6.6 Technical Notes

Bug Fixes

BZ#1001037

When a new user was created on Active Directory (AD) and their password was set, the system administor checked the flag "User must change password on next login". Afterwards, the default password was sent to Red Hat Directory Server (RHDS), which set the password but removed the aforementioned flag. With this update, the flag for password change at next login persists, and the password sync tool for by-passing the 7-day constraint is allowed if the flag is checked.

BZ#1008021

If an ACI (access control instruction) is configured to give permissions to "self", bound user itself, the result of a granted access for an entry was cached and could erroneously be reused for all entries. Consequently, a bound client could retrieve entries or attributes it was not supposed to, or fail to retrieve those entries and attributes it was supposed to retrieve. With this update, certain accesses are granted per entry, making sure that if a granted access is cached, it is purged for the next entry.

BZ#1009122

The multi-master replication protocol keeps a cumulative counter of the relative time offsets between servers. However, prior to this update, if the system time was adjusted by more than one day, the counter became off by more than one day. Consequently, a replication consumer refused to accept changes from the master and the replication process failed. This update adds a new configuration attribute to cn=config - nsslapd-ignore-time-skew, with the default of "off". In addition, an error message is logged warning the system administrator about the time skew issue. Alternatively, if this attribute is set to "on", a replication consumer allows replication to proceed despite the excessive time skew.

BZ#1012699

Previously, when an invalid install script from host name to the server was supplied, a vague error message was returned to the user. This update provides a proper error message to be returned when a setup script encounters an error in the host name.

BZ#1044218

Previously, the size of the directory server was constantly increasing after search requests for simple paged results were processed. The memory leak causing this bug has been fixed, and the server size no longer increases in the aforementioned situation.

BZ#1049029

Prior to this update, Windows Sync Control request returned the renamed member of a group entry only, not the group containing this member. As a consequence, renaming user Distinguished Name (DN) on Active Directory (AD) was not applied to the synced member DN in a group that the user DN belonged to. With this update, once a rename operation is received from AD, Windows Sync Control searches groups having a member value, and replaces the old DN with the renamed DN. In addition, Windows Sync Control also updates the renamed member DN in a group as intended.

BZ#1053766

Previously, when importing an LDAP Data Interchange Format (LDIF) or doing a replication initialization that contained tombstone entries, the parent entry of the tombstone entry had its numsubordinate entry count incorrectly incremented. With this update, the parent entry numsubordinate attribute is not updated when processing a tombstone entry, and numsubordinate value is now accurate in all entries.

BZ#1057805

Previously, calculating the size of an entry in the memory was underestimated: the entry cache size was larger than the specified size in the configuration. This bug has been fixed by calculating each entry size more accurately, which leads to more accurate size of the entry cache.

BZ#1060385

When trying to process an empty log file, the logconv.pl utility failed to run and reported a series of Perl errors. To fix this bug, empty log files are checked and ignored, and logconv.pl reports the empty log file by the following message:

Skipping empty access log, /var/log/dirsrv/slapd-ID/access.

BZ#1070583

While a Total Replication Update or Replica Initialization was occurring, the server could terminate unexpectedly. With this update, the replication plugin is not allowed to terminate while the total update of replica is still running, and the server thus no longer crashes.

BZ#1070720

Prior to this update, using the "-f" filter option caused the rsearch utility to return a filter syntax error. This update makes sure the filter is properly evaluated, and rsearch now works correctly when using the "-f" option.

BZ#1071707

Previously, when a search request for simple paged results was sent to a server and the request was abandoned, the paged result slot in the connection table was not properly released. Consequently, as the slot was not available, the temporary initial slot number "-1" was kept to access an array, which caused its invalid access. With this update, the abandoned slot content is properly deleted for reuse. As a result, the temporary slot number is now replaced with the correct slot number, and invalid array accesses no longer occur.

BZ#1073530

Due to exceeded size limit, Access Control Instruction (ACI) group evaluation failed. However, the "sizelimit" value could be a false value retrieved from a non-search operation. With this update, detected false values are replaced with an unlimited value (-1), and ACI group evaluation no longer fails due to an unexpected sizelimit exceeded error.

BZ#1077895

Performing an LDAP operation using the proxied authentication control could previously lead to server memory leaks. With this update, the allocated memory is released after the operation completion, and the server no longer leaks memory when processing operations using the proxied authentication control.

BZ#1080185

Prior to this update, the tombstone data resurrection did not consider the case in which its parent entry became a conflict entry. In addition, resurrected tombstone data treatment was missing in the entryrdn index. As a consequence, the parent-child relationship became confused when the tombstone data was being resurrected. With this update, the Directory Information Tree (DIT) structure is properly maintained; even if the parent of a tombstone-data entry becomes a conflict entry, the parent-child relationship is now correctly managed.

BZ#1083272

Due to improper use of the valueset_add_valueset() function, which expects only empty values to be passed to it, the server could terminate unexpectedly. This update handles the misuse of the function, which now no longer causes the server to crash.

BZ#1086454

Previously, the logging level was too verbose for the severity of the message, and the errors log could fill up with redundant messages. To fix this bug, the logging has been changed to be written only when "access control list processing" log level is being used, and thus the errors log no longer fills up with harmless warning messages.

BZ#1086903

Previously, if the do_search() function failed at the early phase, the memory storing the given baseDN was not freed. The underlying source code has been fixed, and the baseDN no longer leaks memory even if the search fails at the early phase.

BZ#1086907

Previously, in the entry cache, some delete operations failed with an error when entries were deleted while tombstone purging was in process. This update retries to obtain the parent entry until it succeeds or times out. As a result, delete operations in the entry cache now succeed as intended.

BZ#1092097

Previously, when Multi Master Replication was configured, if an entry was updated on Master 1 and deleted on Master2, the replicated update from Master 1 could target on a deleted entry (a tombstone). This led to two consequences. Firstly, the replicated update failed and could break the replication. Secondly, the tombstone entries differed on Master 1 and Master 2. This update allows updates on a tombstone if the update originates in a replication. Now, replication succeeds and tombstone entries are identical on all servers.

BZ#1097002

When deleting a node entry whose descendants were all deleted, previously, only the first position was checked. Consequently, the child entry at the first position was deleted in the database. However, it could be reused for the replaced tombstone entry, which reported the false error "has children", and thus caused the node deletion to fail. With this update, instead of checking the first position, all child entries are checked whether they are tombstones or not; in case all of them are tombstones, the node is deleted. Now, the false error "has children" is no longer reported, and a node entry whose children are all tombstones is successfully deleted.

BZ#1098653

When a replication is configured, a replication change log database is also a target of the backup. However, backing up a change log database previously failed because there was no back end instance associated with the replication change log database. As a consequence, backing up on a server failed. With this update, if a backing up database is a change log database, the db2bak.pl utility skips checking the back end instance, and backing up thus works as intended.

