.189. nss-pam-ldapd
4.190. nss_db
4.191. omping
4.192. opencryptoki
4.193. openldap
4.194. openmotif
4.195. openscap
4.196. openssh
4.197. openssl
4.198. openssl-ibmca
4.199. openswan
4.200. oprofile
4.201. pacemaker
4.202. pam
4.203. pam_krb5
4.204. pam_ldap
4.205. papi
4.206. parted
4.207. pciutils
4.208. perl
4.209. perl-Date-Manip
4.210. perl-Net-DNS
4.211. perl-NetAddr-IP
4.212. perl-Sys-Virt
4.213. perl-Test-Spelling
4.214. php-pear
4.215. php53 and php
4.216. pinentry
4.217. piranha
4.218. pki-core
4.219. plymouth
4.220. policycoreutils
4.221. portreserve
4.222. postfix
4.223. postgresql
4.224. powerpc-utils
4.225. powertop
4.226. prelink
4.227. procps
4.228. pykickstart
4.229. pyparted
4.230. python
4.231. python-dmidecode
4.232. python-meh
4.233. python-netaddr
4.234. python-psycopg2
4.235. python-qpid
4.236. python-rhsm
4.237. python-virtinst
4.238. qemu-kvm
4.239. ql2400-firmware
4.240. ql2500-firmware
4.241. qpid-cpp
4.242. qpid-qmf
4.243. qpid-tests
4.244. qpid-tools
4.245. qt
4.246. qt3
4.247. RDMA
4.248. Release Notes
4.249. redhat-release
4.250. redhat-rpm-config
4.251. resource-agents
4.252. rgmanager
4.253. rhn-client-tools
4.254. rhnlib
4.255. ricci
4.256. rng-tools
4.257. rpm
4.258. rsyslog
4.259. ruby
4.260. s390utils
4.261. sabayon
4.262. samba
4.263. sblim-cmpi-base
4.264. sblim-cmpi-fsvol
4.265. sblim-cmpi-nfsv3
4.266. sblim-gather
4.267. sblim-sfcb
4.268. sblim-sfcc
4.269. sblim-smis-hba
4.270. scsi-target-utils
4.271. seabios
4.272. sed
4.273. seekwatcher
4.274. selinux-policy
4.275. setroubleshoot
4.276. setup
4.277. sg3_utils
4.278. shadow-utils
4.279. sigar
4.280. slapi-nis
4.281. smartmontools
4.282. sos
4.283. spice-client
4.284. spice-protocol
4.285. spice-server
4.286. spice-vdagent
4.287. squid
4.288. sssd
4.289. star
4.290. subscription-manager
4.291. subversion
4.292. sudo
4.293. swig
4.294. system-config-firewall
4.295. system-config-kickstart
4.296. system-config-lvm
4.297. system-config-printer
4.298. system-switch-java
4.299. systemtap
4.300. tcp_wrappers
4.301. tcsh
4.302. telnet
4.303. texlive-texmf
4.304. tftp
4.305. thunderbird
4.306. tigervnc
4.307. tmpwatch
4.308. tog-pegasus
4.309. tomcatjss
4.310. tsclient
4.311. tuned
4.312. udev
4.313. udisks
4.314. unicap
4.315. usbutils
4.316. util-linux-ng
4.317. valgrind
4.318. virt-manager
4.319. virt-top
4.320. virt-v2v
4.321. virt-viewer
4.322. virt-what
4.323. virtio-win
4.324. vte
4.325. which
4.326. wireshark
4.327. wpa_supplicant
4.328. X.Org

Warning

This is only a partial build of the Package Updates. All errata that are included in this release are not in this document yet.

4.1. 389-ds-base

Updated 389-ds-base packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.
Bug Fixes
BZ#720458
If a server sent a response to an unbind request and the client simply closed the connection, Directory Server 8.2 logged "Netscape Portable Runtime error -5961 (TCP connection reset by peer.)".
BZ#752155
An incorrect SELinux context caused AVC errors in /var/log/audit/audit.log.
BZ#711266
The DS could not restart after a new object class was created which used the entryUSN attribute.
BZ#697663, BZ#700665, BZ#711533, BZ#711241, BZ#726136, BZ#700215
A number of memory leaks and performance errors were fixed.
BZ#712167
The ns-slapd process segfaulted if suffix referrals were enabled.
BZ#711513
A high volume of TCP traffic could cause the slapd process to quit responding to clients.
BZ#714298
Attempting to delete a VLV index caused the server to hang.
BZ#720051
Connections to the DS by an RSA authentication server using simple paged results by default would timeout.
BZ#735217
Running a simple paged search against a subtree with a host-based ACI would hang the server.
BZ#733443
If the target attribute list for an ACI had syntax errors and more than five attributes, the server crashed.
BZ#734267
It was not possible to set account lockout policies after upgrading from RHDS 8.1.
BZ#720452
Adding an entry with an RDN containing a % caused the server to crash.
BZ#709868
Only FIPS-supported ciphers can be used if the server is running in FIPS mode.
BZ#711265
It is possible to disable SSLv3 and only allow TLS.
BZ#713317, BZ#713318
If the changelog was encrypted and the certificate became corrupt, the server crashed.
BZ#733434
If the passwordisglobalpolicy attribute was enabled on a chained server, a secure connection to the master failed.
BZ#714310
If a chained database was replicated, the server could segfault.
BZ#694571
Editing a replication agreement to use SASL/GSS-API failed with GSS-API errors.
BZ#742611
In replication, a msgid may not be sent to the right thread, which caused "Bad parameter to an LDAP routine" errors. This causes failures to propagate up and halt replication.
BZ#701057
Password changes were replicated among masters replication, but not to consumers.
BZ#717066
If an entry was modified on RHDS and the corresponding entry was deleted on the Windows side, the sync operation attempts to use the wrong entry.
BZ#734831
Some changes were not properly synced over to RHDS from Windows.
BZ#726273
RHDS entries were not synced over to Windows if the user's CN had a comma.
BZ#718351
Intensive update loads on master servers could break the cache on the consumer, causing it to crash.
BZ#699458
Syncing a multi-valued attribute could delete all the other instances of that attribute when a new value was added.
BZ#729817
If a synced user subtree on Windows was deleted and then a user password was changed on the RHDS, the DS would crash.
Enhancements
BZ#742382
The nsslapd-idlistscanlimit configuration attribute can be set dynamically, instead of requiring a restart.
BZ#742661
Separate resource limits can be set for paged searches, independent of resource limits for regular searches.
BZ#720459
The sudo schema has been updated.
BZ#739959
A new configuration attribute sets a different list of replicated attributes for a total update versus an incremental update.
BZ#733440
A new configuration option allows the server to be started with an expired certificate.
BZ#720461
New TLS/SSL error messages have been added to the replication error log level.
Users are advised to upgrade to these updated 389-ds-base packages, which resolve these issues and add these enhancements.
Updated 389-ds-base packages that fix multiple bugs are now available.
389 Directory Server is an LDAPv3 compliant server. The base package includes the LDAP server and command-line utilities for server administration.
Bug Fixes
BZ#701554
Password changes did not replicate because the method used to pass the changes to consumer servers was rejected on the consumer. This issue has been corrected, and password changes now replicate as expected.
BZ#701556
Values could be lost when group memberships were synchronized between 389 Directory Server and Active Directory with the Windows Sync feature. The synchronization and modify operations have been altered to prevent this issue, allowing group updates to synchronize with Active Directory.
BZ#701558
The ldclt command-line testing tool crashed during LDAP ADD operations because an LDAP attribute was not set correctly, preventing the creation of entries that did not already exist. This update allows the LDAP ADD to proceed correctly.
BZ#701559
The server crashed if a long running task was started using the cn=tasks,cn=config interface and then the server was shut down before the task completed. This update prevents the server from crashing, but does not gracefully terminate the task, which can leave the server database in an inconsistent state. For example, the fixup-memberof.pl script invokes a tasks to fix up the memberOf attribute in group member entries. If the server is shut down before the task can complete, some entries may not have the correct memberOf values. Users should ensure that tasks are complete before shutting down the server to avoid inconsistency.
BZ#701560
When using the Entry USN feature, deleting an entry caused a memory leak via the entryusn attribute. This update fixes the memory leak.
All 389-ds-base users are advised to upgrade to these updated packages, which addresses these issues.

4.2. abrt

Updated abrt and libreport packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The abrt packages contain the Automatic Bug Reporting Tool (ABRT) version 2. In comparison with ABRT version 1, this version provides more flexible configuration, which covers a variety of customer use cases that the previous version was unable to cover. It also moves a lot of data processing from the daemon to separate tools that run without root privileges, which makes the daemon less error prone and the whole processing more secure.

Note

This update obsoletes the former report tool and replaces the report library to unify the reporting process in all Red Hat applications (Anaconda, setroubleshoot, ABRT).
The most interesting feature for end-users is the problem solution searching: when ABRT is configured to report to the Red Hat Customer Portal, it tries to search Red Hat problem databases (such as Knowledge Base or Bugzilla) for possible solutions and refers the user to these resources if the solution is found.

Bug Fixes

BZ#610603
The abrt-gui application used to list plug-ins multiple times if they were configured in the configuration file. This is now fixed.
BZ#627621
In the previous version of ABRT, a daemon restart was required for any changes in the configuration to take effect. In the new version, most of the options in the configuration file no longer require a restart.
BZ#653872
Support for retrace server has been added. Refer to https://fedorahosted.org/abrt/wiki/AbrtRetraceServer for more information about this new feature.
BZ#671354
By default, ABRT stores all problem information in the /var/spool/abrt/ directory. Previously, this path was hard coded and could not be changed in the configuration. With this update, this path can be changed in the /etc/abrt/abrt.conf configuration file.
BZ#671359
The previous documentation failed to cover some customer use cases. This error has been fixed, and all of these use cases are now covered in the Red Hat Enterprise Linux 6 Deployment Guide.
BZ#673173
In ABRT version 1, it was not possible to use wildcards to specify that some action should happen for any user. ABRT version 2 adds support for this functionality.
BZ#695416
The lacking information about configuring a proxy has been added to the Red Hat Enterprise Linux 6 Deployment Guide.
BZ#707950
Previously, a bug in ABRT version 1 was preventing a local Python build to finish. This is now fixed.
BZ#725660
The previous report tool and report library have been obsoleted by abrt and libreport. Users can notice the change in the problem reporting user interface of Anaconda, setroubleshoot, and ABRT.
All users of ABRT are advised to upgrade to these updated packages, which provide numerous bug fixes and enhancements.

4.3. acl

Updated acl packages that add two enhancements are now available for Red Hat Enterprise Linux 6.
Access Control Lists (ACLs) are used to define finer-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Enhancements

BZ#720318
Prior to this update, the ACL library did not provide any function to check for extended ACLs of a file without following symbolic links. The only available function, acl_extended_file(), used to cause unnecessary mounts of autofs. This update introduces a new function, acl_extended_file_nofollow(), that checks for extended ACLs of a file without following symbolic links.
BZ#723998
Previously, the ACL library was linked without support for RELRO (read-only relocations) flags. With this update, the library is now linked with partial RELRO support.
Users of acl are advised to upgrade to these updated packages, which add these enhancements.
Updated acl packages that fix two bugs are now available for Red Hat Enterprise Linux 6.
Access Control Lists (ACLs) are used to define finer-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Bug Fixes

BZ#674883
Prior to this update, the setfacl.1 man page was not intelligible in that it did not state that removing a non-existent ACL entry is not considered to be an error. With this update, the setfacl.1 man page has been updated so that its content is now intelligible and exactly specifies the aforementioned behavior with regard to removing a non-existent ACL entry.
BZ#702638
Prior to this update, the package specification did not reflect a change of the upstream project web page address. This update corrects the respective address in the package specification.
All users of Access Control Lists should upgrade to these updated packages, which fix these bugs.

4.4. alsa-lib

Updated alsa-lib packages that fix one bug are now available for Red Hat Enterprise Linux 6.
The alsa-lib packages contain libraries for the Advanced Linux Sound Architecture (ALSA).

Bug Fix

BZ#704772
Prior to this update, the alsa output plugin for the Audacious Audio Player did not work correctly. As a result, Audacious could under certain circumstances fail to generate any sound and display error messages. With this update, alsa-lib is modified so that Audacious can now generate sound as expected.
All alsa-lib users are advised to upgrade to these updated packages, which fix this bug.

4.5. anaconda

An updated anaconda package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.
The anaconda package contains portions of the Anaconda installation program that can be run by the user for reconfiguration and advanced installation options.

Bug Fixes

BZ#641861
Issues with "interactive" mode partitioning are fixed.
BZ#731274
The network command is parsed correctly.
BZ#689996
The /boot partition on EFI systems is handled correctly.
BZ#705274
Files that are necessary for libreport and SSL installation mode have been added.
BZ#676404
Symbolic links to LVM commands have been added to the rescue image.
BZ#730650
The /sbin/cio_ignore command is added to initrd.img for IBM System z.
BZ#689029
Support for dracut-style "rdloaddriver=" and "rdblacklist=" parameters is added.
BZ#679108
Support for static addresses in "ipv6=" is added.
BZ#706099
A testing framework for stub commands is added.
BZ#699745
Driver disks support multiple kernel versions and are also built for Red Hat Enterprise Linux 6.0 and 6.1.
BZ#668570
Network connection is brought up before saving a bug report.
BZ#715130
Errors in .treeinfo are detected.
BZ#698282
The xhost authentication is changed when performing live installation.
BZ#664981, BZ#726804
Debugging improvements in loader and package installation code have been made.
BZ#679810
The dialog box focus and initialization have been corrected.
BZ#701220
The iSCSI Login button is disabled when no nodes are selected.
BZ#695362
When a mount point is set to /boot, the file system type is no longer changed.
BZ#728280, BZ#725777, BZ#723194, BZ#723344, BZ#694800, BZ#621175
EDD handling improvements have been made, including Xen and CCISS.
BZ#698429
Extended partitions are handled correctly.
BZ#681803
Handling of "network --device=bootif" is corrected.
BZ#750764
Centering of the Anaconda window when an external display is present is corrected.
BZ#605938
Encrypted device lines written to kickstart files are corrected.
BZ#618535
zFCP multipath devices can be added in the user interface as expected.
BZ#732380
iSCSI discovery that returns no devices is handled correctly.
BZ#704593
Systems with more than 2147483647 kB of memory are handled properly.
BZ#712487
The header image is hidden on all but 800x600 displays.
BZ#690058
The "noprobe" parameter for driver disks is honored.
BZ#713991
The "linksleep=" boot parameter is honored.
BZ#699640
Installation sources (including NFS ISO storages) are mounted correctly.
BZ#679397
Processes in the anaconda process group are killed when the system is shut down.
BZ#693271
Partitioning alignment is corrected.
BZ#616641
Progress indicator improvements for device discovery and command line mode have been made.
BZ#691817, BZ#690748
Kickstart network failures and device name collisions are handled properly.
BZ#691910
The "crashkernel=" parameter in a kickstart file is handled properly.
BZ#712195
Support for the "ext4migrate" parameter has been removed.
BZ#706675
The language and keyboard selection screens are now skipped in stage2 when possible.
BZ#614504
Device capacity values are sorted as numbers, not characters.
BZ#695740
Swap partitions are handled correctly.
BZ#676118
The "--target" option is used in kickstart files for iSCSI devices.
BZ#701371, BZ#696876, BZ#674241, BZ#734374, BZ#729716
Various multipath and raid storage bugs are fixed.
BZ#679073
Anaconda verifies that devices specified with "part" can be partitioned.

Enhancements

BZ#659790
Vendor-provided tools on driver disks are now allowed.
BZ#694198
The initrd.img file is compressed with LZMA.
BZ#696696
The "noverifyssl" boot parameter is added.
BZ#697419
The tboot package is configured when it is installed.
BZ#709653
Multipath device can now be specified using WWID.
Users of anaconda should upgrade to this updated package, which fixes these bugs and adds these enhancements.

4.6. apr

Updated apr packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.
Security Fix
CVE-2011-1928
The fix for CVE-2011-0419 (released via RHSA-2011:0507) introduced an infinite loop flaw in the apr_fnmatch() function when the APR_FNM_PATHNAME matching flag was used. A remote attacker could possibly use this flaw to cause a denial of service on an application using the apr_fnmatch() function.

Note

This problem affected httpd configurations using the "Location" directive with wildcard URLs. The denial of service could have been triggered during normal operation; it did not specifically require a malicious HTTP request.
This update also addresses additional problems introduced by the rewrite of the apr_fnmatch() function, which was necessary to address the CVE-2011-0419 flaw.
All apr users should upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the apr library, such as httpd, must be restarted for this update to take effect.

4.7. atlas

Updated atlas packages that add various enhancements are now available for Red Hat Enterprise Linux 6.
The ATLAS (Automatically Tuned Linear Algebra Software) project is a research effort focusing on applying empirical techniques providing portable performance. The atlas packages provide C and Fortran77 interfaces to a portably efficient BLAS (Basic Linear Algebra Subprograms) implementation and routines from LAPACK (Linear Algebra PACKage).
The atlas packages have been upgraded to upstream version 3.8.4, which adds a number of enhancements over the previous version. The atlas package now contains subpackages optimized for Linux on IBM System z architectures. (BZ#694459)
All users of atlas are advised to upgrade to these updated packages, which add these enhancements.

4.8. attr

Updated attr packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.

Bug Fixes

BZ#651119
Prior to this update, the setfattr utility could not restore the original values of the attributes when the "getfattr -e text" or "getfattr --encoding=text" command was used to dump attributes with embedded null characters. This update fixes the encoding of these values in getfattr to prevent information loss.
BZ#665049
Prior to this update, the getfattr utility followed symbolic links to directories even if the "-h" or "--no-dereference" option was specified. Additionally, the description in the getfattr(1) man page that related to this functionality was misleading. This update fixes getfattr with the "-h" option so that it no longer follows the symbolic links and the related content of the getfattr(1) man page is now correct.
BZ#665050
Prior to this update, the getfattr utility did not return a non-zero exit code when an attribute specified in the "getfattr" command did not exist. This update fixes getfattr so that it now returns a non-zero exit code when an attribute does not exist.
BZ#674870
Prior to this update, supported methods for encoding values of the extended attributes were not properly described in the setfattr(1) man page. This update adds the appropriate descriptions of the encoding methods to the setfattr(1) man page.
BZ#702639
Prior to this update, the project web page address as stated in the package specification did not reflect the change of the upstream project web page address. This update corrects the project web page address in the package specification.
BZ#727307
Prior to this update, the attr library was built without support for read-only relocations (RELRO) flags. With this update, the library is now built with partial RELRO support.
All users of attr are advised to upgrade to these updated packages, which fix these bugs.

4.9. audit

Updated audit packages that fix various bugs and add several enhancements are now available for Red Hat Enterprise Linux 6.
The audit packages contain the user space utilities for storing and searching the audit records which have been generated by the audit subsystem in the Linux 2.6 kernel.
The audit package has been upgraded to upstream version 2.1.3, which provides a number of bug fixes and enhancements over the previous version. (BZ#731723)

Bug Fixes

BZ#715279
Previously, the audit daemon was logging messages even when configured to ignore "disk full" and "disk error" actions. With this update, audit now does nothing if it is set to ignore these actions, and no messages are logged in the described scenario.
BZ#715315
Previously, the Audit remote logging client received a "disk error" event instead of "disk full" event from a server when the server's disk space ran out. This bug has been fixed and the logging client now returns the correct event in the described scenario.
BZ#748124
Prior to this update, the audit system was identifying the accept4() system call as the now deprecated paccept() system call. Now, the code has been fixed and audit uses the correct identifier for the accept4() system call.
BZ#709345
Previously, the "auditctl -l" command returned 0 even if it failed because of dropped capabilities. This bug has been fixed and a non-zero value is now returned if the operation is not permitted.
BZ#728475
When Kerberos support was disabled, some configuration options in the audisp-remote.conf file related to Kerberos 5 generated warning messages about GSSAPI support during boot. With this update, the options are now commented out in the described scenario and the messages are no longer returned.
BZ#700005
On i386 and IBM System z architectures, the "autrace -r /bin/ls" command returned error messages even though all relevant rules were added correctly. This bug has been fixed and no error messages about sending add rule data requests are now returned in the described scenario.
All audit users are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

4.10. augeas

Updated augeas packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
Augeas is a configuration editing tool. Augeas parses configuration files in their native formats and transforms them into a tree. Configuration changes are made by manipulating this tree and saving it back into native config files.
The augeas packages have been upgraded to upstream version 0.9.0, which provides a number of bug fixes and enhancements over the previous version. (BZ#691483)

Bug Fix

BZ#693539
Previously, due to a bug in the source code, parsing invalid files failed silently without any error message. With this update, error messages are provided to inform users about the problem.
All users of Augeas are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

4.11. autofs

An updated autofs package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.
The autofs utility controls the operation of the automount daemon. The automount daemon automatically mounts file systems when you use them, and unmounts them when they are not busy.
Bug Fixes
BZ#704935
The autofs utility did not reset the map entry status on a reload request. As a result, newly added map entries that had previously recorded a mount failure failed to work. With this update, autofs resets the map entry status on a reload request and map entries are mounted as expected.
BZ#704939
The autofs utility could have terminated with a segmentation fault when attempting certain mounts. This occurred due to a race condition between mount handling threads for mounts that had previously recorded a mount failure. The automount cache map entry is now verified to be valid.
BZ#704940
The automount(8) man page referred to a non-existent man page. This was caused by a typographical error in the code. With this update, the man page reference has been corrected and the man page is displayed as expected.
BZ#704929
Due to a deadlock, autofs could stop responding when attempting to mount map entries that were nested within maps. With this update, the underlying code has been changed and, where possible, nested map entries mount correctly.
BZ#704933
Prior to this update, automount could terminate unexpectedly with a pthreads error. This occurred because attempts to acquire the master map lock occasionally failed as the lock was held by another thread. With this update, the underlying code has been adapted to wait for a short time before failing.
BZ#704927, BZ#704928
When retrieving paged results from an LDAP (Lightweight Directory Access Protocol) server, autofs handled certain cases incorrectly, which caused the query to not obtain all results. This update adds the code that handles these additional cases.
BZ#704937
Prior to this update, if a key entry of an automount map began with an asterisk (*) sign, the daemon failed with a segmentation fault because the sign was not matched correctly. With this update, such asterisk signs are handled correctly.
BZ#704228
When using GSSAPI authentication, the fact that an incorrect authentication host name was being used caused the connection to fail. This update now gets the correct host name for the connection.
BZ#692816
automount was not performing sufficient sanity checks of server names in its configuration. This update corrects the configuration entry parsing.
BZ#700136
Error reporting for invalid mount locations was unclear. This update improves the error reporting.
BZ#703332
When an automount map key is present in a file map and is also present in an included map source, if the file map entry was removed and a lookup performed before a re-load was issued, the map lookup would have failed. This update corrects the logic used to determine if the lookup needs to continue into included maps.
BZ#718927
When reloading maps that include a combination of direct and indirect maps, it was possible for automount to deadlock due to incorrect lock ordering.
BZ#725931
There was inadvertent use of a small amount of GPLv3-licensed code from Samba in autofs. While this was permissible, it would have entailed explicitly relicensing autofs from "GPLv2 or later" to "GPLv3", which is not intended for autofs at this time. Therefore, the Samba-derived code has been replaced in order to maintain the "GPLv2 or later" licensing status of autofs.
Enhancements
BZ#704416
This update adds the "--dumpmaps" option to the automount command, which allows you to dump the maps from their source as seen by the automount daemon.
BZ#704932
This update adds simple Base64 encoding for LDAP and thus allows hashing of the password entries in the /etc/autofs_ldap_auth.conf configuration file.
All autofs users are advised to upgrade to this updated package, which provides numerous bug fixes and enhancements.

4.12. autotrace

Updated autotrace packages that fix one bug are now available for Red Hat Enterprise Linux 6.
AutoTrace is a program for converting bitmaps to vector graphics. Supported input formats include BMP, TGA, PNM, PPM, and any format supported by ImageMagick, whereas output can be produced in PostScript, SVG, xfig, SWF, and others.
Bug Fix
BZ#658057
When installing autotrace-devel multilib RPM packages from the optional repository, file conflicts between these packages appeared, causing the installation transaction to abort. This problem has been fixed and the installation transaction now proceeds without conflicts.
All users of autotrace are advised to upgrade to these updated packages, which resolve this issue.

4.13. bacula

Updated bacula packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
Bacula is a set of programs that allow you to manage the backup, recovery, and verification of computer data across a network of different computers.

Bug Fixes

BZ#651776
Prior to this update, the bacula packages were not distributed with the applybaculadate file. As a result, the logwatch cron script failed. The problem has been fixed by including the applybaculadate file in the bacula packages so that the logwatch cron script now works as expected.
BZ#651780
Prior to this update, the make_catalog_backup.pl script created a MySQL configuration file, which had the file permissions set to world-writeable and world-readable so that MySQL did not accept the configuration file with these permissions and the MySQL database login configuration was not used. As a result, it was not possible to complete a MySQL database dump. With this update, the configuration file is now created with correct permissions, and the MySQL database login configuration is used by MySQL so that it is now possible to complete the MySQL database dump as expected.
BZ#651786
Prior to this update, there was no option to change Bacula's runtime user. As a consequence, Bacula was always run under the root user. The problem has been fixed by adding support for the bacula-dir, bacula-fd, and bacula-sd files in the /etc/sysconfig/ directory; these files can be used for specifying a non-root user and group with the DIR_USER, FD_USER, SD_USER, and DIR_GROUP, FD_GROUP and SD_GROUP options, respectively. With this update, Bacula can be run under the specified user.
BZ#651787
Prior to this update, when creating a symbolic link to the "bscan" utility, the new link was erroneously named "dbcheck". As a result, the already existing "dbcheck" symbolic link was overwritten by the erroneous one. Thus the "dbcheck" command ran the "bscan" utility so that it was not possible to execute the "bscan" utility with the "bscan" command. The problem has been fixed in this update so that the "dbcheck" and "bscan" utilities now work as expected.
BZ#657297
Prior to this update, Bacula's default configuration missed a required option. As a result, the Bacula tray monitor component terminated unexpectedly. The problem has been fixed by adding the "Address" option to the "Director" section in the Bacula tray monitor configuration file so that the Bacula tray monitor now works as expected with the default configuration file. Note that this bug fix does not alter any existing Bacula tray monitor configuration file. As a consequence, the Bacula tray monitor can terminate unexpectedly if the existing Bacula tray monitor configuration is incorrect.
BZ#689400
Prior to this update, the backup size was computed incorrectly under certain circumstances. As a consequence, the reported size of the incremental backup could have been wrong. The problem has been fixed by correcting the backup size computation process so that the size of the incremental backup is now reported correctly.
BZ#712794
Prior to this update, the shadow-utils package was not listed among the package dependencies for Bacula. As a result, the bacula user and bacula group were not created when the shadow-utils package was not present on the system, and a warning message was displayed during the bacula packages installation. This bug has been fixed by adding shadow-utils to the package dependencies.
BZ#712804
Prior to this update, the chkconfig package, which contains the "alternatives" utility, was not listed among the package dependencies for Bacula. As a result, the bacula-dir and bacula-sd services were not configured, the "alternatives" utility was not found, and Bacula's symbolic links were not created. These problems have been fixed by adding chkconfig to the package dependencies.
All users of Bacula are advised to upgrade to these updated packages, which fix these bugs.

4.14. bfa-firmware

An updated bfa-firmware package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.
The bfa-firmware package contains the Brocade Fibre Channel Host Bus Adapter (HBA) Firmware to run Brocade Fibre Channel and CNA adapters. This package also supports the Brocade BNA network adapter.
The bfa-firmware package has been upgraded to upstream version 3.0.0.0, which provides a number of bug fixes and enhancements over the previous version. (BZ#735142)
All users of Brocade Fibre Channel and CNA adapters are advised to upgrade to this updated package, which fixes several bugs and adds various enhancements.

4.15. bind

Updated bind and bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix
CVE-2011-1910
An off-by-one flaw was found in the way BIND processed negative responses with large resource record sets (RRSets). An attacker able to send recursive queries to a BIND server that is configured as a caching resolver could use this flaw to cause named to exit with an assertion failure.
All BIND users are advised to upgrade to these updated packages, which resolve this issue. After installing the update, the BIND daemon (named) will be restarted automatically.
Updated bind and bind97 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with each description below.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix
CVE-2011-2464
A flaw was discovered in the way BIND handled certain DNS requests. A remote attacker could use this flaw to send a specially-crafted DNS request packet to BIND, causing it to exit unexpectedly due to a failed assertion.
Users of bind97 on Red Hat Enterprise Linux 5, and bind on Red Hat Enterprise Linux 6, are advised to upgrade to these updated packages, which resolve this issue. After installing the update, the BIND daemon (named) will be restarted automatically.
Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix
CVE-2011-4313
A flaw was discovered in the way BIND handled certain DNS queries, which caused it to cache an invalid record. A remote attacker could use this flaw to send repeated queries for this invalid record, causing the resolvers to exit unexpectedly due to a failed assertion.
Users of bind are advised to upgrade to these updated packages, which resolve this issue. After installing the update, the BIND daemon (named) will be restarted automatically.
Updated bind packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly.

Bug Fixes

BZ#699951
Prior to this update, the code in libdns which sends DNS requests was not robust enough and suffered from a race condition. If a race condition occurred, the "named" name service daemon logged an error message in the format "zone xxx.xxx.xxx.in-addr.arpa/IN: refresh: failure trying master xxx.xxx.xxx.xxx#53 (source xxx.xxx.xxx.xxx#0): operation canceled" even when zone refresh was successful. This update improves the code to prevent a race condition in libdns and the error no longer occurs in the scenario described.
BZ#700097
A command or script traditionally gives a non-zero exit status to indicate an error. Prior to this update, the nsupdate utility incorrectly returned the exit status "0" (zero) when the target DNS zone did not exist. Consequently, the nsupdate command returned "success" even though the update failed. This update corrects this error and nsupdate now returns the exit status "2" in the scenario described.
BZ#725577
Prior to this update, named did not unload the bind-dyndb-ldap plugin in the correct places in the code. Consequently, named sometimes terminated unexpectedly during reload or stop when the bind-dyndb-ldap plugin was used. This update corrects the code, the plug-in is now unloaded in the correct places, and named no longer crashes in the scenario described.
BZ#693982
A non-writable working directory is a long time feature on all Red Hat systems. Previously, named wrote "the working directory is not writable" as an error to the system log. This update changes the code so that named now writes this information only into the debug log.
BZ#717468
The named initscript lacked the "configtest" option that was available in earlier releases. Consequently, users of the bind initscript could not use the "service named configtest" command. This update adds the option and users can now test their DNS configurations for correct syntax using the "service named configtest" command.
All users of bind are advised to upgrade to these updated packages, which fix these bugs.

4.16. bind-dyndb-ldap

An updated bind-dyndb-ldap package that fixes several bugs is now available for Red Hat Enterprise Linux 6.
The dynamic LDAP (Lightweight Directory Access Protocol) back end is a plug-in for BIND that provides an LDAP database back-end capabilities. It features support for dynamic updates and internal caching to lift the load off of the LDAP server.

Bug Fixes

BZ#742368
Previously, the bind-dyndb-ldap plug-in could faile to honor the selected authentication method because it did not call the ldap_bind() function on reconnection. Consequently, the plug-in connected to the LDAP server anonymously. With this update, the ldap_bind() function is executed on reconnection and the plug-in uses the correct authentication method in the described scenario.
BZ#707255
The bind-dyndb-ldap plug-in failed to load new zones from the LDAP server runtime. This update adds the zone_refresh parameter to the plug-in which controls how often the zone check is performed.
BZ#745045
The bind-dyndb-ldap plug-in could fail to connect to the LDAP server. This happened when the LDAP server was using localhost and FreeIPA installation was using a name different from the machine hostname. This update adds to the plug-in the ldap_hostname option, which can be used to set the correct LDAP server hostname.
BZ#727856
The "named" process could have remained unresponsive due to a race condition in the bind-dyndb-ldap plug-in. With this update, the race condition has been resolved and the problem no longer occurs.
All users of bind-dyndb-ldap are advised to upgrade to this updated package, which fixes these bugs.

4.17. binutils

An updated binutils package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.
binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).
Bug Fixes
BZ#664640
Prior to this update, the readelf utility added 0x40 into a character in order to display a non-printing character but did not do so when processing a multibyte character. As a result, the readelf utility did not display a multibyte character in the ELF header correctly. The code has been corrected and readelf no longer displays garbled characters when processing multibyte, or non-ASCII, characters.
BZ#674925
An unneeded patch to bineutils caused a large link time degradation when using the binutils --build-id command. This update removes that patch.
BZ#689829
An Operating System (OS) Application Binary Interface (ABI) describes the low-level interface between a program and the operating system (OS/ABI). The indirect meta-function, ifunc(), whose value can be determined at load time, allows for architecture dependent optimization. Prior to this update, the OS/ABI preprocessor macro was erroneously set to UNIX - Linux instead of UNIX - System V in an ELF header by a dynamic executable which used ifunc(). This update applies a backported patch which corrects the code and the error no longer occurs.
BZ#698005
Prior to this update, the binutils' strip command, which is run as part of the RPM build process, did not copy the EI_OSABI value in the ELF file header properly, it set the value to zero. Consequently, if the EI_OSABI field of the debug file had a value of 3 (ABI tag for GNU/Linux), in the stripped file it was erroneously set to 0 (UNIX - System V). This update corrects the problem and strip now leaves the field intact.
BZ#701586
On 64-bit PowerPC platforms, the position of -ldl in the list compiler options caused unexpected behavior when compiling C++ code. If -ldl was not placed at the end of parameter list, the GNU C Compiler (GCC) failed with an error in the format:
libtest.a(some_object_file.o): undefined reference to `.dlerror'
With this update, the code has been corrected and the GCC compiler functions as expected.
BZ#707387
When compiling C source code using the GNU C Compiler (GCC), a Table Of Contents (TOC), is created for every executable file. Prior to this update, compiling C++ code using GCC for 64-bit PowerPC, using -mcmodel=small -mno-minimal-toc as options, GNU linker, (ld), erroneously decided that if a section did not make use of the TOC it could belong to any TOC group. Consequently, when a local function call was made from one section of code to another section in the same object file, due to the two sections being assigned to different TOC groups, a failure occurred and an error message in the following format was logged.
libbackend.a(cse.o)(.text.unlikely+0x60): sibling call optimization to `.opd' does not allow automatic multiple TOCs; recompile with -mminimal-toc or -fno-optimize-sibling-calls, or make `.opd' extern
This update applies an upstream patch to improve the partitioning of sections of code, which make local function calls, into multiple TOC groups. As a result the error no longer occurs in the scenario described.