BZ#1103287

When processing a large amount of access logs without using any verbose options, memory continued to grow until the system was exhausted of available memory, or logs were completely processed. The back-ported feature causing excessive memory consumption has been removed, and memory now remains stable regardless of the amount of logging being processed.

BZ#1103337

Previously, the following message was incorrectly coded as an error level:

changelog iteration code returned a dummy entry with csn %s, skipping ...

Consequently, once the server run into the state, this benign error message was logged in the error log repeatedly. To fix this bug, the log level has been changed, and the the message is no longer logged.

BZ#1106917

Prior to this update, when performing a modrdn operation on a managed entry, the managed entry plugin failed to properly update managed entry pointer. The underlying source code has been fixed, and the managed entry link now remains intact on modrdn operations.

BZ#1109333

The previous MemberOf plugin code assumed the Distinguished Name (DN) value to have the correct syntax, and did not check the normalized value of that DN. This could lead to dereferencing a NULL pointer and unexpected termination. This update checks the normalized value and logs a proper error. As a result, invalid DN no longer causes crashes and errors are properly logged.

BZ#1109335

When adding and deleting entries, the modified parent entry, numsubordinates, could be replaced in the entry cache, even if the operation failed. As a consequence, parent numsubordinate count could be incorrectly updated. This update adds code to unswitch the parent entry in the cache, and parent numsubordinate count is now guaranteed to be correct.

BZ#1109337

Previously, if nested tombstone entries were present, parents were always purged first, and thus their child entries became orphaned. With this update, when doing the tombstone purge, the candidate list is processed in the reverse order, which removes the child entries before the parent entries. As a result, orphaned tombstone entries are no longer left orphaned after purging.

BZ#1109352

Previously, a tombstone purge thread issued a callback search that started reading the id2entry file, even if the back end had already been stopped or disabled. This could cause the server to terminate unexpectedly. Now, when performing a search and returning entries, this update checks if the back end is started before reading id2entry. As a result, even if the tombstone purge occurs while the back end is stopped, the server no longer crashes.

BZ#1109356

Due to various mistakes in the source code, potential memory leaks, corrupted memory, or crashes could occur. All the aforementioned bugs have been addressed, and the server now behaves as expected without crashing or leaking memory.

BZ#1109358

Due to a failure in back end transaction, the post plugin was not properly passed to the back end. As a consequence, the ldapdelete client unexpectedly executed a tombstone deletion. A failure check code has been added with this update, and a tombstone deletion by ldapdelete now fails as expected.

BZ#1109361

Previously, the server enabled the rsa_null_sha cipher, which was not considered secure. With this update, rsa_null_sha is no longer available.

BZ#1109363

Previously, the caller of the slapi_valueset_add_attr_valuearray_ext() function freed the returned Slapi_ValueSet data type improperly upon failure. Consequently, Slapi_ValueSet leaked memory when the attribute adding operation failed. This update adds the code to free the memory, and returned Slapi_ValueSet no longer leaks memory.

BZ#1109373

Prior to this update, syntax plugins were loaded during bootstrapping. However, in that phase, attributes had already been handled. As a consequence, the sorted results of multi-attribute values in schema and Directory Server specific Entries (DSE) became invalid. This update adds a default syntax plugin, and the sorted results of DSE and schema are now in the right order.

BZ#1109377

Previously, environment variables, except from TERM and LANG, were ignored if a program was started using the "service" utility. Consequently, memory fragmentation could not be configured. To fix this bug, mallopt environment variables, "SLAPD_MXFAST", "MALLOC_TRIM_THRESHOLD_" and "MALLOC_MMAP_THRESHOLD_", have been made configurable. Now, memory fragmentation can be controlled explicitly and provide instructions to the "service" utility.

BZ#1109379

Prior to this update, when running a CLEANALLRUV task, the changelog replication incorrectly examined a Change Sequence Number (CSN) which could be deleted and returned as the minimum CSN for a replica. With this update, CSNs that are from a "cleaned" replica ID are ignored, and replication now uses the correct minimum CSN.

BZ#1109381

Previously, a group on Active Directory (AD) had a new member which was not a target of windows sync and existed only on AD. If an operation was executed on AD, the member was replaced with other members which were the targets of the windows sync. Consequently, the new member values were not synchronized. With this update, a modify operation follows including the member value, which is now proceeded by confirming the existence on AD, thus fixing the bug.

If a group on Active Directory (AD) and Directory Server (DS) had members which were local, not synchronized, and the members were removed from the group on one side, the delete operation was synchronized and all the members including the local ones were deleted. The underlying source code has been modified to check, firstly, if an attribute is completely deleted on one side, secondly, if each value on the other side is in the sync scope. In addition, the value is now put to the mode for the delete only if the value is in the sync scope.

BZ#1109384

Previously, the manual page for the logconv.pl utility was missing some of the command line options. The manual page has been updated to show the complete usage of logconv.pl with all the available options.

BZ#1109387

Due to a bug in partial restoration, the order of the restored index became confused. With this update, the default compare function is called. Now, after running a partial restoration, indexing problems no longer occur.

BZ#1109443

In processing Class of Service (CoS) definition entry, if the cosTemplateDn entry was not yet given when the cosAttribute entry was being processed, the parent entry Distinguished Name (DN) was set to cosTemplateDn automatically. Consequently, the parent entry could be an ancestor entry of an entry to be updated. In addition, if the entry was a target of the betxn type of plugins, a deadlock occurred. With this update, the parent entry DN is added only when codTemplateDn is not provided. Now, even if cosAttribute and cosTemplateDn are listed in the order in the CoS definition entry and the betxn type plug-ins are enabled, updating an entry no longer causes deadlocks.

BZ#1109952

Previously, if Virtual List View (VLV) search failed with "timelimit" or "adminlimit" server resources, the allocated ID list was not freed. Consequently, when the failure occurred, the memory used for the ID list leaked. This update adds the free code for the error cases, and the memory leaks caused by the VLV failure no longer occur.

Enhancement

BZ#985270

Previously, only the root Distinguished Name (DN) accounts were able to specify users that could bypass the password policy settings or add hashed passwords to users. With this update, non-root DN accounts are allowed to perform these types of operations as well.

Bug Fix

BZ#1080185

Bug fixes for replication conflict resolution

Bug Fixes

BZ#1025009

When the machine suspended, the NetworkManager daemon deactivated all network devices on that machine. Consequently, the Wake-on-LAN clients did not work because this network device was powered down, and thus could not receive the Magic Packet. With this update, NetworkManager leaves devices running at suspend time if they have the Wake-on-LAN or Wake-on-Wireless-LAN variable enabled, and Wake-on-LAN works as intended if the administrator enables it.