Note

It is necessary to relink executables and shared libraries containing objects which were compiled with -mcmodel=small -mno-minimal-toc. Therefore code should be recompiled by running these commands again after applying the update.
BZ#714824
Prior to this update, after compiling a kernel from source code with debugging information, some debug information was missing. Consequently, when using the GNU Project's debugger (GDB) utility, if a user issued the command l setup_arch to determine the target architecture, the following error was displayed.
No line number known for setup_arch
This update corrects the code and the GDB utility now correctly displays the architecture for which the code was compiled.
BZ#721079
Compilers used for producing code optimized for 64-bit PowerPC platforms use the default Red Hat Enterprise Linux system linker, ld, provided with the operating system to produce executables and libraries. Some object code generated by the IBM XL compiler caused ld to terminate unexpectedly with a segmentation fault. Consequently, users were not able to produce optimized executables or libraries. With this update, a backported patch has been applied to correct the problem and ld no longer crashes in the scenario described.
BZ#733122
When linking FORTRAN programs with the IBM XL compiler and the default Red Hat Enterprise Linux 6.1 system linker, ld sometimes terminated unexpectedly with a segmentation fault. This updates applies an upstream patch to correct the problem and ld no longer crashes in the scenario described.
BZ#747695
The assembler, as, when generating a memory reference to a local symbol plus or minus an offset, did not include the constant offset when generating 32-bit x86 code. Consequently, when the local symbol being referenced was defined before the instruction using the symbol with an offset, an error would occur. This update corrects the code and the problem no longer occurs.
Enhancements
BZ#696368
With this update, backported patches have been included to support new AMD processors.
BZ#696494
Certain Intel processors support a new RdRand instruction to generate a true random number in a short time. This update includes support for this new instruction.
Users of binutils are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.
An updated binutils package that fixes one bug is now available for Red Hat Enterprise Linux 6.
The binutils package is a collection of programming tools for the manipulation of object code in various object file formats.

Bug Fix

BZ#721079
Prior to this update, an input object file could have a non-empty .toc section but no references to the .toc entries because of a problem in the 64-bit PowerPC linker TOC editing code. As a result, various utilities of the binutils package terminated unexpectedly with a segmentation fault under certain conditions. This update handles local symbols in .toc sections correctly. Now, no more crashes occur.
Users of binutils are advised to upgrade to this updated package, which fixes this bug.

4.18. biosdevname

An updated biosdevname package that fixes several bugs and adds various enhancements are now available for Red Hat Enterprise Linux 6.
The biosdevname package contains an optional convention for naming network interfaces; it assigns names to network interfaces based on their physical location. The package is disabled by default, except for a limited set of Dell PowerEdge, C Series and Precision Workstation systems.
The biosdevname package has been upgraded to upstream version 0.3.11, which provides a number of bug fixes and enhancements over the previous version. (BZ#696203)

Bug Fixes

BZ#700248
When NPAR (NIC Partitioning) is enabled, the partition number should be appended as a suffix to the interface name. Previously, biosdevname did not add partition numbers to interface names, for example, instead of naming an interface "em3_1", the interface was named "em3". Consequently, partitioned network interfaces were missing the suffix necessary to describe the partition. Now, biosdevname correctly recognizes the VPD (Vital Product Data) suffix and full interface names are created correctly.
BZ#700251
When biosdevname ran in a guest environment, it suggested names to new network interfaces as if it was in a host environment. Consequently, affected network interfaces were incorrectly renamed. Now, biosdevname no longer suggests names in the described scenario.
BZ#729591
When biosdevname was reading VPD information to retrieve NPAR-related data, the read operations failed or became unresponsive on certain RAID controllers. Additionally, biosdevname sometimes attempted to read beyond the VPD boundary in the sysfs VPD file, which also resulted in a hang. This bug has been fixed and biosdevname now performs the read operation correctly in the described scenarios.
BZ#739592
Previously, the "--smbios" and "--nopirq" command-line parameters were missing in the biosdevname binary. Consequently, consistent network device naming could not be enabled because biosdevname exited without suggesting a name. This update adds support for these parameters and enables the device naming.
BZ#740532
Previously, NICs (Network Interface Cards) on biosdevname-compatible machines were given traditional "eth*" names instead of "em*" or "p*p*" names. This bug has been fixed and biosdevname now provides correct names for the NICs.

Enhancements

BZ#696252
With this update, "--smbios" and "--nopirq" command-line parameters have been added to biosdevname.
BZ#736442
The biosdevname man page has been updated to explain the functionality of the "--smbios" and "--nopirq" command-line parameters.
Users of biosdevname are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.

4.19. blktrace

Updated blktrace packages that fix one bug and add one enhancement are now available for Red Hat Enterprise Linux 6.
The blktrace packages contain a number of utilities to record the I/O trace information for the kernel to user space, and utilities to analyze and view the trace information.

Bug Fix

BZ#705128
Prior to this update, the blkparse code contained a misprint. As a result, blkparse used the wrong variable when printing the PC Writes Completed. This update modifies the code so that blkparse now prints the correct value for PC Writes Completed.

Enhancement

BZ#736399
This update adds FLUSH/FUA support to blktrace.
All blktrace users are advised to upgrade to these updated packages, which fix this bug and add this enhancement.

4.20. bltk

An updated bltk package that fixes two bugs is now available for Red Hat Enterprise Linux 6.
The bltk (Battery Life Tool Kit) package includes binaries and scripts to test battery life.

Bug Fixes

BZ#618308
Prior to this update, the bltk tree was corrupted. As a result, the bltk_report script failed. This update modifies the settings of the bltk root path. Now, the report script works as expected.
BZ#679028
Prior to this update, bltk could be installed without requiring the gnuplot binary. As a result, the bltk_plot script exited with an error message when the gnuplot package was not installed and the charts were shown from measured data. This update requires the gnuplot package for its installation. Now, the bltk_plot script no longer exits with an error.
All bltk users are advised to upgrade to this updated package, which fixes these bugs.

4.21. boost

Updated boost packages that fix one bug are now available for Red Hat Enterprise Linux 6.
Boost provides free peer-reviewed portable C++ source libraries, with emphasis on libraries which work well with the C++ Standard Library.

Bug Fix

BZ#723503
Prior to this update, the cyclic redundancy check (CRC) was not correctly computed on 64-bit architectures during decompression of gzip archives. In this update, constant-width integer types are used to compute CRC to make the results stable across all architectures.
Users of Boost are advised to upgrade to these updated packages which fix this bug.

4.22. ca-certificates

An updated ca-certificates package that fixes one security issue is now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact.
This package contains the set of CA certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI).
Security Fix
BZ#734381
It was found that a Certificate Authority (CA) issued fraudulent HTTPS certificates. This update removes that CA's root certificate from the ca-certificates package, rendering any HTTPS certificates signed by that CA as untrusted.
All users should upgrade to this updated package. After installing the update, all applications using the ca-certificates package must be restarted for the changes to take effect.

4.23. cachefilesd

An updated cachefilesd package that fixes two bugs is now available for Red Hat Enterprise Linux 6.
The cachefilesd package manages a kernel module that attempts to improve the performance of selected file systems by using local disk space to cache data read over the network.

Bug Fixes

BZ#660347
Prior to this update, cachefilesd used the wrong log level for cull info messages. As a result, the /var/log/messages file could become overloaded. This update reduces the messages to the debug level. Now, /var/log/messages no longer becomes overloaded.
BZ#723890
Prior to this update, cachefilesd depended on a specific version of the SELinux policy package. As a result, only the nominated version was allowed. This update permits the nominated version and any later versions. Now, the SELinux policy dependency works as expected.
All users of cachefilesd are advised to upgrade to this updated package, which fixes these bugs.

4.24. certmonger

An updated certmonger package that fixes multiple bugs is now available for Red Hat Enterprise Linux 6.
The certmonger service monitors certificates as the date at which they become invalid approaches, optionally attempting to re-enroll with a supported certificate authority (CA) to keep the services which use the certificates running without incident.

Bug Fixes

BZ#692766
Previously, the certmonger service could access a Network Security Services (NSS) database without a password, despite being configured to use a password to access that database. This behavior was not recognized as an error. This update correctly diagnoses this inconsistency as an error.
BZ#694184
Previously, if the certmonger service could not generate a key pair in an NSS database because it did not have the password that was required for accessing the database, the certmonger service did not recover when it was subsequently given the correct password. This update handles this case correctly.
BZ#697058
Previously, the certmonger service did not correctly diagnose a missing token if the name of the token to use was specified when the service was instructed to generate a key pair for storage in an NSS database. This update corrects this error.
BZ#712500
Previously, the certmonger service encountered an assertion failure if the D-Bus message bus service was not already running when certmonger was started. This update modifies the certmonger service so that no more assertion problems occur in such a situation.
BZ#721392
Previously, when the getcert command needed to report an error message which it received from the certmonger service, it exited unexpectedly due to a logic error. This update corrects the logic so that the error message is correctly reported.
BZ#727863
Previously, the certmonger service was not fully compatible with newer versions of the xmlrpc-c and libcurl packages. As a result, credentials could not be delegated when using GSSAPI authentication with a CA that was accessed via XML-RPC. This update includes the necessary changes to continue to be able to delegate credentials when using GSSAPI authentication with a CA that is accessed using XML-RPC, such as IPA.
BZ#699059, BZ#739903
Previously, when the getcert request command was given a location for key or certificate storage using a relative path, and the location did not exist, the error was only reported after multiple warnings during which the command attempted to convert the relative path to an absolute path. This update suppresses these warnings.
BZ#741262
Previously, an incorrect error message was displayed if the getcert resubmit command was invoked with the -i flag to specify which request should be resubmitted to a CA but no request that matched the provided value was present. This update displays the correct error message.
BZ#742348
Due to a logic error, attempts to save a newly-obtained certificate to an NSS database could fail intermittently. This update corrects the error.

Enhancements

BZ#698772
Previously, the getcert list command only printed information about every certificate and enrollment request being managed by certmonger, and there was no way to narrow down the results. This update includes an updated version of the command which can narrow the result set if the invoking user provides information about the location of the certificate or key in which the user is interested
BZ#750617
This update now includes an HTTP "Referer:" header value when submitting requests to CAs which are accessed using XML-RPC, as is expected to be required by future releases of the IPA CA.
All users of the certmonger service are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.
An updated certmonger package that fixes one bug is now available for Red Hat Enterprise Linux 6.1.
An updated certmonger package that fixes one bug is now available for Red Hat Enterprise Linux 6.1.
The certmonger service monitors certificates, warning of their impending expiration, and optionally attempting to re-enroll with supported CAs (Certificate Authorities).

Bug Fix

BZ#729803
When submitting a signing request to a Red Hat IPA (Identity, Policy, Audit) CA, certmonger is expected to authenticate using the client's host credentials, and to delegate the client's credentials to the server. Recent updates to libraries on which certmonger depends changed delegation of client credentials from a mandatory operation to an optional operation that is no longer enabled by default, which effectively broke certmonger's support for IPA CAs. This update gives certmonger the ability to explicitly request credential delegation when used with newer versions of these libraries, which introduce an API that allows certmonger to explicitly request that credential delegation be performed.
All certmonger users are advised to upgrade to this updated package, which fixes this bug.

4.25. cifs-utils

An updated cifs-utils package that fixes two bugs is now available for Red Hat Enterprise Linux 6.
The cifs-utils package contains utilities for mounting and managing CIFS shares.

Bug Fixes

BZ#676439
Prior to this update, mount.cifs dropped the CAP_DAC_READ_SEARCH flag together with most of the other capability flags before it performed a mount. As a result, mounting onto a directory without execute permissions failed if mount.cifs was installed as a setuid program and the user mount was configured in the /etc/fstab file. This update reinstates the CAP_DAC_READ_SEARCH flag before calling mount. Now, mounting no longer fails.
BZ#719363
Prior to this update, several mount options were missing from the mount.cifs(8) man page. With this update, the man page documents all mount options.
All users of cifs-utils are advised to upgrade to this updated cifs-utils package, which fixes these bugs.

4.26. cjkuni-fonts

Updated cjkuni-fonts packages that fix one bug are now available for Red Hat Enterprise Linux 6.
CJK Unifonts are Unicode TrueType fonts derived from original fonts made available by Arphic Technology under the Arphic Public License and extended by the CJK Unifonts project.

Bug Fix

BZ#682650
Prior to this update, when viewing the U+4190 CJK character with the AR PL UMing font and the font size 10, this character was not displayed properly. This bug has been corrected in this update so that the character is now correctly displayed as expected.
All users of cjkuni-fonts are advised to upgrade to these updated packages, which fix this bug.

4.27. cluster

Updated cluster and gfs2-utils packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The cluster packages contain the core clustering libraries for Red Hat High Availability as well as utilities to maintain GFS2 file systems for users of Red Hat Resilient Storage.
Bug Fixes
BZ#707115
The cluster and gfs2-utils packages have been upgraded to upstream version 3.0.12.1, which provides a number of bug fixes over the previous version.
BZ#713977
Previously, when a custom multicast address was configured, the configuration parser incorrectly set the default value of the time-to-live (TTL) variable for multicast packet to 0. As a consequence, cluster nodes were not able to communicate with each other. With this update, the default TTL value is set to 1, which fixes the problem.
BZ#726777
A section describing the "suborg" option for the fence_cisco_usc agent was not present in the RELAX NG schema which is used to validate the cluster.conf file. As a consequence, validation of cluster.conf failed even if the file was valid. The suborg section has been added to the RELAX NG schema and cluster.conf is now validated correctly.
BZ#707091
Building the resource group index for a new GFS2 file system using the mkfs.gfs2 utility used all the space allocated. If the file system filled up completely, no room was left to write a new rindex entry. As a consequence, the gfs2_grow utility was unable to expand the file system. The mkfs.gfs2 utility has been modified so that enough space is now allocated for the entire rindex file, and one extra rindex entry. The gfs2_grow source code has been modified to utilize the unused rindex space. As a result, gfs2_grow is now able to expand a completely full GFS2 file system.
BZ#678585
GFS2 POSIX (Portable Operating System Interface) lock operations (implemented in Distributed Lock Manager, also known as DLM) are not interruptible when they wait for another POSIX lock. Previously, processes that created a deadlock with POSIX locks could not be killed to resolve the problem, and one node had to be reset. DLM now uses a new kernel feature that allows the waiting process to be killed, and information about the killed process is now passed to the dlm_controld daemon to be cleaned up. Processes deadlocked on GFS2 POSIX locks can now be recovered by killing one or more of them.
BZ#719135
Prior to this update, boundaries for the locktable and label fields in the GFS2 superblock were not properly checked by the tunegfs2 tool. As a consequence, running the "gfs2_tool sb" command could terminate unexpectedly with buffer overflow. In addition, invalid characters could be printed when using tunegfs2 to change locktable or label to a minimum or maximum length (63 characters). The tunegfs tool has been modified to check the correct boundaries of the locktable and label fields. As a result, tunegfs2 no longer creates invalid locktables or labels, and therefore gfs2_tool prints the superblock values properly.
BZ#740385
When executing the cman utility by using the init script with enabled debugging, a file descriptor leaked. The file pointed to the file descriptor would continue to grow endlessly, filling up the /tmp file system. This update ensures that the file descriptor is closed after a successful cman startup. Space in /tmp is now released correctly.
BZ#695795
The cman utility implements a complex set of checks to configure the Totem protocol. One of the checks that copies the configuration data was incorrect and the transport protocol option was not handled correctly as a consequence. A patch has been applied to address this issue and cman now handles the transport option properly.
BZ#679566
When the user executed the "gfs2_edit savemeta" command to save the metadata for a target GFS2 file system, not all of the directory information was saved for large directories. If the metadata was restored to another device, the fsck.gfs2 tool found directory corruption because of a missing leaf block. This was due to gfs2_edit treating the directory leaf index (also known as the directory hash table) like a normal data file. With this update, gfs2_edit's savemeta function is modified to actually read all the data (the directory hash table) for large directories and traverse the hash table, saving all the leaf blocks. Now, all leaf blocks are saved properly.
BZ#679080
When the fsck.gfs2 tool was resolving block references and no valid reference was found, the reference list became empty. As a consequence, fsck.gfs2 check in pass1b terminated unexpectedly with a segmentation fault. With this update, pass1b is modified to check that the list is empty. The segmentation fault no longer occurs and fsck.gfs2 proceeds as expected.
BZ#731775
The dlm_controld daemon passed error results back to the kernel for POSIX unlock operations flagged with CLOSE. As a consequence, the kernel displayed the "dlm: dev_write no op" error messages, most of them when using non-POSIX locks, flocks. The dlm_controld daemon has been fixed to not pass error results to the kernel for POSIX unlock operations flagged with CLOSE. As a result, error messages no longer appear.
BZ#729071
Previously, the mount.gfs2 utility passed the "loop" option to the GFS2 kernel module which treated it as an invalid option. Mounting a GFS2 file system on loopback devices failed with an "Invalid argument" error message. With this update, mount.gfs2 is modified to avoid passing the "loop" option to the kernel. Mounting GFS2 systems on loopback devices now works as expected.
BZ#728230
Missing sanity checks related to the length of a cluster name caused the cman utility to fail to start. The correct sanity checks have been implemented with this update. The cman utility starts successfully and informs the user of the incorrect value of the cluster name, if necessary.
BZ#726065
The XML format requires special handling of certain special characters. Handling of these characters was not implemented correctly, which caused the cluster.conf file to not function as expected. Correct handling of the characters has been implemented and cluster.conf now works as expected.
BZ#706141
The exact device/mount paths were not compared due to incorrect logic in mount.gfs2 when trying to find mtab entries for deletion. The original entry was not found during remounts and therefore was not deleted. This resulted in double mtab entries. With this update, the realpath() function is used on the device/mount paths so that they match the content of mtab. As a result, the correct original mtab entry is deleted during a remount, and a replacement entry with the new mount options is inserted in its place.
BZ#720668
Previously, mkfs.gfs2 treated normal files incorrectly as if they were block devices. Attempting to create a GFS2 file system on a normal file caused mkfs.gfs2 to fail with a "not a block device" error message. Additional checks have been added so that mkfs.gfs2 does not call functions specific for block devices on normal files. GFS2 file systems can now be created on normal files. However, use of GFS2 in such cases is not recommended.
BZ#719126
The tunegfs2 command line usage message was not updated to reflect the available arguments which are documented in the man page. As a consequence, tunegfs2 printed an inaccurate usage message. The usage message has been updated and tunegfs2 now prints an accurate message.
BZ#719124
Previously, certain argument validation functions did not return error values, and tunegfs2 therefore printed confusing error messages instead of exiting quietly. Error handling has been improved in these validation functions, and tunegfs2 now exits quietly instead of printing the confusing messages.
BZ#694823
Previously, the gfs2_tool command printed the UUID (Universally Unique Identifier) output in uppercase. Certain applications expecting the output being in lowercase (such as mount) could have malfunctioned as a consequence. With this update, gfs2_tool is modified to print UUIDs in lowercase so that they are in a commonly accepted format.
BZ#735917
The qdisk daemon did not allow cman to upgrade the quorum disk device name. The quorum disk device name was not updated when the device was changed and, in very rare cases, the number of qdiskd votes would therefore not be correct. A new quorum API call has been implemented to update the name and votes of a quorum device. As a result, quorum disk device names and votes are updated consistently and faster than before.
BZ#683104
Prior to this update, the fsck.gfs2 utility used the number of entries in the journal index to look for missing journals. As a consequence, if more than one journal was missing, not all journals were rebuilt and subsequent runs of fsck.gfs2 were needed to recover all the journals. Each node needs its own journal; fsck.gfs2 has therefore been modified to use the "per_node" system directory to determine the correct number of journals to repair. As a result, fsck.gfs2 now repairs all the journals in one run.
BZ#663397
Previously, token timeout intervals of corosync were larger than the time it took a failed node to rejoin the cluster. Consequently, corosync did not detect that a node had failed until it rejoined. The failed node had been added again before the dlm_controld daemon asked corosync for the new member list, but dlm_controld did not notice this change. This eventually caused the DLM (Distributed Lock Manager) lockspace operations to get stuck. With this update, dlm_controld can notice that a node was removed and added between checks by looking for a changed incarnation number. Now, dlm_controld can properly handle nodes that are quickly removed and added again during large token timeouts.
BZ#732991
Previously, if a cluster was configured with a redundant corosync ring, the dlm_controld daemon would log harmless EEXIST errors, "mkdir failed: 17". This update removes these error messages so that they no longer appear.
Enhancements
BZ#733345
The corosync IPC port allows, when configured correctly, non-privileged users to access corosync services. Prior to this update, the cman utility did not handle such connections correctly. As a consequence, users were not able to configure unprivileged access to corosync when it was executed using cman. This update adds support to cman to configure unprivileged access. As a result, configured users and groups can now access corosync services without root privileges.
BZ#680930
This update introduces dynamic schema generation, which provides a lot of flexibility for end users. Users can plug into Red Hat Enterprise Linux High Availability Add-On custom resource and fence agents, and still retain the possibility to validate their cluster.conf file against those agents.
BZ#732635, BZ#735912
This update adds support for Redundant Ring Protocol, which aligns the default configuration of cman with corosync. Note that this enhancement is included as a Technology Preview.
BZ#702313
Previously, gfs2_edit saved GFS2 metadata uncompressed. Saved GFS2 metadata sets could have filled up a lot of storage space, and transferring them (for example, for support and debugging) would be slow. This update adds gzip compression to the metadata saving and restoring functions of gfs2_edit. GFS2 metadata sets are now compressed when saving and decompressed when restoring them. The user can specify the compression level with a command line option.
BZ#704178
With this update, the tunegfs2 utility replaces the superblock manipulating feature of gfs2_tool.
BZ#673575
Previously, the fence_scsi agent did not reboot a node when it was fenced. As a consequence, the node had to be rebooted manually before rejoining the cluster. This update provides a script for detecting loss of SCSI reservations. This can be used in conjunction with the watchdog package in order to reboot a failed host.
Users of cluster and gfs2-utils are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.
Updated cluster and gfs2-utils packages that fix one bug are now available for Red Hat Enterprise Linux 6.
The Red Hat Cluster Manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure. Using redundant hardware, shared disk storage, power management, and robust cluster communication and application failover mechanisms, a cluster can meet the needs of the enterprise market.

Bug Fix

BZ#728247
Prior to this update, the "suborg" option was not allowed by the cluster configuration schema defined in the /usr/share/cluster/cluster.rng file. As a consequence, when the "suborg" option was specified for the fence_cisco_ucs agent, the cluster refused to validate the configuration schema. The "suborg" option is now properly recognized, which fixes the problem.
All users of cluster and gfs2-utils are advised to upgrade to these updated packages, which resolve this bug.
Updated cluster and gfs2-utils packages that fix one bug are now available for Red Hat Enterprise Linux 6.
The Red Hat Cluster Manager is a collection of technologies working together to provide data integrity and the ability to maintain application availability in the event of a failure. Using redundant hardware, shared disk storage, power management, and robust cluster communication and application failover mechanisms, a cluster can meet the needs of the enterprise market.

Bug Fix

BZ#720100
Previously, when a custom multicast address was configured, the configuration parser incorrectly set the default value of the time-to-live (TTL) variable for multicast packet to 0. Consequently, cluster nodes could not communicate with each other. With this update, the default TTL value is set to 1, thus fixing this bug.
Users of cluster and gfs2-utils are advised to upgrade to these updated packages, which fix this bug.

4.28. clustermon

Updated clustermon packages that fix a bug and add an enhancement are now available for Red Hat Enterprise Linux 6.
The clustermon packages are used for remote cluster management.

Bug Fix

BZ#634373
Previously, the clustermon tool failed to shut down nodes if the user had mounted a GFS2 file system that was not listed in the /etc/fstab file. This was caused by clustermon relying on the rgmanager tool and the GFS2 init scripts to unmount all file systems, but the cluster stack would not stop properly if the user mounted the file system manually. This has been fixed: clustermon now ensures that there are no cluster file systems mounted and then attempts to stop the cluster stack.

Enhancement

BZ#724978
The "get_cluster_schema" function call has been added to allow users to easily get the XML cluster schema content.
All users of clustermon are advised to upgrade to this updated packages, which resolves this bug.

4.29. coolkey

An enhanced coolkey package is now available for Red Hat Enterprise Linux 6.
The coolkey package contains driver support for CoolKey and Common Access Card (CAC) smart card products.

Enhancements

BZ#578690
This update adds support for Personal Identity Verification (PIV) smart cards.
BZ#700907
Common Access Cards (CAC) are defined to have exactly three certificates. However, some cards that used the CAC interface supplied one or two certificates only, which may have caused the coolkey utility to fail. CAC smart cards that contain less than three certificates are now supported.
Users of PIV and CAC smart cards are advised to upgrade to this updated package, which adds these enhancements.

4.30. coreutils

Updated coreutils packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
The coreutils packages contain the core GNU utilities. These packages combine the old GNU fileutils, sh-utils, and textutils packages.

Bug Fixes

BZ#691292
Prior to this update, SELinux appeared to be disabled when building coreutils in Mock. As a result, coreutils did not build. With this update, SELinux determines more precisely whether it is disabled or not. Now, the packages are built successfully.
BZ#703712
Previously, incorrect signal handling could cause various problems for tcsh users logging into the root shell using the su utility. Signal masking in the subshell called by the su utility has been modified to respect the SIGTSTP signal as well as the SIGSTOP signal.
BZ#715557
When using the "-Z/--context" option in the cp utility, the SELinux context of a file was not changed if the file destination already existed. The utility has been modified and the context is changed as expected. However, this option is not portable to other systems.
BZ#720325
Prior to this update, the acl_extended_file() function could cause unnecessary mounts of autofs when using the ls command on a directory with autofs mounted. This update adds the new acl function, acl_extended_file_nofollow(), to prevent unnecessary autofs mounts.
BZ#725618
The description of the "--sleep-interval" option in the tail(1) manual page has been improved to be clearer about the behavior and to match the upstream version of coreutils.
All users of coreutils are advised to upgrade to these updated packages, which fix these bugs.

4.31. corosync

Updated corosync packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The corosync packages provide the Corosync Cluster Engine and C Application Programming Interfaces (APIs) for Red Hat Enterprise Linux cluster software.
Bug Fixes
BZ#677583
Prior to this update, the corosync-blackbox command could, under certain circumstances, produce a backtrace in the output and consequently terminate with a segmentation fault. With this update, Corosync creates correct fdata files and also corosync-fplay is more resistant when dealing with incorrect fdata files.
BZ#677583
Prior to this update, cpg did not use the "left_nodes" field in the downlist message. As a consequence, a node could miss a configuration change and report larger old_members than expected if one node was paused. This update modifies the downlist so that the "left_nodes" field is used. Now, the membership events are correct.
BZ#692620
Prior to this update, cpg did not use the "left_nodes" field in the downlist message. As a consequence, a node could miss a configuration change and report larger old_members than expected if one node was paused. This update modifies the downlist so that the "left_nodes" field is used. Now, the membership events are correct.
BZ#696883
Prior to this update, running Corosync could cause a segmentation fault on multiple nodes when executed via CMAN. This update modifies the code so that executing Corosync via CMAN no longer causes segmentation faults with the pacemaker test suite.
BZ#696887
Prior to this update, the reference counting on the configuration server in Corosync was incorrect. As a consequence, terminating the corosync-cfgtool -r command before completing caused a segmentation fault. This update adds the correct reference counting for each architecture. Now, Corosync no longer encounters segmentation faults in this situation.
BZ#707860
Prior to this update, Corosync could terminate with a segmentation fault if it ran out of available open files. This update handles the maximum number of open files more gracefully. Now, Corosync no longer crashes when going over open file limits.
BZ#707867
Prior to this update, corosync-objctl could not create a new object/key and display double or float values. This update adds float and double support to corosync-objctl. Now, corosync-objctl can display object values with double or float types.
BZ#707873
Prior to this update, Corosync could terminate with a segmentation fault if it encountered a negative value for the message type on systems where char is signed. This update improves the check of the message type for incoming messages.
BZ#707875
Prior to this update, an error message was wrongly displayed if files in the service.d directory differed from the service key. With this update, Corosync longer checks for sub parameters in files in the service.d directory. Now, files in service.d directory can contain every possible configuration option.
BZ#709758
Prior to this update, Corosync used a spinlock around I/O operations. As a consequence, Corosync consumed an extremely high portion of the central processing unit (CPU) when running a large amount of inter-process communication (IPC) operations because the spinlocks would spin during I/O. This update replaces the spinlock with a mutual exclusion (mutex), which releases the processor from spinning but enforces correct behavior.
BZ#712115
Prior to this update, an incorrect mutex in the internal confdb data storage system could, under certain circumstances, cause Corosync to terminate with a segmentation fault. This update corrects the mutex and objdb API iteration no longer causes Corosync to terminate with a segmentation fault.
BZ#712188
Prior to this update, Corosync became locked with contrived test cases when the tracking functionality of the internal object database was enabled if it was under heavy load. This update modifies Corosync so that the tracking functionality under heavy load no longer causes Corosync to lock up.
BZ#725058
Prior to this update, retransmit list errors could occur on slower hardware due to high multicast traffic and slow CPU usage. This update processes the multicast buffer queue more frequently and retransmit errors are now less probable.
BZ#732698
Prior to this update, Corosync sometimes terminated unexpectedly when Corosync ran the cman_tool join and cman_tool leave commands in a loop. This update modifies the code so that no more segmentation faults occur in such situations.
Enhancements
BZ#529136
Prior to this update, the protocol in Corosync unnecessarily copied memory on AMD64 and EM64T architectures to align data structures for architectures which do not handle alignment correctly. As a consequence, the utilization of the central processing unit (CPU) was increased. This update can conditionally avoid copies on unaligned safe architectures such as Intel 80386, AMD64, and EM64T architectures. Now the CPU utilization is reduced by around 20%.
BZ#599327
Prior to this update, no diagnostic message was available when the multicast was blocked. As a consequence, each partition lost quorum which never remerged. This update displays a diagnostic warning that the node can not exit the GATHER state when a local NIC (network interface card) fault occurs or the firewall prevents totem from forming a cluster. In addition, the runtime.totem.pg.mrp.srp.firewall_enabled_or_nic_failure key is now set to 1.
BZ#667652
Prior to this update, fenced nodes where not safely powered up due to issues with the boot sequence. As a consequence, users had to skip cluster services at boot to avoid problems such as long response times and fences in two-node clusters. With this update, setting the nocluster boot parameter prevents Corosync to start automatically.
BZ#688260
Prior to this update, configuring two rings with different IP subnets only duplicated the IP address data of one ring. This update adds support for the redundant ring functionality to Corosync as a Technology Preview.
BZ#707876
Prior to this update, the corosync init script did not depend on syslog. As a consequence, syslog logging did not work if the user turned off syslog. This update adds syslog as a dependency to the init script. Now, logging works in all cases.
BZ#722469
Prior to this update, configuring two rings with different IP subnets only duplicated the IP address data of one ring. This update adds support for the redundant ring functionality to Corosync as a Technology Preview.
All corosync users are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.
Updated corosync packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
The corosync packages provide the Corosync Cluster Engine and C Application Programming Interfaces (APIs) for Red Hat Enterprise Linux cluster software.

Bug Fixes

BZ#726608
Previously, under heavy traffic, receive buffers sometimes overflowed, causing loss of packets. Consequently, retransmit list error messages appeared in the log files. This bug has been fixed, incoming messages are now processed more frequently, and the retransmit list error messages no longer appear in the described scenario.
BZ#727962
Previously, when a combination of a lossy network and a large number of configuration changes was used with corosync, corosync sometimes terminated unexpectedly. This bug has been fixed, and corosync no longer crashes in the described scenario.
BZ#734997
Prior to this update, when corosync ran the "cman_tool join" and "cman_tool leave" commands in a loop, corosync sometimes terminated unexpectedly. This bug has been fixed, and corosync no longer crashes in the described scenario.
All users of corosync are advised to upgrade to these updated packages, which fix these bugs.

4.32. cpufrequtils

An updated cpufrequtils package that fixes a bug is now available for Red Hat Enterprise Linux 6.
The cpufrequtils package contains utilities that can be used to control the cpufreq interface provided by the kernel on hardware that supports CPU frequency scaling.

Bug Fix

BZ#675734
Prior to this update, the cpufreq-aperf utility did not run on 32-bit systems due to an incorrect argument passed to the read() call. This problem has been fixed: the buffer size is now used instead of the size of the pointer and the cpufreq-aperf utility runs as expected.
All users of cpufrequtils are advised to upgrade to this updated package, which resolves this bug.

4.33. crash

An updated crash package that fixes various bugs and adds several enhancements is now available for Red Hat Enterprise Linux 6.
The crash package provides a self-contained tool that can be used to investigate live systems, and kernel core dumps created from the netdump, diskdump, kdump, and Xen/KVM "virsh dump" facilities from Red Hat Enterprise Linux.
BZ#710193
The crash package has been upgraded to upstream version 5.1.8, which provides a number of enhancements and bug fixes over the previous version.

Bug Fixes

BZ#705142
Previously, compressed kdump dump files were handled incorrectly on AMD64 and Intel 64 architectures if a system contained more than 454 CPUs. In such a case, the crash session terminated during initialization with the "crash: compressed kdump: invalid nr_cpus value: [cpus]" error message. A patch has been provided to address this issue, and the compressed dump files are now handled properly, thus fixing this bug.
BZ#716931
When the first chunk of physical memory on a system was assigned to NUMA (Non-Uniform Memory Architecture) node 1 (typically it is assigned to NUMA node 0), the "kmem -s" or "kmem -S" command incorrectly showed all cache blocks allocated by the slab allocator as empty. This bug has been fixed, and the kmem command now shows populated kmem_cache slab data correctly.
BZ#712214
In a rare scenario, a non-crashing CPU received a shutdown NMI (non-maskable interrupt) immediately after receiving an interrupt from another source. Because the IRQ entry-point symbols "IRQ0x00_interrupt" through "IRQ0x##_interrupt" no longer existed, the bt command terminated with the "bt: cannot transition from exception stack to current process stack" error message on AMD64 and Intel 64 architectures. This bug has been fixed, and backtrace now properly transitions from the NMI stack back to the interrupted process stack.