BZ#1034860

Previously, NetworkManager used the kernel's Point-to-point protocol over Ethernet (PPPoE) driver, which did not inform userland when it received a PPPoE Active Discovery Terminate (PADT) frame. As a consequence, when connecting to certain digital subscriber line (DSL) providers, the NetworkManager daemon failed to notice whether the connection was dropped. With this update, NetworkManager uses a userland PPPoE driver rather than the kernel driver, and dropped DSL connections are now noticed for all providers.

BZ#1113996

NetworkManager automatically provides an autoconnect for interfaces. Previously, when this connection was altered and saved, NetworkManager terminated unexpectedly. The write_ip4_setting() function has been updated to fix this bug, and NetworkManager no longer crashes after saving altered configuration.

Bug Fix

BZ#784223

Due to improper synchronization between multiple threads when accessing shared data objects, the bonobo-activation-server process was in certain cases killed by the SIGSEGV signal. With this update, clean-up tasks on one thread have been deferred, so synchronization is no longer necessary. As a result, the process does not crash anymore in the described scenario.

Bug Fixes

BZ#743399

Due to a regression, some systems reported the following entry in the Automatic Bug Reporting Tool (ABRT) even though no applications were being tested at the time and the systems were idle:

"Process /usr/sbin/packagekitd was killed by signal 11 (SIGSEGV)"

A patch has been provided to fix this bug, and ABRT no longer produces such error messages.

BZ#811097

When running the "pkcon install" command, the pkcon utility failed to provide a prompt for the user requiring more information. Instead, the pkcon utility terminated unexpectedly and returned the following error:

"Fatal error: user declined simulation"

An upstream patch has been provided to fix this bug. As a result, pkcon prompts the user with "Proceed with changes? [N/y]" to get an input, and completes successfully.

BZ#874270

Due to a series of processes all aborting and nsswitch malfunctioning, starting the KVM host or guest displayed error messages on ABRT. The bug has been fixed, and KVM no longer returns error messages.

Security Fixes

CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003, CVE-2013-2062, CVE-2013-2064

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system.

CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2066

Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client.

CVE-2013-1995

A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11's libXi runtime library handled signed numbers. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client.

CVE-2013-2005

A flaw was found in the way the X.Org X11 libXt runtime library used uninitialized pointers. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client.

CVE-2013-2004

Two stack-based buffer overflow flaws were found in the way libX11, the Core X11 protocol client library, processed certain user-specified files. A malicious X11 server could possibly use this flaw to crash an X11 client via a specially crafted file.

Bug Fixes

BZ#1054614

Previously, updating the mesa-libGL package did not update the libX11 package, although it was listed as a dependency of mesa-libGL. This bug has been fixed and updating mesa-libGL now updates all dependent packages as expected.

BZ#971626

Previously, closing a customer application could occasionally cause the X Server to terminate unexpectedly. After this update, the X Server no longer hangs when a user closes a customer application.

Bug Fix

BZ#1084467

Previously, kernel oops messages were deleted by ABRT, and thus the user was not sufficiently informed about the kernel behavior. With this update, kernel oops messages are kept and also supplemented by an explanation. The previous behavior can be restored in the newly created /etc/abrt/plugins/oops.conf file (man abrt-oops.conf).

Enhancement

BZ#989530

With this update, ABRT messages include machine host name.

Bug Fixes

BZ#806911

Previously, the AIDE utility did not handle 'prelink' files properly if the prelink package was not installed. As a consequence, initializing the database by running the 'aide --init' command caused errors, and the database could not then be read with the 'aide --check' command. With this update, after running the 'aide --init' command in the described situation, a warning massage is displayed that prompts the user to install the prelink package first.

BZ#1119759

Prior to this update, the AIDE utility did not process the 'report_attributes' parameter correctly. Consequently, running the 'aide --check' command resulted in an incomplete report and a segmentation fault. A patch has been applied to address this bug, and AIDE now works as expected when reporting forced attributes.

Bug Fix

BZ#1073939

Previously, the Akonadi service used the hard-coded ~/.local/share/akonadi socket directory. As a consequence, the Akonadi server did not start if the home directory was located on Andrew File System (AFS), which did not support the creation of UNIX sockets. With this update, the directory that holds the sockets has been changed to '/tmp/[username]-akonadi.[random]'. As a result, Akonadi starts on systems with the home directory on AFS as expected.

Bug Fix

BZ#1072956

The alsa-utils packages have been updated with various upstream fixes to improve stability and usage.

Bug Fixes

BZ#689823

Previously, Abstract Machine Test Utility (AMTU) did not handle the name of the interface correctly under certain circumstances. As a consequence, AMTU failed to obtain a list of network interfaces to test. With this update, the interface hardware type and carriers are obtained from the /sys/class/net/ directory. Now, only an Ethernet and a token ring can be used, and a carrier must be present. As a result, AMTU handles the new network interface names as expected.

BZ#723049

Prior to this update, AMTU ran network tests on interfaces configured with a static IP that did not have an existing connection, causing those tests to fail. With this update, AMTU no longer runs tests on interfaces that are not up.

BZ#1098076

Previously, the name of the network interface was restricted to 4 characters on 32-bit systems and 8 characters on 64-bit system due to using the sizeof() operator instead of the strlen() function. As a consequence, AMTU did not correctly display the full network interface name in certain portions of the output. A patch has been applied to address this bug, and AMTU now always displays the full network interface name as expected.

Bug Fixes

BZ#734121

When users of IBM System z had the kdump package installed, the default kernel was set to kernel-kdump. However, the zIPL utility ignored the Kdump and debugged kernels when creating the zipl.conf file. Consequently, after updating the system, the newly-installed kernel was not set as the default entry in zipl.conf since the default kernel has been set to kernel-kdump. Now, if a kernel name includes “-kdump”, such a kernel is not set as default instead of the newly-installed kernel.

BZ#979163

Under certain circumstances, downloading of a kickstart file could fail due slow network initialization. To address this bug, a new GATEWAY_PING_TIMEOUT option has been added to the Network Manager. The option checks connectivity to the server before reporting a network interface as being connected. With this update, Anaconda has been modified to use this feature by the nicedelay boot option that can now be used in cases of very slow network initialization.

BZ#1001960

No major release version was written to the boot menu for Red Hat Enterprise Linux. As a consequence, after installing on a multi-boot system, it was not clear which Red Hat Enterprise Linux entry corresponded to which major version. The boot menu entry now contains the major version of the Red Hat Enterprise Linux release. For Red Hat Enterprise Linux 6, this means there is the Red Hat Enterprise Linux 6 entry. Note that there is not the minor version number, such as 6.6. This is because there is currently no infrastructure to update the boot menu entry in place, so the entry would be incorrect after an upgrade.