Enhancements

BZ#695413
The crash.8 man page and the associated built-in "crash -h" output have been re-written. The crash.8 man page now clarifies the required invocation options, adds all of the rarely-used command line options that have proliferated over the years, and updates the ENVIRONMENT variables section. The "crash -h" output now closely mimics the relevant parts of the crash.8 man page.
BZ#703467
With this update, the new "--osrelease [dump_file]" command line option that displays the OSRELEASE vmcoreinfo string from a kdump dump file has been added.
Users of crash are advised to upgrade to this updated package which fixes these bugs and adds these enhancements.

4.34. crontabs

An updated crontabs package that fixes one bug is now available for Red Hat Enterprise Linux 6.
The crontabs package contains root crontab files and directories. You will need to install the cron daemon to run the jobs from crontabs. The cron daemon such as cronie or fcron checks the crontab files to see when particular commands are scheduled to be executed. If commands are scheduled, it executes them. Crontabs handles a basic system function, so it should be installed on your system.

Bug Fix

BZ#609544
Prior to this update, an example included in the /etc/crontab file contained an omission. It did not state that defining a job in crontab requires a username to be defined. The missing information has been added to the /etc/crontab file in this update.
All users of crontabs are advised to upgrade to this updated package, which fixes this bug.

4.35. cryptsetup-luks

Updated cryptsetup-luks packages that fix several bugs and add an enhancement are now available for Red Hat Enterprise Linux 6.
The cryptsetup-luks packages provide a utility which allows users to set up encrypted devices with the Device Mapper and the dm-crypt target.

Bug Fixes

BZ#713410
When the cryptsetup or libcryptsetup utility was run in FIPS (Federal Information Processing Standards) mode, the "Running in FIPS mode." message was displayed during initialization of all commands. This sometimes caused minor issues with associated scripts. This bug has been fixed and the message is now displayed only in verbose mode.
BZ#732179
Prior to this update, several directives were missing in cryptsetup status command implementation. Therefore, the cryptsetup status command always returned the exit code 0 when verifying the status of a mapped device. To fix this issue, the code has been modified. The cryptsetup status command now returns the 0 value only if the device checked is active.

Enhancement

BZ#701936
Previously, the libcryptsetup crypt_get_volume_key() function allowed to perform an action not compliant with FIPS. To conform FIPS requirements, the function is now disabled in FIPS mode and returns an EACCES error code to indicate it. Note that the "luksDump --dump-master-key" command and the key escrow functionality of the volume_key package are also disabled in FIPS mode as a consequence of this update.
All users of cryptsetup-luks are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.
Updated cryptsetup-luks packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
The cryptsetup-luks packages provide a utility which allows users to set up encrypted devices with the Device Mapper and the dm-crypt target.

Bug Fixes

BZ#713456
When the cryptsetup or libcryptsetup utility was run in FIPS (Federal Information Processing Standards) mode, the "Running in FIPS mode." message was displayed during initialization of all commands. This sometimes caused minor issues with associated scripts. This bug has been fixed and the message is now displayed only in verbose mode.
BZ#709055
Previously, the libcryptsetup crypt_get_volume_key() function allowed to perform an action not compliant with FIPS. To conform FIPS requirements, the function is now disabled in FIPS mode and returns an EACCES error code to indicate it.
Note that the "luksDump --dump-master-key" command and the key escrow functionality of the volume_key package are also disabled in FIPS mode as a consequence of this update.
Users of cryptsetup-luks are advised to upgrade to these updated packages, which fix these bugs.

4.36. ctdb

Updated ctdb packages that fix multiple bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.
The ctdb packages provide a clustered database based on Samba's Trivial Database (TDB) used to store temporary data.
The ctdb packages have been upgraded to upstream version 1.0.114, which provides a number of bug fixes over the previous version. (BZ#701944)

Bug Fixes

BZ#728545
Prior to this update, the ctdb daemon leaked a file descriptor to anon_inodefs. This update modifies ctdb so that this file discriptor can no longer leak.

Enhancement

BZ#672641
This update adds support for Clustered Samba on top of GFS2 as a Technology Preview.
All users of ctdb are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

4.37. cups

Updated cups packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX operating systems.
Security Fix
CVE-2011-2896
A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the CUPS GIF image format reader. An attacker could create a malicious GIF image file that, when printed, could possibly cause CUPS to crash or, potentially, execute arbitrary code with the privileges of the "lp" user.

Bug Fixes

BZ#681836
Previously CUPS was not correctly handling the language setting LANG=en_US.ASCII. As a consequence lpadmin, lpstat and lpinfo binaries were not displaying any output when the LANG=en_US.ASCII environment variable was used. As a result of this update the problem is fixed and the expected output is now displayed.
BZ#706673
Previously the scheduler did not check for empty values of several configuration directives. As a consequence it was possible for the CUPS daemon (cupsd) to crash when a configuration file contained certain empty values. With this update the problem is fixed and cupsd no longer crashes when reading such a configuration file.
BZ#709896
Previously when printing to a raw print queue, when using certain printer models, CUPS was incorrectly sending SNMP queries. As a consequence there was a noticeable 4-second delay between queueing the job and the start of printing. With this update the problem is fixed and CUPS no longer tries to collect SNMP supply and status information for raw print queues.
BZ#712430
Previously when using the BrowsePoll directive it could happen that the CUPS printer polling daemon (cups-polld) began polling before the network interfaces were set up after a system boot. CUPS was then caching the failed hostname lookup. As a consequence no printers were found and the error, "Host name lookup failure", was logged. With this update the code that re-initializes the resolver after failure in cups-polld is fixed and as a result CUPS will obtain the correct network settings to use in printer discovery.
BZ#735505
The MaxJobs directive controls the maximum number of print jobs that are kept in memory. Previously, once the number of jobs reached the limit, the CUPS system failed to automatically purge the data file associated with the oldest completed job from the system in order to make room for a new print job. This bug has been fixed, and the jobs beyond the set limit are now properly purged.
BZ#744791
The cups init script (/etc/rc.d/init.d/cups) uses the daemon function (from /etc/rc.d/init.d/functions) to start the cups process, but previously it did not source a configuration file from the /etc/sysconfig/ directory. As a consequence, it was difficult to cleanly set the nice level or cgroup for the cups daemon by setting the NICELEVEL or CGROUP_DAEMON variables. With this update, the init script is fixed.
All users of CUPS are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, the cupsd daemon will be restarted automatically.
Updated cups packages that fix a bug are now available for Red Hat Enterprise Linux 6.
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems.

Bug Fix

BZ#736304
The MaxJobs directive controls the maximum number of print jobs that are kept in memory. Previously, once the number of jobs reached the limit, the CUPS system failed to automatically purge the oldest completed job from the system to make room for a new one. This bug has been fixed, and the jobs beyond the limit are now properly purged in the described scenario.
All users of cups are advised to upgrade to these updated packages, which fix this bug.

4.38. curl

Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix
CVE-2011-2192
It was found that cURL always performed credential delegation when authenticating with GSSAPI. A rogue server could use this flaw to obtain the client's credentials and impersonate that client to other servers that are using GSSAPI.
Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.
Updated curl packages that resolve an issue are now available Red Hat Enterprise Linux 6.
The curl packages provide the libcurl library and the cURL command line tool for transferring data using various protocols, including HTTP, FTP, FILE, LDAP, TELNET, TFTP, SCP. Both, libcurl and cURL, support many useful capabilities, such as user authentication, proxy support, FTP uploading, HTTP POST and PUT methods, SSL certificates, and file transfer resume.

Bug Fix

BZ#727884
As a solution to a security issue, GSSAPI credential delegation was disabled, which broke the functionality of the applications that were relying on delegation, which was incorrectly enabled by libcurl. To fix this issue, the CURLOPT_GSSAPI_DELEGATION libcurl option has been introduced in order to enable delegation explicitly when applications need it. All applications using GSSAPI credential delegation can now use this new libcurl option to be able to run properly.
All users of cURL and libcurl are advised to upgrade to these updated packages, which resolve this issue. All running applications using libcurl have to be restarted for the update to take an effect.

4.39. cyrus-imapd

Updated cyrus-imapd packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support.
Security Fix
CVE-2011-1926
It was discovered that cyrus-imapd did not flush the received commands buffer after switching to TLS encryption for IMAP, LMTP, NNTP, and POP3 sessions. A man-in-the-middle attacker could use this flaw to inject protocol commands into a victim's TLS session initialization messages. This could lead to those commands being processed by cyrus-imapd, potentially allowing the attacker to steal the victim's mail or authentication credentials.
Users of cyrus-imapd are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, cyrus-imapd will be restarted automatically.
Updated cyrus-imapd packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support.
Security Fix
CVE-2011-3208
A buffer overflow flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to crash the nntpd child process or, possibly, execute arbitrary code with the privileges of the cyrus user.
Red Hat would like to thank Greg Banks for reporting this issue.
Users of cyrus-imapd are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the update, cyrus-imapd will be restarted automatically.
Updated cyrus-imapd packages that fix two security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support.
Security Fixes
CVE-2011-3372
An authentication bypass flaw was found in the cyrus-imapd NNTP server, nntpd. A remote user able to use the nntpd service could use this flaw to read or post newsgroup messages on an NNTP server configured to require user authentication, without providing valid authentication credentials.
CVE-2011-3481
A NULL pointer dereference flaw was found in the cyrus-imapd IMAP server, imapd. A remote attacker could send a specially-crafted mail message to a victim that would possibly prevent them from accessing their mail normally, if they were using an IMAP client that relies on the server threading IMAP feature.
Red Hat would like to thank the Cyrus IMAP project for reporting the CVE-2011-3372 issue. Upstream acknowledges Stefan Cornelius of Secunia Research as the original reporter of CVE-2011-3372.
Users of cyrus-imapd are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, cyrus-imapd will be restarted automatically.

4.40. cyrus-sasl

Updated cyrus-sasl packages that fix two bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.
The cyrus-sasl packages contain the Cyrus implementation of the Simple Authentication and Security Layer (SASL), a method for adding authentication support to connection-based protocols.

Bug Fixes

BZ#720451
Prior to this update, the ntlm plug-in did not work due to a code error. This update modifies the source code so that the plug-in now works as expected.
BZ#730242
Prior to this update, creating the user ID and the group ID of the saslauth daemon caused conflicts. This update corrects this behavior and now the saslauth daemon works as expected.
BZ#730246
Prior to this update, cyrus-sasl displayed redundant warnings during the compilation. With this update, cyrus-sasl has been modified and now works as expected.

Enhancement

BZ#727274
This update adds support of partial Relocation Read-Only (RELRO) for the cyrus-sasl libraries.
All users of cyrus-sasl are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

4.41. dbus

Updated dbus packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.
Security Fix
CVE-2011-2200
A denial of service flaw was found in the way the D-Bus library handled endianness conversion when receiving messages. A local user could use this flaw to send a specially-crafted message to dbus-daemon or to a service using the bus, such as Avahi or NetworkManager, possibly causing the daemon to exit or the service to disconnect from the bus.
All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using the libdbus library must be restarted, or the system rebooted.

4.42. device-mapper-multipath

Updated device-mapper-multipath packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The device-mapper-multipath packages provide tools to manage multipath devices using the device-mapper multipath kernel module.
Bug Fixes
BZ#677449
DM Multipath removed a device if it failed to check the device status due to insufficient memory. This happened because the command checking if the device map existed failed as the system returned an error. With this update, Multipath no longer returns an error under these circumstances and no devices are removed if the system runs out of memory while checking device status.
BZ#678673
If a device-mapper-multipath device was open but all attached device paths had been lost, the device was unable to create a new table with no device paths. As a concequence the multipath -ll command returned output indicating that no paths to the device were available with confusing "failed faulty running" rows presenting the missing paths. Multipath devices now reload tables with no device paths correctly.
BZ#689504
Device paths could fail even if unavailable only temporarily. This happened because the RDAC (Redundant Disk Array Controller) checker function did not recheck the status of hosts if it had received a temporary error code. The function now rechecks the path after it has received such error codes and the path failures are transient as expected.
BZ#697386
A previous bug fix introduced a race condition between the main thread and the thread running the checkerloop routine as the checkerloop thread was created with deferred cancellation type. The checkerloop thread continued running and attempted to access a property, which had been previously unallocated by the main thread. This caused the multipathd daemon to shutdown with a segmentation fault. Now the checkerloop thread checks if a shutdown is in progress and the deamon shuts down gracefully.
BZ#700169
The Multipath daemon failed to include some ghost paths when counting the number of active paths; however, when the ghost paths failed, they were subtracted from the number of active paths. This caused multipathd to fail IO requests even though some paths were still available. The Multipath daemon now counts ghost paths correctly and no longer fails IO requests while there are still active paths available.
BZ#705854
If the user set dev_loss_tmo to a value greater than 600 in multipath.conf without setting the fast_io_fail_tmo value, the multipathd daemon did not notify the user that fast_io_fail_tmo was not set. Multipath now issues a warning that fast_io_fail_tmo is not set under such circumstances.
BZ#706555
On shared-storage multipath setups that set failback to manual, multipath could keep alternating from the failover pathgroup to the primary pathgroup infinitely. This happened because multipath was incorrectly failing back to the primary pathgroup whenever a path priority changed. With this update, multipath no longer fails back to the primary pathgroup when a path's priority changes under such circumstances.
BZ#707560
If the multipath device was deleted while a path was being checked, multipathd did not abort the path check and terminated unexpectedly when trying to access the multipath device information. The Multipath daemon now aborts any path checks when the multipath device is removed and the problem no longer occurs.
BZ#714821
The Multipath daemon was removing a multipath device twice. This could cause multipathd to access memory already used for another purpose, and caused the multipathd daemon to terminate unexpectedly. The multipathd daemon now removes the device once and the problem no longer occurs.
BZ#719571
The kpartx utility built partition devices for invalid GUID partition tables (GPT) because it did not validate the size of GUID partitions. The kpartx utility now checks the partition size, and does not build devices for invalid GPTs.
BZ#723168
Multipath previously returned an unclear error message when it failed to find rport_id. The returned message and its severity have been adjusted.
BZ#725541
Several upstream commits have been included in the device-mapper-multipath package providing a number of bug fixes and enhancements over the previous version.
BZ#738298
Anaconda failed to recognize an existing filesystem on a zSeries Linux fibre-channel adapter (zFCP) LUN and marked it as 'Unknown' when reinstalling the system. This happened due to an incorrect setting of the DM_UDEV_DISABLE_DISK_RULES_FLAG property. Filesystem on a multipath zFCP LUN is now correctly recognized during the installation.
BZ#747604
The asynchronous TUR path checker caused multipathd to terminate unexpectedly due to memory corruption. This happened if multipathd attempted to delete a path while the asynchronous TUR checker was running on the path. The asynchronous TUR checker code has been removed, and multipathd no longer crashes on path removal.
Enhancements
BZ#636009
Multipath now supports up to 8000 device paths.
BZ#683616
To provide support for Asymmetric Logical Unit Access (ALUA), the RDAC checker has been modified to work better with devices in IOSHIP mode. The checker now sets the Task Aborted Status (TAS) bit to 1 if the TAS bit is set to 0 and changeable on a LUN (Logical Unit Number) discovery. The function now also reports PATH_UP for both the path groups in the RDAC storage in IOSHIP mode.
BZ#694602
To run multipath on IBM BladeCenter S-series with RAIDed Shared Storage Module (RSSM) demanded a manual multipath configuration to enable RSSM. Multipath now configures the server automatically.
BZ#699577
The text in the defaults multipaths devices sections of the multipath.conf man page has been improved to provide a better clarification.
BZ#713754
The rr_min_io_rq option has been added to the default, devices, and multipaths sections of the multipath.conf file. This option defines the number of I/O requests to route to a path before switching to the next path in the current path group. Note that the rr_min_io option is no longer used.
BZ#710478
UID, GID, and mode owner settings defined in /etc/multipath.conf for a multipath device are ignored. These access permissions are now set with the udev rules.
Users are advised to upgrade to these updated device-mapper-multipath packages, which fix these bugs and add these enhancements.
Updated device-mapper-multipath packages that fix a bug are now available for Red Hat Enterprise Linux 6.
The device-mapper-multipath packages provide tools to manage multipath devices by giving the dm-multipath kernel module instructions on what to do, as well as by managing the creation and removal of partitions for Device-Mapper devices.

Bug Fix

BZ#732384
When deleting a multipath device while checking a path, the multipathd daemon did not abort the path check. As a consequence, the daemon terminated when trying to access multipath device information. The problem has been fixed and the multipathd daemon now aborts the path check when deleting a multipath device.
All users of device-mapper-multipath are advised to upgrade to these updated packages, which fix this bug.

4.43. DeviceKit-power

Updated DeviceKit-power packages that add two enhancements are now available for Red Hat Enterprise Linux 6.
DeviceKit-power provides a daemon, API and command line tools for managing power devices attached to the system.