BZ#1038001

When a bonding device was specified in the %pre section of a kickstart file and used with the %include kickstart option, Anaconda could not create the bond interface correctly. This update applies a patch to fix this bug and bonding interfaces are created as expected in the described scenario.

BZ#1039051

Previously, it was not possible to specify a local domain name by the kickstart network command. As a consequence, if a short host name was configured by the kickstart network --hostname option, name resolution of short names from local domain did not work properly in the Anaconda installer. A new --domain option for the network command has been added to address this bug.

BZ#1044716

When upgrading using Anaconda, it attempted to enable all swap devices listed in the /etc/fstab/ directory on the system. However, Anaconda did not check whether the swap devices existed. Consequently, non-existent swap devices listed in /etc/fstab/ caused errors to be returned during an upgrade. With this update, when Anaconda encounters such a device, it displays a dialog window allowing the user to either skip the device or abort the upgrade.

BZ#1046320

The --percent parameter was omitted in the output kickstart file, even if it was provided in the input kickstart file. As a consequence, the installation would be less reproducible using the output kickstart file. With this update, the kickstart code has been modified to not omit the --percent parameter from the output kickstart file.

BZ#1067857

Previously, Anaconda did not check the VLAN ID that was passed as a boot parameter. Therefore, Anaconda could not retrieve a kickstart file on an NFS volume over a VLAN interface, because a VLAN connection had not been established. This update modifies Anaconda to check the VLAN ID.

BZ#1123791

During installation, the /tmp/ size directory was always 250M. On systems with a large number of drives, large driver update disks, or a large number of repositories, /tmp/ space could be exhausted, causing the installation to terminate unexpectedly. With this update, 50% of memory is reserved for /tmp/ on systems with RAM greater than 512M, thus the installation proceeds correctly in the aforementioned scenario.

Enhancements

BZ#1081596

This update allows using the symbolic console device identifier for the cio_ignore kernel parameter in the generic.prm file for the IBM System z. Using this identifier prevents issues which may arise if no default console device number is available at installation time, or if the console device number is different from what was previously a hard-coded value in the generic.prm file. As a result, console devices using a different device identifier than what was previously hard-coded into the generic.prm file can be removed from the blacklist and made available for use.

Bug Fixes

BZ#1065067

The interpretation of the "ausearch -i" command, alternatively "ausearch --interpret", has been improved. * New event types are supported by the audit packages. * Remote logging bugs have been fixed. * The ausearch matching has been improved. * The augenrules utility support has been added to the audit packages. * Management of audispd plugins has been completely reworked. * The updated ausearch and aureport utilities can now produce reports from logs not included in the configured audit log directory by specifying the directory containing the logs on the command line. * The auditctl list rules command (the -l option) now outputs rules from the kernel in a new format which matches the formatting accepted to be loaded into the kernel.

BZ#1028635

Previously, the audisp-remote plugin did not connect to the remote server after a transient "critical" network error. The underlying source code has been patched, and audisp-remote now connects to the remote server as intended.

Enhancements

BZ#96723

With this update, audit rules can be built from a directory of rule files. Rule files can be stored in the /etc/audit/rules.d/ directory based on what packages are installed. When rules need to be loaded into the kernel, they are now assembled into one master file by the augenrules utility and then loaded.

BZ#967240

This update adds a new command line option, --checkpoint. When invoked, the --checkpoint option causes the ausearch utility to report only new complete events on successive executions. This option is especially useful for running periodic reports that display the updates since the last report.

Bug Fixes

BZ#1001635, BZ#1059383

Previously, the Grub lens did not support "setkey", "lock", and "foreground" directives, which caused virt-v2v process to terminate unexpectedly with an error message. The bug has been fixed, and virt-v2v process no longer fails.

BZ#1093711, BZ#1016904

When sudo configuration files, sudoers, contained directives with user aliases or group names using underscore characters, the sudoers lens was unable to parse the configuration file. With this update, underscores have been permitted in group names, and the sudoers lens now parses files successfully.

BZ#1033795

Prior to this update, when shell configuration files contained "export" lines with multiple variables or case statements with two semicolons (;;) on the same line as an expression, Augeas was unable to parse these files. With this update, Augeas handles multiple variables on the same export line and case statements with two semicolons as expected, and the aforementioned files are successfully parsed.

BZ#1043636

Previously, when the sysconfig lens was used to parse a shell configuration file containing a blank comment after another comment, the parsing process failed. The lens has been fixed to parse this combination of comments, and parsing is now finished successfully.

BZ#1062091

When parsing yum configuration files with spaces around key or value separators, Augeas was unable to parse the files. The underlying source code has been fixed, and yum configuration files are now parsed successfully.

BZ#1073072

Prior to this update, no generic lens existed for parsing the INI-style files, and parsing thus failed with an error message. The IniFile module has been fixed to contain generic lenses, and INI-style files are now parsed as intended.

BZ#1075112

When automounter maps contained references to hosts with host names containing hyphens, the automounter lens failed to parse the /etc/auto.export configuration file. A patch has been provided to fix this bug, and /etc/auto.export is now parsed as expected.

BZ#1083016

Prior to this update, the default rsyslog configuration file provided in Red Hat Enterprise Linux failed to parse using Augeas. The rsyslog lens has been fixed to parse the filters and templates used, and /etc/rsyslog.conf is now parsed successfully.

BZ#1100237

When Nagios Remote Plugin Executor (NRPE) configuration files contained the "allow_bash_command_substitution" option, the NRPE lens was unable to parse the files. A patch has been provided to fix this bug, and files with "allow_bash_command_substitution" are now parsed as intended.

Enhancements

BZ#1016899

With this update, lenses have been added to parse configuration files relating to Red Hat JBoss A-MQ, including ActiveMQ configurations, ActiveMQ XML files, Jetty configuration, and JMX access files.

BZ#1016900

A new lens has been added to parse the Splunk configuration files, and thus the user can now manage Splunk configuration through the Puppet module.

Bug Fixes

BZ#852997

Previously, the authconfig utility did not back up the /etc/passwd files, /etc/group, /etc/shadow, and /etc/gshadow files. As a consequence, if the "authconfig --restorebackup" command was run, these files were not reverted. With this update, authconfig backs up the aforementioned files, and when the "--restorebackup" option is used, it properly reverts the state of these files.

BZ#912851

Prior to this update, the authconfig utility did not properly read the LDAP base from the nslcd.conf file if there were multiple specific the LDAP bases specified. Consequently, the value of the LDAP base read from nslcd.conf was incorrect. With this update, authconfig ignores the specific LDAP bases, and reads and overwrites only the general LDAP base value.

BZ#975203

In some cases the authconfig utility was not able to properly detect whether SSSD or Winbind should be enabled. As a consequence, these daemons were stopped when authconfig was run although they should have not been effected. With this update, authconfig no longer changes the state nor restarts the services if the services configuration is not changed. As a result, the SSSD or Winbind runs after the execution of the "authconfig --update" command and does not effect any settings related to SSSD or Winbind.

BZ#1023294

When the "authconfig --disableipav2 --update" command was used, the "ipa-client-install --uninstall" command was not run. As a consequence, the IPA client was not properly deinitialized on the machine and the machine was not removed from the previously joined domain. The updated authconfig utility now correctly calls "ipa-client-install --uninstall" in the described scenario, and the IPA client of the machine is properly deinitialized, and the machine removed from the domain.

BZ#1025065

Prior to this update, the default umask when creating home directories with the pam_mkhomedir utility was 0022, which made these directories world-readable. To fix this bug, the "umask=0077" option with pam_mkhomedir is used by default, and the home directories newly created by pam_mkhomedir are no longer world-readable.

BZ#1119797

Previously, the ipa-client-install command used for the IPAv2 domain join was interactively asking for input. When called from the authconfig-gtk GUI, the user could not interact with it, and thus the domain join operation failed. With this update, the authconfig GUI uses the "ipa-client-install --unattended" command and no longer tries to interact with the user. As a result, the IPAv2 domain join operation is now successful.

Enhancement

BZ#916574

The authconfig utility is now able to set up the automount entry in the nsswitch.conf file to pull information from the LDAP server via the SSSD client.

Bug Fixes

BZ#994217

The am-utils package, which provides automatic mounting of maps in the amd format, is no longer supported in Red Hat Enterprise Linux 6. However, amd-formatted maps are still needed for example when using keys containing the forward slash (/), using wildcard matching for keys, or performing more complex actions after the key is matched. This update adds a parser for amd-formatted maps to the autofs utility.

BZ#1036032

If an IPv6 link-local address contained the percent sign (%), the autofs utility incorrectly reported the address as invalid. The mount location validity check has been updated, and the incorrect reports no longer occur in the described case.

BZ#1038696

When checking the mount option string, the automount daemon did not take into account the length of the string, which led to incorrect comparisons. As a consequence, the mount probes did not include NFS version 3 when the "-v" option was used, and under some circumstances, the mounts were not created properly. The option matching has been modified to account for option length, thus fixing this bug.

BZ#1046164

Due to previous changes to the autofs utility, autofs was not properly handling remote procedure calls (RPC) to probe server availability. Consequently, autofs was not querying the portmapper service for NFS version 2 and NFS version 3 mounts correctly. The RPC handling in autofs has been updated, and autofs now queries host availability properly.

BZ#1059549

The negative cache timeout was not handled properly by the autofs utility. Consequently, autofs was not correctly reading included automounter maps. This update fixes the handling of the negative cache in autofs.

BZ#1068999, BZ#1081285

The autofs utility did not apply mutual exclusion when using the initialization and termination functions from the OpenLDAP library. As these functions are not thread-safe, a double free error occurred and autofs terminated unexpectedly. This bug has been fixed by adding a mutual exclusion condition for the aforementioned OpenLDAP functions.

BZ#1073197

The autofs utility did not correctly process the output from the scandir() function. Consequently, autofs could terminate unexpectedly with a segmentation fault. The autofs utility has been modified to correctly read the scandir() output.

BZ#1081479

If the standard I/O file descriptors were closed by a process that started the autofs utility, autofs, before entering daemon state, could create file descriptor corresponding to one of the standard I/O file descriptors. When autofs entered daemon mode, these file descriptors were closed and autofs terminated unexpectedly. Now, the device control file descriptor is closed after the autofs file system version check and a new descriptor is opened after autofs enters daemon mode.

BZ#1083744

The autofs utility did not properly check for entries that corresponded to previously failed mount attempts, the so-called "negative entries". Consequently, when the "autofs mount" command was specified with the "browse" option, the autofs utility could create directories that did not correspond to map entries within the corresponding automounter map. With this update, the check for negative map entries has been fixed.

BZ#1089576

When calling the autofs parser, the scan buffer was sometimes not properly reset for the next scan. Consequently, incorrect success returns occurred for subsequent operations. The autofs utility attempted to add these returned entries, which led to a segmentation fault. This bug has been fixed by adding a function that resets the parse buffer at the start of each map entry scan.

Bug Fixes

BZ#768708, BZ#885849

Previously, when the ARCOUNT field in the DNS Response Header contained a non-zero value, avahi-daemon performed a check and logged errors about invalid DNS packets being received. Note that a non-zero value of ARCOUNT is an indication of additional data sections in the DNS packet, but avahi-daemon does not interpret them. As a consequence, avahi-daemon was not sufficiently interoperable with other mDNS/DNS-SD implementations, and the automatic service discovery thus did not provide the user with the expected results on some platforms. Additionally, avahi-daemon logged inaccurate information which cluttered log files. The redundant check has been removed, and the described situation no longer occurs.

BZ#1074028

Previously, various options such as maximum count of cached resource records or numerous options related to handling of connected clients to the avahi-daemon could not be configured. As a consequence, in large networks, the avahi-daemon could reach the upper bound of some internal limits. In addition, the avahi-daemon was exhibiting erroneous behavior, such as logging error messages and failing to discover some services in large networks. To fix this bug, support for configuring various internal limits has been introduced with the following newly added options: cache-entries-max, clients-max, objects-per-client-max, entries-per-entry-group-max. For details about these options, see the avahi-daemon.conf(5) manual page.

Bug Fixes

BZ#948207

Under certain circumstances, a file descriptor leak occurred in nested Bash functions. This bug has been fixed and file descriptors are no longer leaked in the described case.

BZ#951171

Due to a bug in the tty driver, an ioctl call could return the "-EINTR" error code when the "read" command was interrupted by a signal, such as SIGCHLD. As a consequence, the subsequent "read" call caused the Bash shell to abort with a "double free or corruption (out)" error message. The applied patch corrects the tty driver to use the "-ERESTARTSYS" error code so the system call is restarted if needed. As a result, Bash no longer crashes in this scenario.

BZ#986095

When the HISTFILESIZE variable was set to a value larger than zero, the HISTSIZE variable was set to zero as well. If the .bash_history file had time stamps enabled and was not empty, executing the "su - " command caused Bash to become unresponsive. This bug has been fixed, and Bash no longer hangs in the aforementioned scenario.

BZ#1007926

Previously, Bash did not process quote characters correctly when using here-strings with multi-line input in a function declaration. Consequently, the declaration was corrupted, which affected copying such functions, or transferring them to another shell. This bug has been fixed, and here-strings with multi-line input are now processed correctly.

BZ#1010164

When processing larger associative arrays inside Bash scripts, a memory leak occurred. This bug has been fixed, and Bash no longer leaks memory when working with associative arrays.