Enhancements

BZ#625880
To allow administrators easily disable the suspend and hibernate actions on the system, DeviceKit-power now checks the PolicyKit authorization before deciding whether an action can be completed.
BZ#727544
This update introduces a new sub-package DeviceKit-power-devel-docs, which contains developer's documentation for DeviceKit-power, so that it is now possible to install the DeviceKit-power-devel package on machines with multiple architectures without file conflicts.
All users are advised to upgrade to these updated DeviceKit-power packages, which add these enhancements.

4.44. dhcp

Updated dhcp packages that fix two security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address.
Security Fixes
CVE-2011-2748, CVE-2011-2749
Two denial of service flaws were found in the way the dhcpd daemon handled certain incomplete request packets. A remote attacker could use these flaws to crash dhcpd via a specially-crafted request.
Users of DHCP should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing this update, all DHCP servers will be restarted automatically.
Updated dhcp packages that fix several bugs and add two enhancements are now available for Red Hat Enterprise Linux 6.
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. DHCPv6 is the DHCP protocol that supports IPv6 networks.

Bug Fixes

BZ#694798
Previously, when multiple DHCP clients were launched at the same time to handle multiple virtual interfaces on the same network interface card (NIC), the clients used the same seed to choose when to renew their leases. Consequently, these virtual interfaces for some clients could have been removed over time. With this update, the dhclient utility uses the Process Identifier (PID) for seeding the random number generator, which fixes the bug.
BZ#694799
If a system was rebooted while a network switch was inoperative, the network connection would recover successfully. However, it was no longer configured to use DHCP even if the dhclient utility had been running in persistent mode. With this update, the dhclient-script file has been modified to refresh the ARP (Address Resolution Protocol) table and the routing table instead of bringing the interface down, which fixes the bug.
BZ#731990
If the system included network interfaces with no hardware address, the dhcpd scan could have experienced a segmentation fault when scanning such an interface. As a consequence, the dhcpd daemon unexpectedly terminated. To prevent this issue, dhcpd now tests a pointer which represents the hardware address of the interface for the NULL value. The dhcp daemon no longer crashes.
BZ#736999
Previously, all source files were compiled with the "-fpie" or "fPIE" flag. As a consequence, the libraries used by dhcp could not have been used to build Perl modules. To fix this problem, all respective dhcp Makefiles have been modified to compile libraries with the "-fpic" or "-fPIC" flag. The libraries used by dhcp are now built without the previous restrictions.
BZ#736194
Previously, both dhcp and dhclient packages included the dhcp-options(5) and dhcp-eval(5) man pages. As a consequence, a conflict could have occurred when any of these man pages were updated, because dhcp and dhclient packages could have been upgraded separately. To prevent the problem from occurring in future updates, shared files of dhcp and dhclient packages have been moved to the dhcp-common package that is required by both dhcp and dhclient as a dependency.

Enhancements

BZ#706974
A feature has been backported from dhcp version 4.2.0. This feature allows the DHCPv6 server to be configured to identify DHCPv6 clients in accordance with their link-layer address and their network hardware type. With this update, it is now possible to define a static IPv6 address for the DHCPv6 client with a known link-layer address.
BZ#693381
Previously, the dhcpd daemon ran as root. With this update, new "-user" and "-group" options can be used with dhcpd. These options allow dhcpd to change the effective user and group ID after it starts. The dhcpd and dhcpd6 services now run the dhcpd daemon with the "-user dhcpd -group dhcpd" parameters, which means that the dhcpd daemon runs as the dhcpd user and group instead root.
Users are advised to upgrade to these updated dhcp packages, which fixes these bugs and add these enhancements.

4.45. dmidecode

An updated dmidecode package that fixes one bug and adds one enhancement is now available for Red Hat Enterprise Linux 6.
The dmidecode package provides utilities for extracting x86 and Intel Itanium hardware information from the system BIOS or EFI (Extensible Firmware Interface), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag as well as other details, depending on the manufacturer. This often includes usage status for the CPU sockets, expansion slots such as AGP, PCI and ISA, among others, memory module slots, and many different kinds of I/O ports, such as serial, parallel and USB.
Prior to this update, the extended records for the DMI types Memory Device (DMI type 17) and Memory Array Mapped Address (DMI type 19) were missing from the dmidecode utility output. With this update, dmidecode has been upgraded to upstream version 2.11, which updates support for the SMBIOS specification to version 2.7.1, thus fixing this bug. Now, the dmidecode output contains the extended records for DMI type 17 and DMI type 19. (BZ#654833)
All users of dmidecode are advised to upgrade to this updated package, which fixes this bug and adds this enhancement.
An updated dmidecode package that fixes a bug is now available for Red Hat Enterprise Linux 6.
The dmidecode package provides utilities for extracting x86 and Intel Itanium hardware information from the system BIOS or EFI (Extensible Firmware Interface), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag, as well as other details, depending on the manufacturer.
Bug Fix
BZ#744690
Previously, extended records for Memory Device (DMI type 17) and Memory Array Mapped Address (DMI type 19) DMI types were missing from the dmidecode utility output. With this update, dmidecode has been upgraded to upstream version 2.11, which updates support for the SMBIOS specification to version 2.7.1, thus fixing this bug.
All users of dmidecode are advised to upgrade to this updated package, which fixes this bug.

4.46. dnsmasq

An updated dnsmasq package that addresses two bugs is now available for Red Hat Enterprise Linux 6.
Dnsmasq is a lightweight and easy-to-configure DNS forwarder and DHCP server.
Bug Fixes
BZ#584009
Three changes were made to /etc/init.d/dnsmasq, the dnsmasq startup script.
If dnsmasq was started or restarted by a non-privileged user, the startup script previously failed silently. With this update, the dnsmasq startup script now exits with a status code of 4 (user had insufficient privilege) and returns a "User has insufficient privilege" error to STD OUT when started or restarted by a non-privileged user.
A "force-reload" option was added: The "service force-reload dnsmasq" command now forces dnsmasq to reload. Previously, it did nothing.
If /etc/init.d/dnsmasq passed an invalid argument, previously the startup script exited with a status code of 1 (generic or unspecified error). With this update, the startup script now exits correctly, returning a status code of 2 (invalid or excess argument) in such a circumstance.
BZ#704073
If the virtual bridge interface (virbr0) was up and dnsmasq was started by default, dnsmasq could, in some circumstances, write a "DHCP packet received on eth(x) which has no address" message to /var/log/messages. Note: this message was not in error. The message was written if an actual interface (eg eth1) was up; did not have a configured IP address (eg was slaved to a logical bonded interface); and was in the same LAN as another host which generated a DHCP request. The message had little-to-no utility, however: it presented a warning where none was needed. With this update, this message is no longer written to /var/log/messages in these, and equivalent, circumstances.
All dnsmasq users should install this update which makes these changes.

4.47. dosfstools

An updated dosfstools package that fixes various bugs is now available for Red Hat Enterprise Linux 6.
The dosfstools package contains a set of tools for creating and maintaining FAT-type file systems. It includes the mkdosfs and dosfsck utilities, which make and check MS-DOS FAT file systems on hard drives and floppy disks.

Bug Fixes

BZ#624596
Previously, when the dosfsck and the dosfslabel utilities were executed on the IBM System z architecture using a FAT32 file system, they terminated with this error message: "Logical sector size is zero". This was caused by unaligned fields which were first byte-wise copied. With this fix, the fields are not pre-copied any more, but are accessed the same way as on the i686 architecture.
BZ#677789
The fsck.vfat utility terminated due to buffer overflow. This occurred when checking a device with the corrupted VFAT file system if there were any chains of orphaned clusters. The name of the newly created file that contained these clusters was printed directly into the name field, which led to an out of boundary write. The name is now printed into the buffer and individual parts are then correctly copied into the appropriate field.
BZ#688128
The dosfslabel utility displayed an error message when labeling the FAT32 file system due to some of its internal structures being initialized incorrectly. The dosfslabel utility now reads the FAT file system first, which fixes the problem.
BZ#709266
The mkfs.vfat utility did not correctly detect device partitions on RAID devices. As a consequence, formatting failed with an error message. This was caused by an invalid mask for the statbuf.st_rdev variable. The mask has been fixed to be at least four bytes long and the problem no longer occurs.
All users of dosfstools are advised to upgrade to this updated package, which resolves these bugs.

4.48. dovecot

Updated dovecot packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
Dovecot is an IMAP server for Linux, UNIX, and similar operating systems, primarily written with security in mind.
Security Fix
CVE-2011-1929
A denial of service flaw was found in the way Dovecot handled NULL characters in certain header names. A mail message with specially-crafted headers could cause the Dovecot child process handling the target user's connection to crash, blocking them from downloading the message successfully and possibly leading to the corruption of their mailbox.
Users of dovecot are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the dovecot service will be restarted automatically.

4.49. doxygen

Updated doxygen packages that fix one bug are now available for Red Hat Enterprise Linux 6.
Doxygen can generate an online class browser in HTML and/or a reference manual in LaTeX from a set of documented source files. The documentation is extracted directly from the sources.

Bug Fix

BZ#690076
Prior to this update, Doxygen required invalid BuildRequires on the qt-devel package. With this update, packages with BuildRequires dependencies on the qt-devel package have been fixed. Now, these packages explicitly require qt4-devel.
All users of Doxygen are advised to upgrade to these updated packages, which fix this bug.

4.50. dracut

Updated dracut packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.
The dracut packages include an event-driven initramfs generator infrastructure based on udev. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.
Bug Fixes
BZ#659076
Previously, dracut incorrectly displayed that it loaded SELinux even if SELinux was disabled in the config file and "selinux=0" was not specified on the kernel command line. As a consequence, an error message could confuse the user when booting the system. With this update, the dracut utility is modified and the error message no longer appears.
BZ#696980
Due to an error in the dracut module script, the system could fail to find the root volume if a static IP address was specified. As a consequence, the system did not boot. With this update, the error is corrected, and the system is able to boot with a static IP address.
BZ#698160
When mounting the root device over the NFS (Network File System) protocol, the /var/lib/rpcbind directory created by initramfs was world-writable. The dracut tool has been modified to generate initramfs which now sets the ownership to the rpc user and the group.
BZ#698165
When auto-assembling an md RAID device, initramfs used an invalid parameter when calling the mdadm tool. This prevented the system from booting if the root device was on the RAID device. The invalid parameter has been removed and the system now boots properly.
BZ#698215
When auto-assembling an md RAID device, an error in the mdraid_start.sh script prevented the system from booting if the root device was on the RAID device. The error in the script has been fixed and the system now boots correctly.
BZ#701309
Prior to this update, the /var/lib/nfs/prc_pipefs partition could not be accessed on system boot. The problem occurred when booting the system with NFS set as the root partition with at least one separate /var partition. This was caused by initramfs mounting the /var partition over the existing rpc_pipefs partition. The initramfs file system now mounts entries in /etc/fstab.sys, which fixes the problem.
BZ#707609
The dm-mod and dm-crypt kernel modules were missing from the list of kernel modules, which are pre-loaded for the FIPS-140 check. These modules have been added to the list with this update.
BZ#712254
When loading SELinux from inside initramfs, the output of the SELinux commands could be garbled if the user used non-Latin locales. The initramfs file system has been modified to turn off localization for the SElinux commands, which results in readable messages.
BZ#737134
The QLogic qla4xxx iSCSI driver and the iSCSI (Internet Small Computer System Interface) transport layer now support iSCSI boot from Storage Area Network (SAN) using the iscsistart. With this update, dracut is modified to support these changes.
BZ#737593
If the user installed a system with rootfs on a RAID device where RAID members were encrypted, dracut failed to assemble the RAID device on reboot. As a consequence, the system did not boot. A patch has been applied to address this issue, and the RAID device is now assembled on every boot so that the system boots successfully.
BZ#741430
When applying SELinux labels for /dev in initramfs, the restorecon tool did not alter the MCS/MLS label only types. To fix this problem, the "-F" option has been added to all calls of restorecon.
BZ#742920
Prior to this update, the boot process timed out for network settings with DHCP involved. A patch has been applied to extend the timeout interval if DHCP is involved, which fixes the problem.
Enhancements
BZ#701864
This update adds support for iSCSI (Internet Small Computer System Interface) partial offload functionality for certain Broadcom network devices.
BZ#740487
This update adds the dracut-fips-aesni subpackage. Note that the package should be installed when using the aesni-intel module in FIPS mode.
BZ#723548
This update adds support for Logical Volume Management (LVM) mirror devices to serve as root devices. Additionally degraded mirrors are used after a certain timeout if the other half cannot be found at booting time.
BZ#729573
This update adds support for configuring an interface with automatic IPv6 and DHCP over IPv4 by using the "ip=[interface]:dhcp,auto6" command line parameter.
BZ#736094
With this update, the Broadcom FCoE (Fibre Channel over Ethernet) offload driver is now supported.
Users of dracut are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.
Updated dracut packages that add an enhancement are now available for Red Hat Enterprise Linux 6.
The dracut package contains an event-driven initramfs generator infrastructure based around the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

Enhancement

BZ#728549
The dm-mod and dm-crypt kernel modules were missing from the list of kernel modules which are pre-loaded for the FIPS-140 (Federal Information Processing Standards) check. With this update, these modules have been added to the list. This update also introduces the dracut-fips-aesni subpackage which should be installed if the aesni-intel module is used in FIPS mode.
Users of dracut are advised to upgrade to these updated packages, which add this enhancement.

4.51. dump

Updated dump packages that fix three bugs are now available for Red Hat Enterprise Linux 6.
The dump package contains both "dump" and "restore" commands. The "dump" command examines files in a file system, determines which ones need to be backed up, and copies those files to a specified disk, tape, or other storage medium. The "restore" command performs the inverse function of "dump"; it can restore a full backup of a file system. Subsequent incremental backups can then be layered on top of the full backup. Single files and directory subtrees may also be restored from full or partial backups.

Bug Fixes

BZ#702593
Prior to this update, the dump utility passed wrong arguments to the "clone(2)" system call. As a result, dump became unresponsive when executed on the S/390 or IBM System z architecture. This bug has been fixed in this update so that dump now passes correct arguments and no longer hangs.
BZ#691434
Under certain circumstances, the dump utility could have failed to detect holes in files correctly. When a user attempted to restore an erroneous backup using the "restore" command, an error message "Missing blocks at end of [path], assuming hole" could have been displayed. In such case, the backup could have not been restored properly. This bug has been fixed in this update so that dump now handles holes in files as expected.
BZ#658890
Prior to this update, the "dump -w" command did not recognize ext4 file systems as supported. With this update, the bug has been fixed so that "dump -w" now recognizes the ext4 file systems as supported.
All users of dump should upgrade to these updated packages, which fix these bugs.

4.52. e2fsprogs

Updated e2fsprogs packages that fix several bugs and add two enhancements are now available for Red Hat Enterprise Linux 6.
The e2fsprogs packages contain a number of utilities that create, check, modify, and correct inconsistencies in ext2, ext3, and ext4 file systems. This includes e2fsck (which repairs file system inconsistencies after an unclean shutdown), mke2fs (which initializes a partition to contain an empty file system), tune2fs (which modifies file system parameters), and most of the other core file system utilities.

Bug Fixes

BZ#676465
Running the "e2fsck" command on certain corrupted file systems failed to correct all errors during the first run. This occurred when a file had its xattr block cloned as a duplicate, but the block was later removed from the file because the file system did not contain the xattr feature. However, the block was not cleared from the block bitmaps. During the second run, e2fsck found the cloned xattr block as in use, but not owned by any file, and had to repair the block bitmaps. With this update, the processing of duplicate xattr blocks is skipped on non-xattr file systems. All problems are now discovered during the first run.
BZ#679931
On certain devices with very large physical sector size, the mke2fs utility set the block size to be as large as the size of the physical sector. In some cases, the size of the physical sector was larger than the page size. As a consequence, the file system could not be mounted and, in rare cases, the utility could even fail. With this update, the default block size is not set to be larger than the system's page size, even for large physical sector devices.
BZ#683906
Previously, multiple manual pages contained typos. These typos have been corrected with this update.
BZ#713475
This update modifies parameters of the "mke2fs" command to be consistent with the "discard" and "nodiscard" mount options for all system tools (like mount, fsck, or mkfs). The user is now also informed about the ongoing discard process.
BZ#730083
Previously, the libcomm_err libraries were built without the read-only relocation (RELRO) flag. Programs built against these libraries could be vulnerable to various attacks based on overwriting the ELF section of a program. To enhance the security, the e2fsprogs package is now provided with partial RELRO support.

Enhancements

BZ#679892
Previously, the tune2fs tool could not set "barrier=0" as the default option on the ext3 and ext4 file systems. With this update, users are now able to set this option when creating the file system, and do not have to maintain the option in the /etc/fstab file across all of the file systems and servers.
BZ#713468
Previously, raw e2image output files could be extremely large sparse files, which were difficult to copy, archive, and transport. This update adds support for exporting images in the qcow format. Images in this format are small and easy to manipulate.
Users are advised to upgrade to these updated e2fsprogs packages, which fix these bugs and add these enhancements.