BZ#1012015

If a command substitution enclosed in double-quote characters contained a double-quoted string, Bash performed brace expansion on the command before performing command substitution. Consequently, the command created different output than expected. The bug has been fixed, and command substitution now precedes brace expansion in the described case.

BZ#1102803

After editing a command in vi visual mode, Bash echoed every substituted command, which produced a lengthy shell output when editing loops. This behavior has been changed and Bash now only echoes the original string in the described scenario.

Bug Fixes

BZ#1044545

Previously, the allow-notify configuration option did not take into account the Transaction SIGnature (TSIG) key for authentication. Consequently, this caused a slave server not to accept a NOTIFY message from a non-master server that used the TSIG key for authentication, even though the slave server was configured to accept NOTIFY messages when the specific TSIG key was used. The named source code has been fixed to also check the TSIG key ID when receiving a NOTIFY message from a non-master server, and the slave server now correctly accepts NOTIFY messages in this scenario.

BZ#1036700

Prior to this update, the Response Rate Limiting (RRL) functionality in BIND distributed in Red Hat Enterprise Linux 6 was missing the referrals-per-second and nodata-per-second options. As a consequence, users of BIND that was configured to use the RRL functionality could not explicitly filter empty responses for a valid domain and referrals or delegations to the server for a given domain. With this update, the missing functionality has been backported to BIND, and users can now explicitly filter empty responses for a valid domain and referrals or delegations to the server for a given domain when using the RRL functionality in BIND.

BZ#1008827

Previously, the host utility used the same send buffer for all outgoing queries. As a consequence, under high network load, a race condition occurred when the buffer was used by multiple queries, and the host utility terminated unexpectedly with a segmentation fault when sending of one query finished after another query had been sent. The host utility source code has been modified to use a separate send buffer for all outgoing queries, and the described problem no longer occurs.

BZ#993612

Prior to this update, a bug in the BIND resolver source code caused a race condition, which could lead to prematurely freeing a fetch memory object. As a consequence, BIND could terminate unexpectedly with a segmentation fault when it accessed already freed memory. The BIND resolver source code has been fixed to guarantee that the resolver fetch object is not freed until there is no outstanding reference to that object, and BIND no longer crashes in this scenario.

BZ#1023045

Previously, the manual page for the dig utility contained upstream-specific options for an Internationalized Domain Name (IDN) library. Consequently, these options did not function as expected and users were incapable of disabling IDN support in dig following the steps from the manual page. The dig(1) manual page has been modified to include the options of the IDN library used in Red Hat Enterprise Linux and users can now successfully disable IDN support in dig following the steps from the manual page.

BZ#919545

Prior to this update, due to a regression, the dig utility could access an already freed query when trying multiple origins during domain name resolution. Consequently, the dig utility sometimes terminated unexpectedly with a segmentation fault, especially when running on a host that had multiple search domains configured in the /etc/resolv.conf file. The dig source code has been modified to always use a query that is still valid when trying the next origin, and the dig utility no longer crashes in this scenario.

BZ#1066876

Prior to this update, the named source code was unable to correctly handle the Internet Control Message Protocol (ICMP) Destination unreachable (Protocol unreachable) responses. Consequently, an error message was logged by named upon receiving such an ICMP response but BIND did not add the address of the name server to a list of unreachable name servers. This bug has been fixed, and no errors are now logged when the ICMP Destination unreachable (Protocol unreachable) response is received.

BZ#902431

Previously, the /var/named/chroot/etc/localtime file was created during the installation of the bind-chroot package, but its SELinux context was not restored. Consequently, /var/named/chroot/etc/localtime had an incorrect SELinux context. With this update, the command to restore the SELinux context of /var/named/chroot/etc/localtime after creation has been added in the post transaction section of the SPEC file, and the correct SELinux context is preserved after installing bind-chroot.

BZ#917356

Previously, the /var/named/named.ca file was outdated and the IP addresses of certain root servers were not valid. Although the named service fetches the current IP addresses of all root servers during its startup, invalid IP addresses can reduce performance just after a restart. Now, /var/named/named.ca has been updated to include the current IP addresses of root servers.

BZ#997743

Prior to this update, the named init script checked the existence of the rndc.key file only during the server startup. Consequently, the init script generated rndc.key even if the user had a custom Remote Name Daemon Control (RNDC) configuration. This bug has been fixed, and the init script no longer generates rndc.key if the user has a custom RNDC configuration.

BZ#919414

Previously, when calling the sqlite commands, the zone2sqlite utility used a formatting option that did not add single quotes around the argument. As a consequence, zone2sqlite was unable to perform operations on tables whose name started with a digit or contained the period (.) or dash (–) characters. With this update, zone2sqlite has been fixed to use the correct formatting option and the described problem no longer occurs.

BZ#980632

Previously, the named init script did not check whether the PID written in the named.pid file was a PID of a running named server. After an unclean shutdown of the server, the PID written in named.pid could belong to an existing process while the named server was not running. Consequently, the init script could identify the server as running and therefore the user was unable to start the server. With this update, the init script has been enhanced to perform the necessary check, and if the PID written in named.pid is not a PID of the running named server, the init script deletes the named.pid file. The check is performed before starting, stopping, or reloading the server, and before checking its status. As a result, the user is able to start the server without problems in the described scenario.

BZ#1025008

Prior to this update, BIND was not configured with the --enable-filter-aaaa configuration option. As a consequence, the filter-aaaa-on-v4 option could not be used in the BIND configuration. The --enable-filter-aaaa option has been added, and users can now configure the filter-aaaa-on-v4 option in BIND.

BZ#851123

Prior to this update, the named init script command configtest did not check if BIND was already running, and mounted or unmounted the file system into a chroot environment. As a consequence, the named chroot file system was damaged by executing the configtest command while the named service was running in a chroot environment. This bug has been fixed, and using the init script configtest command no longer damages the file system if named is running in a chroot environment.

BZ#848033

Previously, due to a missing statement in the named init script, the init script could return an incorrect exit status when calling certain commands (namely, checkconfig, configtest, check, and test) if the named configuration included an error. Consequently, for example, when the service named configtest command was run, the init script returned a zero value meaning success, regardless of the errors in the configuration. With this update, the init script has been fixed to correctly return a non-zero value in case of an error in the named configuration.

BZ#1051283

Previously, ownership of some documentation files installed by the bind package was not correctly set. Consequently, the files were incorrectly owned by named instead of the root user. A patch has been applied, and the ownership of documentation files installed by the bind package has been corrected.

BZ#951255

Prior to this update, the /dev/random device, which is a source of random data, did not have a sufficient amount of entropy when booting a newly installed virtual machine (VM). Consequently, generating the /etc/rndc.key file took excessively long when the named service was started for the first time. The init script has been changed to use /dev/urandom instead of /dev/random as the source of random data, and the generation of /etc/rndc.key now consumes a more reasonable amount of time in this scenario.

BZ#1064045

Previously, the nsupdate utility was unable to correctly handle an extra argument after the -r option, which sets the number of User Datagram Protocol (UDP) retries. As a consequence, when an argument followed the -r option, nsupdate terminated unexpectedly with a segmentation fault. A patch has been applied, and nsupdate now handles the -r option with an argument as expected.

BZ#948743

Previously, when the named service was running in a chroot environment, the init script checked whether the server was already running after it had mounted the chroot file system. As a consequence, if some directories were empty in the chroot environment, they were mounted again when the service named start command was used. With this update, the init script has been fixed to check whether named is running before mounting file system into the chroot environment and no directories are mounted multiple times in this scenario.

BZ#846065

Previously, BIND was not configured with the --with-dlopen=yes option. As a consequence, external Dynamically Loadable Zones (DLZ) drivers could not be dynamically loaded. A patch has been applied, and external DLZ drivers are now dynamically loadable as expected.

Enhancements

BZ#1092035

Previously, the number of workers and client-objects was hard-coded in the Lightweight Resolver Daemon (lwresd) source, and it was insufficient. This update adds two new options: the lwres-tasks option, which can be used for modifying the number of workers created, and the lwres-clients option, which can be used for specifying the number of client objects created per worker. The options can be used inside the lwres statement in the named/lwresd configuration file.

BZ#956685

This update adds support for the TLSA resource record type in input zone files, as specified in RFC 6698. TLSA records together with Domain Name System Security Extensions (DNSSEC) are used for DNS-Based Authentication of Named Entities (DANE).

Bug Fixes

BZ#1128279

Previously, the ld linker could overwrite a valid SONAME with an empty string in a DT_NEEDED record. Consequently, certain programs were linked but could not be executed because symbols from some libraries were not loaded. With this update, the ld linker correctly handles empty strings in SONAMEs, and programs linked by ld now can be executed as expected.

BZ#906079

When creating a shared library for a "ppc64" target, the ld linker selected linker stubs that were not thread-safe by default. Consequently, if such a shared library was used by a multi-threaded application, calls into the library could fail in unpredictable ways. To fix this problem, the ld linker now build shared libraries for "ppc64" targets with thread-safe linker stubs.

BZ#909056

The readelf utility incorrectly assumed that a long name table would always be available if an archive used long names. Consequently, readelf could terminate unexpectedly with a segmentation fault on archive libraries that used long names but did not have a long name table. To fix this problem, readelf now verifies the existence of a long name table on archive libraries.

BZ#959422

The ld linker incorrectly handled certain TLS relocations that appears in debugging (DWARF) sections. Consequently, debugging information for some variables in TLS sections could be incorrect. With this update, the ld linker now correctly handles TLS relocations in DWARF sections, and the related TLS variables now can be properly examined.

Bug Fixes

BZ#1037680

Due to the way the Python programming language was packaged for Red Hat Enterprise Linux, the boost packages could not be provided for secondary architectures. For example, boost-devel.i686 was not available on the x86-64 architecture. The Python packaging has been updated, and it is now possible to install secondary-architecture versions of the boost packages.

BZ#1021004

A coding error in the shared_ptr pointer previously caused a memory leak when serializing and unserializing shared pointers. The shared_ptr code has been corrected and the memory leak now no longer occurs.

BZ#969183

Due to an error in threading configuration of GNU Compiler Collection (GCC) version 4.7 or later, Boost failed to detect the support for multithreading versions of GCC. This patch fixes the error and Boost now detects multithreading support in the described circumstances correctly.

BZ#1108268

Prior to this update, a number of boost libraries were not compatible with GCC provided with Red Hat Developer Toolset. A fix has been implemented to address this problem and the affected libraries now properly work with Red Hat Developer Toolset GCC.

BZ#801534

The mpi.so library was previously missing from the boost libraries. Consequently, using the Message Passing Interface (MPI) in combination with Python scripts failed. With this update, mpi.so is included in the boost packages and using MPI with Python works as expected.

Enhancement

BZ#1132455

The MPICH2 library has been replaced with a later version, MPICH 3.0. Note that Boost packaging has been updated accordingly and new packages are named boost-mpich* instead of boost-mpich2*.

Bug Fix

BZ#1071366

Smart Card readers have multiple modes, some of which have limitations on the size of commands that can be sent to the Smart Card. Previously, OmniKey 3121 supported the modes of operation that allowed longer commands, but not in the standard CCID way. As a consequence, the user received an unrecoverable error message when running a long command. This update recognizes OmniKey 3121 and enables the longer modes so that longer commands are successfully executed on the Smart Card.

Bug Fix

BZ#1125342

This update fixes the implementation of the remove_known_ca dbus call in the certmonger package to prevent the certmonger daemon from terminating unexpectedly when called by remove_known_ca.

Enhancement

BZ#1027265

This update adds the certmonger_selinux manual page to document the effect that SELinux has in limiting the allowed access to locations for the certmonger daemon. Also, the selinux.txt document has been added to the certmonger package to provide more details about interaction with SELinux. A reference to certmonger_selinux and selinux.txt has been added to other certmonger man pages.

Bug Fixes

BZ#843160

Previously, the fencing time comparison did not work as expected when fence agent completed too fast or the corosync callback was delayed. Consequently, the Distributed Lock Manager (DLM) became unresponsive when waiting for fencing to complete. With this update, different time stamps that are not effected by the sequence of fencing or corosync callbacks are now saved and compared, and DLM no longer hangs in the aforementioned situation.

BZ#1059269

Prior to this update, the "pcs stonith confirm <node>" command failed to acknowledge the STONITH fencing technique. As a consequence, any requests from other nodes in the cluster or from clients in the same node became ignored. A patch has been provided to fix this bug, and "pcs stonith confirm" now works as expected, fencing the specified node successfully.

BZ#1029210

Due to an error in the configuration, the qdisk daemon in some situations used an incorrect "tko" parameter for its wait period when initializing. Consequently, qdisk initialization could be significantly delayed and, under some circumstances, failed entirely. With this update, the cluster configuration file has been fixed, and qdisk initialization now proceeds as expected.

BZ#980575

Previously, the ccs_read_logging() function used the create_daemon_path() function to generate daemon-specific CCS paths for the attributes. As a consequence, attributes on individual logging_daemons were not applied correctly. This bug has been fixed, and attributes on individual logging_daemons are now applied correctly.

BZ#979313

Due to a code error in corosnync, after the corosync utility terminated unexpectedly with a segmentation fault, the qdiskd daemon evicted other cluster nodes. The underlying source code has been patched, and qdiskd no longer evicts the other nodes if corosync crashes.