4.53. ecryptfs-utils

Updated ecryptfs-utils packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity. eCryptfs is released as a Technology Preview for Red Hat Enterprise Linux 5 and 6.
The setuid mount.ecryptfs_private utility allows users to mount an eCryptfs file system. This utility can only be run by users in the "ecryptfs" group.
Security Fixes
CVE-2011-1831
A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of a requested mount point when mounting an encrypted file system. A local attacker could possibly use this flaw to escalate their privileges by mounting over an arbitrary directory.
CVE-2011-1832
A race condition flaw in umount.ecryptfs_private could allow a local attacker to unmount an arbitrary file system.
CVE-2011-1834
It was found that mount.ecryptfs_private did not handle certain errors correctly when updating the mtab (mounted file systems table) file, allowing a local attacker to corrupt the mtab file and possibly unmount an arbitrary file system.
CVE-2011-1835
An insecure temporary file use flaw was found in the ecryptfs-setup-private script. A local attacker could use this script to insert their own key that will subsequently be used by a new user, possibly giving the attacker access to the user's encrypted data if existing file permissions allow access.
CVE-2011-1837
A race condition flaw in mount.ecryptfs_private could allow a local attacker to overwrite arbitrary files.
CVE-2011-3145
A race condition flaw in the way temporary files were accessed in mount.ecryptfs_private could allow a malicious, local user to make arbitrary modifications to the mtab file.
CVE-2011-1833
A race condition flaw was found in the way mount.ecryptfs_private checked the permissions of the directory to mount. A local attacker could use this flaw to mount (and then access) a directory they would otherwise not have access to.

Note

The fix for this issue is incomplete until a kernel-space change is made. Future Red Hat Enterprise Linux 5 and 6 kernel updates will correct this issue.
Red Hat would like to thank the Ubuntu Security Team for reporting these issues. The Ubuntu Security Team acknowledges Vasiliy Kulikov of Openwall and Dan Rosenberg as the original reporters of CVE-2011-1831, CVE-2011-1832, and CVE-2011-1833; Dan Rosenberg and Marc Deslauriers as the original reporters of CVE-2011-1834; Marc Deslauriers as the original reporter of CVE-2011-1835; and Vasiliy Kulikov of Openwall as the original reporter of CVE-2011-1837.
Users of ecryptfs-utils are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

4.54. esc

An updated esc package that fixes various bugs is now available for Red Hat Enterprise Linux 6.
The esc package contains the Smart Card Manager GUI (Graphical User Interface), which allows the user to manage security smart cards. The primary function of the tool is to enroll smart cards, so that they can be used for common cryptographic operations, such as secure email and website access.

Bug Fixes

BZ#253077
If the user resized an ESC window and closed it, the window did not preserve its size when opening it again. If the user wanted the window to be larger, for example, to make it easier to read, the user had to resize the window every single time when it was opened again. A patch has been applied to address this issue and the previous window size is now restored when opening ESC.
BZ#682216
Previously, during the shut down sequence of the escd daemon, the daemon reported a failure of certain instances. ESC terminated unexpectedly with a segmentation fault as a consequence. This update modifies the daemon to exit quietly. As a result, ESC no longer terminates unexpectedly.
BZ#702683
The esc-prefs.js file contains helpful commented settings designed to assist the user in trying rarely used settings if the situation warrants. A number of these settings in the file contained typos. The typos have been corrected with this update.
BZ#704281
Previously, ESC could have terminated with a segmentation fault after the user had inserted a new smart card into the reader. This was due to a bug in the code which helped to bring a pop-up window to the foreground. The code is no longer needed to assure window focus, therefore it is no longer being executed. As a result, ESC no longer terminates in the scenario described.
All users of esc are advised to upgrade to this updated package, which fixes these bugs.

4.55. fakechroot

Updated fakechroot packages that fix one bug are now available for Red Hat Enterprise Linux 6.
The fakechroot utility lets you run programs in a fake chroot environment without superuser privileges.

Bug Fix

BZ#730647
Due to multilib problems, the fakeroot command was only built on 64-bit architectures as a workaround, one which prevented the RPM package from being built on other architectures. This update resolves the multilib problems so that fakeroot now builds successfully on all architectures.
Users should upgrade to these updated packages, which resolve this issue.

4.56. fcoe-utils

An updated fcoe-utils package that fixes several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 6.
The fcoe-utils package provides Fibre Channel over Ethernet (FCoE) utilities, such as the fcoeadm command line tool for configuring FCoE interfaces, and the fcoemon service to configure DCB Ethernet QOS filters.
The fcoe-utils package has been upgraded to upstream version 1.0.20, which provides a number of bug fixes and enhancements over the previous version. (BZ#695941)

Bug Fixes

BZ#639466
When stopping the fcoe service, the fcoe initscript did not properly clean up after itself as expected (did not remove FCoE devices, kill related processes and unload FCoE drivers). As a consequence, FCoE interfaces were not brought down and FCoE related threads were still running after the fcoe had been stopped. The "service fcoe stop" command is used to ensure safe after-update service restarts on FCoE dependent systems, therefore it cannot be used to remove FCoE devices and unload related kernel modules. Concerning this situation, the initscript has been modified to use the "stop force" command option to completely remove FCoE devices and unload related kernel modules. The fcoe service now should be stopped using the "service fcoe stop force" command.
BZ#732485
When removing a network interface with no fcoe port using the "fcoeadm -d" command, the fcoe port state machine set the removal operation incorrectly to wait without responding to fcoemon. This led to an internal error because fcoemon timed out waiting for the response. To resolve the problem, the code has been modified to return the code for no further action under these circumstances. The "fcoeadm -d" command now works for interfaces without the fcoe port as expected.
BZ#732485
The fcoemon service did not maintain any information about the relative state of a physical network interface and its dependent VLAN interfaces. As a consequence, the fcoe port of the VLAN interface could have been out of sync with the fcoe port of the physical device, resulting in undesired behavior, such as processing link events improperly. To fix this problem, a ready flag has been introduced. This flag is set to false when the physical port is disabled. Link events are now processed correctly for the vlan ports.
BZ#732485
When answering to an FCoE Initialization Protocol (FIP) VLAN Discovery request, some switches encapsulate FIP VLAN Discovery replies in a VLAN 0 tag which is wrapped around the packet's FIP frame header. Previously, when a packet containing such a reply reached a target network interface, some devices did not remove the VLAN tag before they started to process the FIP header. If the VLAN tag was not removed, the length of the processed header was larger than was expected, therefore the FIP parsing logic was not able to parse the FIP header correctly causing a loss of the packet. With this update, the parsing logic has been modified to skip over the VLAN header when necessary, and point to the correct start of the FIP header.
BZ#743689
The timeout for a kernel reply to fcoeadm operations was set to 5 seconds, which was not enough when processing an fcoeadm operation on a system with a large number of FCoE ports while a kernel was under heavy load. As a consequence, the "internal error" message was displayed even though the operation was finished successfully. To prevent this bug, the timeout for the kernel reply was increased to 30 seconds. No error message is now sent when an fcoeadm operation succeeds.
All users of fcoe-utils are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.

4.57. fence-agents

An updated fence-agents package that fixes various bugs and adds several enhancements is now available for Red Hat Enterprise Linux 6.
Red Hat fence agents are a collection of scripts to handle remote power management for cluster devices. They allow failed or unreachable cluster nodes to be forcibly restarted and removed from the cluster.
The fence-agents package has been upgraded to upstream version 3.1.5, which provides a number of bug fixes and enhancements over the previous version. (BZ#707123)

Bug Fixes

BZ#731166
Due to a change in REST API, the fence_rhevm utility incorrectly reported status "UP" as "RUNNING". Consequently, the "fence_rhevm -o status" command always reported "OFF". This bug has been fixed, and fence_rhevm now reports status correctly.
BZ#718924
The fence_drac5 agent failed to clear its SSH sessions on exit as expected by firmware. Consequently, the fence agent appeared to be still connected to the device, and once the connection limit was reached, further logins to the device were not allowed. This bug has been fixed, and fence_drac5 now clears its SSH sessions properly.
BZ#693428
The "monitor" and "status" commands of the fence_ipmilan agent returned chassis status instead of the fence device status. As a result, when a server chassis was powered off, the fence_ipmilan agent exited with the incorrect result code "2" when passed one of these commands. Now, fence_ipmilan returns the correct result code "0" in the described scenario.
BZ#708052
When a blade server was removed from a blade chassis and was fenced via the fence_bladecenter utility with the "--missing-as-off" option enabled, and was scheduled with the "reboot" action, the fence failed. This bug has been fixed, and fence_bladecenter no longer returns an error if a blade server is missing.
BZ#718196
A list operation on fence_drac5 agents resulted in unexpected termination of fence agents. A patch has been provided to address this issue, and fence_drac5 agents now work correctly in the described scenario.
BZ#718207
When the pyOpenSSL package was not present in the system, when an error occurred, the fence_ilo agent terminated with a generic error message, making it difficult to debug the problem. Now, fence_ilo reports that a dependent package is missing in the described scenario, thus fixing this bug.
BZ#732372
The verbose mode of the fence_ipmilan agent exposed user passwords when the whole command was logged by an IPMI tool. Now, the fence_ipmilan output has been changed, and passwords remain undisclosed in the described scenario.
BZ#738384
During simultaneous unfencing operations performed via the fence_scsi agent, all nodes launched their reservation commands at the same time. Consequently, some of the commands failed. Now, fence_scsi retries to unfence a node until its reservation command succeeds.
BZ#734429
A null dereference was discovered in the fence_kdump agent, when the strchr() function returned the NULL value. With this update, the dereference has been fixed in the code and no longer occurs.

Enhancements

BZ#624673
With this update, the new fence_vmware_soap() function has been provided to enable fencing of VMware guests in ESX environments.
BZ#461948
The fence_kdump utility has been updated to integrate fencing with the kernel dump environment.
BZ#698365
With this update, the RelaxNG schema generation for fence-agents has been updated with the rha:description and rha:name attributes in its output to fence attribute group elements.
BZ#726571
The fence_ipmilan agent has been updated to support the -L option of the ipmilan daemon, thus supporting fencing with user session privileges level.
Users of fence-agents are advised to upgrade to this updated package, which fixes these bugs and adds these enhancements.

4.58. fence-virt

Updated fence-virt packages that fix two bugs and add one enhancement are now available for Red Hat Enterprise Linux 6.
The fence-virt packages provide a fencing agent for virtual machines as well as a host agent which processes fencing requests.

Bug Fixes

BZ#719645
Prior to this update, the domain parameter was missing from the metadata. As a consequence, existing configurations utilizing the domain parameter did not function correctly when fencing. This update adds the domain parameter for compatibility. Now, existing configurations work as expected.
BZ#720767
Prior to this update, hash mismatches falsely returned successes for fencing. As a consequence, data corruption could occur in live-hang scenarios. This update corrects the hash handling of mismatches. Now, no more false successes are returned and the data integrity is preserved.

Enhancement

BZ#691200
With this update, the libvirt-qpid plugin now operates using QMF version 2.
All users of fence-virt are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

4.59. file

Updated file packages that fix several bugs are now available for Red Hat Enterprise Linux 6.
The file command is used to identify a particular file according to the type of data contained in the file.
[Updated 7 September 2011] This update fixes a bug in which the file utility did not parse ELF (Executable and Linkable Format) binary files correctly. If an entry in the program header table contained a file offset beyond the end of file, dynamically linked files were reported as being linked statically. The file utility now recognizes files in the described scenario correctly. (BZ#730336)

Bug Fixes

BZ#676045, BZ#712992, BZ#712988
Prior to this update, the file utility could have been unable to recognize RPM files for certain supported architectures. This update improves the file type recognition, and the RPM files for all supported architectures are now correctly identified as expected.
BZ#688700
Prior to this update, the file utility did not correctly recognized the IBM System z kernel images. This problem has been corrected so that the IBM System z kernel images are now correctly recognized as expected.
BZ#692098
Prior to this update, the file utility attempted to show information related to core dumps for binary files that were not core dumps. This undesired behavior has been fixed in this update so that information related to core dumps is showed only for core dumps and not for the binary files which are not core dumps.
BZ#675691
Prior to this update, file patterns for LaTeX checked only the first 400 bytes of a file to determine the pattern type. This caused an incorrect pattern type recognition as some files could have contained a larger number of comments at the beginning of the file. Furthermore, file patterns which matched a Python script were tried before the LaTeX patterns and this undesired behavior could have caused an incorrect pattern type recognition as LaTeX files could have included a source code written in Python. With this update, the aforementioned problems have been fixed by increasing the number of first bytes checked for a LaTeX file to 4096 bytes, and by trying the LaTeX patterns before the Python patterns.
BZ#690801
Prior to this update, there were several spelling mistakes contained in the magic(5) manual page. This update corrects the spelling mistakes in the respective manual page.
BZ#716665
Prior to this update, the file utility treated MP3 files as text files, and therefore was unable to recognize the MP3 files. This undesired behavior has been fixed in this update, and the file utility now treats the MP3 files as binary files and is able to properly recognize them.
All users of file are advised to upgrade to these updated packages, which fix these bugs.

4.60. filesystem

An updated filesystem package that fixes one bug is now available for Red Hat Enterprise Linux 6.
The filesystem package is one of the basic packages that is installed on a Red Hat Enterprise Linux system. The filesystem package contains the basic directory layout for the Linux operating system, including the correct permissions for directories.

Bug Fix

BZ#620063
Prior to this update, certain locale subdirectories in the /usr/share/locale/ directory did not have any owner set. With this update, this bug has been fixed so that the filesystem package now owns the subdirectories of the following locales: bg_BG (Bulgarian), en_NZ (New Zealand English), fi_FI (Finnish), gl_ES (Galician), lv_LV (Latvian), ms_MY (Malaysian), sr_RS (Serbian), en@shaw (Shavian), zh_CN.GB2312 (Chinese Simplified), sr@ijekavian (Serbian Jekavian), and sr@ijekavianlatin (Serbian Jekavian Latin).
All users of filesystem are advised to upgrade to this updated package, which fixes this bug.

4.61. fipscheck

Updated fipscheck packages that add one enhancement are now available for Red Hat Enterprise Linux 6.
The fipscheck library is used to verify the integrity of modules validated under FIPS-140-2. The fipscheck package provides helper binaries for creating and verifying HMAC-SHA256 checksum files.

Enhancement

BZ#727277
Prior to this update, the fipscheck library was linked without support for read-only relocations (RELRO) flags. The updated fipscheck packages are now provided with partial RELRO support.
Users of fipscheck are advised to upgrade to these updated packages, which add this enhancement.

4.62. firefox

Updated firefox packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Security Fixes
CVE-2011-2377
A flaw was found in the way Firefox handled malformed JPEG images. A website containing a malicious JPEG image could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-0083, CVE-2011-0085, CVE-2011-2363
Multiple dangling pointer flaws were found in Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-2364, CVE-2011-2365, CVE-2011-2374, CVE-2011-2375, CVE-2011-2376
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-2371
An integer overflow flaw was found in the way Firefox handled JavaScript Array objects. A website containing malicious JavaScript could cause Firefox to execute that JavaScript with the privileges of the user running Firefox.
CVE-2011-2373
A use-after-free flaw was found in the way Firefox handled malformed JavaScript. A website containing malicious JavaScript could cause Firefox to execute that JavaScript with the privileges of the user running Firefox.
CVE-2011-2362
It was found that Firefox could treat two separate cookies as interchangeable if both were for the same domain name but one of those domain names had a trailing "." character. This violates the same-origin policy and could possibly lead to data being leaked to the wrong domain.
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.18:

Bug Fix

BZ#698313
With previous versions of Firefox on Red Hat Enterprise Linux 5, the "background-repeat" CSS (Cascading Style Sheets) property did not work (such images were not displayed and repeated as expected).
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.18, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Security Fixes
CVE-2011-2982
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-0084
A dangling pointer flaw was found in the Firefox Scalable Vector Graphics (SVG) text manipulation routine. A web page containing a malicious SVG image could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-2378
A dangling pointer flaw was found in the way Firefox handled a certain Document Object Model (DOM) element. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-2981
A flaw was found in the event management code in Firefox. A website containing malicious JavaScript could cause Firefox to execute that JavaScript with the privileges of the user running Firefox.
CVE-2011-2983
A flaw was found in the way Firefox handled malformed JavaScript. A web page containing malicious JavaScript could cause Firefox to access already freed memory, causing Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-2984
It was found that a malicious web page could execute arbitrary code with the privileges of the user running Firefox if the user dropped a tab onto the malicious web page.
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.20:
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.20, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
Updated firefox packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Security Fix
BZ#734316
It was found that a Certificate Authority (CA) issued a fraudulent HTTPS certificate. This update renders any HTTPS certificates signed by that CA as untrusted, except for a select few. The now untrusted certificates that were issued before July 1, 2011 can be manually re-enabled and used again at your own risk in Firefox; however, affected certificates issued after this date cannot be re-enabled or used.
All Firefox users should upgrade to these updated packages, which contain a backported patch. After installing the update, Firefox must be restarted for the changes to take effect.
Updated firefox packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Security Fix
BZ#735483
The RHSA-2011:1242 Firefox update rendered HTTPS certificates signed by a certain Certificate Authority (CA) as untrusted, but made an exception for a select few. This update removes that exception, rendering every HTTPS certificate signed by that CA as untrusted.
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.22. After installing the update, Firefox must be restarted for the changes to take effect.
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Security Fixes
CVE-2011-2995
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
CVE-2011-2372
A flaw was found in the way Firefox processed the "Enter" keypress event. A malicious web page could present a download dialog while the key is pressed, activating the default "Open" action. A remote attacker could exploit this vulnerability by causing the browser to open malicious web content.
CVE-2011-3000
A flaw was found in the way Firefox handled Location headers in redirect responses. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Firefox now treats two copies of the Location, Content-Length, or Content-Disposition header as an error condition.
CVE-2011-2999
A flaw was found in the way Firefox handled frame objects with certain names. An attacker could use this flaw to cause a plug-in to grant its content access to another site or the local file system, violating the same-origin policy.
CVE-2011-2998
An integer underflow flaw was found in the way Firefox handled large JavaScript regular expressions. A web page containing malicious JavaScript could cause Firefox to access already freed memory, causing Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.23:
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.23, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Security Fixes
CVE-2011-3647
A flaw was found in the way Firefox handled certain add-ons. A web page containing malicious content could cause an add-on to grant itself full browser privileges, which could lead to arbitrary code execution with the privileges of the user running Firefox.
CVE-2011-3648
A cross-site scripting (XSS) flaw was found in the way Firefox handled certain multibyte character sets. A web page containing malicious content could cause Firefox to run JavaScript code with the permissions of a different website.
CVE-2011-3650
A flaw was found in the way Firefox handled large JavaScript scripts. A web page containing malicious JavaScript could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox.
For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.24:
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.24, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

4.63. firstaidkit

Updated firstaidkit packages that fix two bugs are now available for Red Hat Enterprise Linux 6.
FirstAidKit is a tool that runs automated diagnostics of an installed system.

Bug Fixes

BZ#664876
Previously, FirstAidKit's GRUB plug-in incorrectly reported failure if GRUB was installed into the Master Boot Record (MBR). Due to the plug-in being unreliable, it has been removed from the firstaidkit package.
BZ#738563
The firstaidkit-plugin-grub package has been removed from Red Hat Enterprise Linux 6.2. As a consequence, in rare cases, the system upgrade operation may fail with unresolved dependencies if the plug-in has been installed in a previous version of Red Hat Enterprise Linux. To avoid this problem, the firstaidkit-plugin-grub package should be removed before upgrading the system. However, in most cases, the system upgrade completes as expected.
All users of firstaidkit are advised to upgrade to these updated packages, which fix these bugs.

4.64. firstboot

An updated firstboot package that fixes two bugs is now available for Red Hat Enterprise Linux 6.
The firstboot utility runs after installation and guides the user through a series of steps that allows for easier configuration of the machine.

Bug Fixes

BZ#700283
Previously, the Traditional Chinese translation (zh_TW) of the Forward button on the welcome page was different from the action mentioned in the text, on the same page, referring to this button. This update provides the corrected translation.
BZ#700305
Previously, when running firstboot in Japanese locale and the user attempted to continue without setting up an account, an untranslated warning message appeared. With this update, the message is properly translated into Japanese.
All users of firstboot are advised to upgrade to this updated package, which fixes these bugs.

4.65. foomatic

An updated foomatic package that fixes one security issue is now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. The package also includes spooler-independent command line interfaces to manipulate queues and to print files and manipulate print jobs. foomatic-rip is a print filter written in C.
Security Fix
CVE-2011-2964
An input sanitization flaw was found in the foomatic-rip print filter. An attacker could submit a print job with the username, title, or job options set to appear as a command line option that caused the filter to use a specified PostScript printer description (PPD) file, rather than the administrator-set one. This could lead to arbitrary code execution with the privileges of the "lp" user.
All foomatic users should upgrade to this updated package, which contains a backported patch to resolve this issue.

4.66. freetype

Updated freetype packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide the FreeType 2 font engine.
Security Fix
CVE-2011-0226
A flaw was found in the way the FreeType font rendering engine processed certain PostScript Type 1 fonts. If a user loaded a specially-crafted font file with an application linked against FreeType, it could cause the application to crash or, possibly, execute arbitrary code with the privileges of the user running the application.
Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The X server must be restarted (log out, then log back in) for this update to take effect.
Updated freetype packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 and 6 provide only the FreeType 2 font engine.
Security Fix
CVE-2011-3256
Multiple input validation flaws were found in the way FreeType processed bitmap font files. If a specially-crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

Note

These issues only affected the FreeType 2 font engine.
Users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.
Updated freetype packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link associated with the description below.
FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. The freetype packages for Red Hat Enterprise Linux 4 provide both the FreeType 1 and FreeType 2 font engines. The freetype packages for Red Hat Enterprise Linux 5 and 6 provide only the FreeType 2 font engine.
Security Fix
CVE-2011-3439
Multiple input validation flaws were found in the way FreeType processed CID-keyed fonts. If a specially-crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.

Note

These issues only affected the FreeType 2 font engine.
Users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. The X server must be restarted (log out, then log back in) for this update to take effect.

4.67. fuse

Updated fuse packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
FUSE (Filesystem in Userspace) can implement a fully functional file system in a user-space program. These packages provide the mount utility, fusermount, the tool used to mount FUSE file systems.
Security Fixes
CVE-2010-3879, CVE-2011-0541, CVE-2011-0542, CVE-2011-0543
Multiple flaws were found in the way fusermount handled the mounting and unmounting of directories when symbolic links were present. A local user in the fuse group could use these flaws to unmount file systems, which they would otherwise not be able to unmount and that were not mounted using FUSE, via a symbolic link attack.

Note

The util-linux-ng RHBA-2011:0699 update must also be installed to fully correct the above flaws.
All users should upgrade to these updated packages, which contain backported patches to correct these issues.
An updated fuse package that fixes one bug is now available in Red Hat Enterprise Linux 6.
The fuse package contains the file system in userspace utilities and libraries required for using fuse file systems.
Bug Fix
BZ#723757
Prior to this update, fusermount used an incorrect path to unmount. As a result, fusermount was unable to unmount mounted fuse file systems. This update, modifies fusermount to use the correct mount path. Now, mounted fuse file systems can be successfully unmounted with fusermount.
All users who use fuse file systems in their environment are advised to upgrade to this updated fuse package, which fixes this bug.

4.68. gcc

Updated gcc packages that fix various bugs and add three enhancements are now available for Red Hat Enterprise Linux 6.
The gcc packages include C, C++, Java, Fortran, Objective C, Objective C++, and Ada 95 GNU compilers, along with related support libraries.

Bug Fixes

BZ#696352
The previous version of GCC incorrectly assumed that processors based on the AMD's multi-core architecture code named Bulldozer support the 3DNow! instruction set. This update adapts the underlying source code to make sure that GCC no longer uses the 3DNow! instructions on these processors.
BZ#705764
On the PowerPC architecture, GCC previously passed the V2DImode vector parameters using the stack and returned them in integer registers, which does not comply with the Application Binary Interface (ABI). This update corrects this error so that GCC now passes these parameters using the AltiVec parameter registers and returns them via the AltiVec return value register.
BZ#721376
Previously, GCC did not flush all pending register saves in a Frame Description Entry (FDE) before inline assembly instructions. This may have led to various problems when the inline assembly code modified those registers. With this update, GCC has been adapted to flush pending register saves in FDE before inline assembly instructions, resolving this issue.
BZ#732802
Prior to this update, the gcov test coverage utility sometimes incorrectly counted even opening brackets, which caused it to produce inaccurate statistics. This update applies a patch that corrects this error so that gcov ignores such brackets, as expected.
BZ#732807
When processing source code that extensively used overloading (that is, with hundreds or more overloads of the same function or method), the previous version of the C++ front end consumed a large amount of memory. This negatively affected the overall compile time and the amount of used system resources. With this update, the C++ front end has been optimized to use less resources in this scenario.

Enhancements

BZ#696145
This update adds support for new "-mfsgsbase", "-mf16c", and "-mrdrnd" command line options, as well as corresponding intrinsics to the immintrin.h header file. This allows for reading FS and GS base registers, retrieving random data from the random data generator, and converting between floating point and half-precision floating-point types.
BZ#696370
GCC now supports AMD's next generation processors. These processors can now be specified on the command line via the "-march=" and "-mtune=" command line options.
BZ#696495
GCC now supports Intel's next generation processor instrinsics and instructions for reading the hardware random number generator.
All users of gcc are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

4.69. gdb

Updated gdb packages that fix multiple bugs and add three enhancements are now available for Red Hat Enterprise Linux 6.
The GNU Debugger (GDB) allows users to debug programs written in C, C++, and other languages by executing them in a controlled fashion and then printing out their data.

Bug Fixes

BZ#669432
Prior to this update, GDB could stop on error when trying to access the libpthread shared library before the library was relocated. Fixed GDB lets the relocations to be resolved first, making such program debuggable.
BZ#669434
The Intel Fortran Compiler records certain debug info symbols in uppercase but the gfortran compiler writes case-insensitive symbols in lowercase. As a result, GDB could terminate unexpectedly when accessing uppercase characters in the debug information from the Intel Fortran Compiler. With this update, GDB properly implements case insensitivity and ignores the symbols case in the symbol files.
BZ#692386
When the user selected the "-statistics" option with a negative number as a result, GDB printed the minus sign twice. This has been fixed and GDB now displays negative numbers with one minus sign only.
BZ#697900
On the PowerPC and the IBM System z architectures, GDB displayed only LWP (light-weight process) identifiers which matched the Linux TID (Thread Identifier) values for the threads found in the core file. GDB has been fixed to initialize the libthread_db threads debugging library when accessing the core file. GDB now correctly displays the pthread_t identifier in addition to the LWP identifier on the aforementioned architectures.
BZ#702427
Structure field offsets above 65535 described by the DWARF DW_AT_data_member_location attribute were improperly interpreted as a 0 value. GDB has been modified and can now handle also large structures and their fields.
BZ#704010
The difference between the very closely related "ptype" and "whatis" commands was not clearly defined in the gdb info manual. Detailed differences between these commands have been described in the manual.
BZ#712117
Prior to this update, the "info sources" subcommand printed only relative paths to the source files. GDB has been modified to correctly display the full path name to the source file.
BZ#730475
Modifying a string in the executable using the "-write" command line option could fail with an error if the executable was not running. With this update, GDB can modify executables even before they are started.

Enhancements

BZ#696890
With this update, Float16 instructions on future Intel processors are now supported.
BZ#698001
Debugged programs can open many shared libraries on demand at runtime using the dlopen() function. Prior to this update, tracking shared libraries that were in use by the debugged program could lead to overhead. The debugging performance of GDB has been improved: the overhead is now lower if applications load many objects.
BZ#718141
Prior to this update, GDB did not handle DWARF 4 .debug_types data correctly. Now, GDB can correctly process data in the DWARF 4 format.
All GDB users are advised to upgrade to these updated gdb packages, which fix these bugs and add these enhancements.

4.70. gdm

Updated gdm packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
The GNOME Display Manager (GDM) provides the graphical login screen, shown shortly after boot up, log out, and when user-switching.

Bug Fixes

BZ#661618
GDM did not properly queue up multiple authentication messages so that messages could quickly be overwritten by newer messages. The queueing mechanism has been modified, and this problem no longer occurs.
BZ#628462
If a Russian keyboard layout was chosen during system installation, the login screen was configured to use Russian input for user names and passwords by default. However, GDM did not provide any visible way to switch between keyboard layouts, and pressing Left Shift and Right Shift keys did not cause the input to change to ASCII mode in GDM. Consequently, users were not able to log in to the system. With this update, GDM allows users to switch keyboard layout properly using the keyboard layout indicator, and users can now log in as expected.
BZ#723515
GDM did not properly release file descriptors used with XDMCP indirect queries. As a consequence, the number of file descriptors used by GDM increased with every XDMCP chooser restart, which, in some cases, led to memory exhaustion and a GDM crash. The underlying GDM code has been modified to manage file descriptors properly, and the problem no longer occurs in this scenario.
BZ#670619
In multi-monitor setups, GDM always displayed the login window on the screen that was determined as active by the mouse pointer position. This behavior caused unpredictable login window placement in dual screen setups when using the NVIDIA's TwinView Dual-Display Architecture because the mouse pointer initially appeared exactly between the monitors outside of the visible screen. GDM now uses new logic to ensure that the initial placement of the mouse pointer and the login window are consistently on one screen.
BZ#645453
The GDM simple greeter login window displayed "Suspend", "Restart" and "Shut Down" buttons even though the buttons were disabled in GDM configuration and the PolicyKit toolkit disallowed any stop, restart, suspend actions on the system. With this update, GDM logic responsible for setting up the greeter login window has been modified and these buttons are no longer displayed under these circumstances
BZ#622561
When authenticating to a system and the fingerprint authentication method was enabled, but no fingerprint reader was attached to the machine, GDM erroneously displayed authentication method buttons for a brief moment. With this update, GDM displays authentication method buttons only if the authentication method is enabled and a reading device is connected.
BZ#708430
GDM did not properly handle its message queue. Therefore, when resetting a password on user login, GDM displayed an error message from a previous unsuccessful attempt. The queueing mechanism has been modified, and this problem no longer occurs.
BZ#688158
When logging into a system using LDAP authentication, GDM did not properly handle LDAP usernames containing backslash characters. As a consequence, such usernames were not recognized and users were not able to log in even though they provided valid credentials. With this update, GDM now handles usernames with backslash characters correctly and users can log in as expected.
All users of gdm are advised to upgrade to these updated packages, which fix these bugs.

4.71. ghostscript

Updated ghostscript packages that fix a bug are now available for Red Hat Enterprise Linux 6.
The Ghostscript suite provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language), and an interpreter for PDF files. Ghostscript translates PostScript code into many common, bitmapped formats, like those understood by most printers and displays. This enables users to display PostScript files and print them on non-PostScript printers.

Bug Fix

BZ#710651
Previously, the default paper size was selected in portrait orientation when printing documents in landscape orientation. Consequently, the output was printed in portrait orientation and the content was cropped on the right side. With this update, if the paper size matches in landscape mode, that paper size is selected and the landscape orientation is selected for printing.
All users of ghostscript are advised to upgrade to these updated packages, which fix this bug.

4.72. gimp

Updated gimp packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
The GIMP (GNU Image Manipulation Program) is an image composition and editing program.
Security Fixes
CVE-2010-4543
A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro (PSP) image file plug-in. An attacker could create a specially-crafted PSP image file that, when opened, could cause the PSP plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP.
CVE-2010-4540, CVE-2010-4541, CVE-2010-4542
A stack-based buffer overflow flaw was found in the GIMP's Lightning, Sphere Designer, and Gfig image filters. An attacker could create a specially-crafted Lightning, Sphere Designer, or Gfig filter configuration file that, when opened, could cause the relevant plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP.
Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

4.73. glibc

Updated glibc packages that fix two security issues, numerous bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links associated with each description below.
The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.
Security Fixes
CVE-2009-5064
A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd.
CVE-2011-1089
It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file.
Red Hat would like to thank Dan Rosenberg for reporting the CVE-2011-1089 issue.
Bug Fixes
BZ#676467
The installation of the glibc-debuginfo.i686 and glibc-debuginfo.x86_64 packages failed with a transaction check error due to a conflict between the packages. This update adds the glibc-debuginfo-common package that contains debuginfo data that are common for all platforms. The package depends on the glibc-debuginfo package and the user can now install debuginfo packages for different platforms on a single machine.
BZ#676591
When a process corrupted its heap, the malloc() function could enter a deadlock while creating an error message string. As a result, the process could become unresponsive. With this update, the process uses the mmap() function to allocate memory for the error message instead of the malloc() function. The malloc() deadlock therefore no longer occurs and the process with a corrupted heap now aborts gracefully.
BZ#692838
India has adopted a new symbol for the Indian rupee leaving the currency symbol for its Unicode U20B9 outdated. The rupee symbol has been updated for all Indian locales.
BZ#694386
The strncmp() function, which compares characters of two strings, optimized for IBM POWER4 and POWER7 architectures could return incorrect data. This happened because the function accessed the data past the zero byte (\0) of the string under certain circumstances. With this update, the function has been modified to access the string data only until the zero byte and returns correct data.
BZ#699724
The crypt() function could cause a memory leak if used with a more complex salt. The leak arose when the underlying NSS library attempted to call the dlopen() function from libnspr4.so with the RTLD_NOLOAD flag. With this update, the dlopen() with the RTLD_NOLOAD flag has been fixed and the memory leak no longer occurs.
BZ#700507
On startup, the nscd daemon logged the following error into the log file if SELinux was active:
rhel61 nscd: Can't send to audit system: USER_AVC avc:  netlink
poll: error 4#012: exe="?" sauid=28 hostname=? addr=? terminal=?
This happened because glibc failed to preserve the respective capabilities on UID change in the AVC thread. With this update, the AVC thread preservers the respective capabilities after the nscd startup.
BZ#703481, BZ#703480
When a host was temporarily unavailable, the nscd daemon cached an error, which did not signalize that the problem was only transient, and the request failed. With this update, the daemon caches a value signalizing that the unavailability is temporary and retries to obtain new data after a set time limit.
BZ#705465
When a module did not provide its own method for retrieving a user list of supplemental group memberships, the libc library's default method was used instead and all groups known to the module were examined to acquire the information. Consequently, applications which attempted to retrieve the information from multiple threads simultaneously, interfered with each other and received an incomplete result set. This update provides a module-specific method which preven