BZ#1074551

Prior to this update, running the "ccs_tool -verbose" command caused ccs_tool to terminate unexpectedly with a segmentation fault. This bug has been fixed, and ccs_tool now returns an error message providing more information.

BZ#1059853

Due to an overly restrictive umask, running the "gfs2_grow" command changed the /etc/mtab file permissions from default 644 to 600. A patch has been provided to fix this bug, and gfs2_grow no longer resets /etc/mtab permissions.

BZ#1062742

Previously, fsck.gfs2 did not fix corrupt quota_change system files. As a consequence, attempts to mount the file system (FS) resulted in an error, even though fsck.gfs2 reported the FS to be clean. With this patch, if fsck.gfs2 finds a corrupted quota_change file, it can rebuild it. Now, GFS2 mounts successfully as intended.

BZ#1080174

Previous attempts to mount a GFS2 file system that had already been mounted prevented further mount attempts from other nodes from completing. With this update, mount.gfs2 no longer leaves the mount group when the file system is already mounted, and attempts to mount an already mounted GFS2 file system are handled properly.

BZ#1053668

Prior to this update, a GFS2 volume failed to mount after conversion from GFS to GFS2, and the gfs2_convert utility aborted with a segmentation fault. The gfs2-utils code has been patched to fix this bug, and the aforementioned conversions now proceed successfully.

Enhancement

BZ#1081517

To aid debugging and administration, fsck.gfs2 now logs a message to the system log when it starts and ends.

Bug Fix

BZ#1076716

Previously, the modcluster service mishandled requests with size in bytes divisible by 4096, which is the size of the read buffer in bytes. Consequently, modcluster incorrectly evaluated such requests as errors. This bug has been fixed, and modcluster now processes all requests as expected.

Bug Fixes

BZ#611250

Previously, the FindGTK2.cmake module was missing from the cmake packages. As a consequence, building GTK2 applications failed. This update adds FindGTK2.cmake and GTK2 applications now build as expected.

BZ#752864

Prior to this update, CMake ignored some options when working with the rpmbuild-4.8 package. As a consequence, building RPM packages on an RPM-based system failed. With this update, CMake works with rpmbuild-4.8 correctly, and the above problem no longer occurs.

BZ#896116

Due to an error in the "add_custom_target" command, CMake previously did not detect a custom target after creating it. With this update "add_custom_target" works properly, and CMake detects a created custom target as expected.

Bug Fix

BZ#1125987

A certain variable was previously uninitialized in the coolkey code. If that variable inherited a single "magic" value, coolkey could fail to present any certificates or keys that were stored in a smart card controlled by coolkey (a CAC, PIV, or coolkey card). Consequently, although the smart card was recognized, the certificates and keys were not visible to some applications. With this update, that variable is now initialized to a safe value and coolkey now presents its certificates and keys properly.

Bug Fixes

BZ#812449

Previously, the "df" command did not display target device information when a symbolic link was specified as a parameter. Consequently, the information about the file was shown instead of the information about the device. This update applies a patch to fix this bug and the "df" command works as expected in the described scenario.

BZ#1016163

When no user was specified, the "id -G" and "groups" commands printed the default group ID listed in the password database. Consequently, the IDs were in certain cases ineffective or incorrect. With this update, the commands have been enhanced to print only proper IDs, thus showing correct information about the groups.

BZ#1046818

A previous update of the coreutils packages fixed the tail utility to handle symbolic links correctly. However, due to this update, tail returned unnecessary warnings about reverting to polling. This update provides a patch to fix this bug and the warning is only shown when necessary.

BZ#1057026

A recent update of the coreutils packages changed the format of the output from the "df" and "df -k" commands to one line per entry, which is required for POSIX mode. As a consequence, scripts relying on the previous two lines per entry format started to fail. To fix this bug, two-line entries have been reintroduced to the output for modes other than POSIX. As a result, scripts relying on the two-line format no longer fail.

BZ#1063887

A recent update of the coreutils packages caused a regression in the signal handling in the su utility. As a consequence, when the SIGTERM signal was received, a parent process was killed instead of the su process. With this update, handling of the SIGTERM signal has been fixed and su no longer kills the parent process upon receiving the termination signal.

BZ#1064621

The chcon(1) manual page did not describe the default behavior when dereferencing symbolic links; the "--dereference" option was not documented. This update adds the appropriate information to the manual page.

BZ#1075679

Certain file systems, for example XFS, have special features such as speculative preallocation of memory holes. These features could cause a failure of the "dd" command test in the upstream test suite. As a consequence, the coreutils package source rpm could not be rebuilt on XFS file systems. To address this bug, the test has been improved to prevent the failures in the described scenario.

BZ#1104244

The "tail --follow" command uses the inotify API to follow the changes in a file. However, inotify does not work on remote file systems and the tail utility is supposed to fall back to polling for files on such file systems. Previously, the Veritas file system was missing from the remote file system list and therefore, "tail --follow" did not display the updates to the file on this file system. The Veritas file system has been added to the remote file system list and the problem no longer occurs.

Enhancement

BZ#1098078

This update enhances the "dd" command to support the count_bytes input flag. When the flag is specified, the count is treated as numbers of bytes rather than blocks. This feature is useful for example when copying virtual disk images.

Bug Fixes

BZ#1067043

If the cpg clients on active cluster nodes terminated while corosync on one of the nodes was paused, corosync did not update its internal information about cpg clients on other nodes properly after resuming. Consequently, that node considered the terminated cgp clients to be still up and running. This update modifies the cpg code to ensure that corosync properly updates information about the cpg membership in this situation.

BZ#1011307

Previously, corosync terminated unexpectedly with a segmentation fault when started on a system with the /dev/shm device full. This happened because the corosync logging system, logsys, could not be properly initialized. This update improves handling of the logsys initialization, and corosync now displays an appropriate error message and exits gracefully if logsys cannot be initialized.

BZ#1025321

Due to a list corruption bug in the Corosync Closed Process Group (CPG) API, corosync could terminate unexpectedly with a segmentation fault under some circumstances. To fix this problem, corosync has been modified to handle the CPG init and list removal functions in the same thread.

BZ#1005179

Previously, corosync could abort without logging an error properly if it was unable to store a file to the user's file system. With this update, corosync now properly verifies whether a "blackbox" can be stored on the file system. A failure of a ring ID store operation is no longer handled by assert but corosync now tries to log an error and then exits gracefully.

BZ#1001210

Previously, when using the InfiniBand Architecture (IBA) as a transport protocol for corosync, corosync could not properly handle the restart of the IBA subnet manager (SM). If the IBA SM was restarted, corosync was not able to start or became unresponsive if it was already running. A series of patches addressing this problem has been applied to corosync, and it now works properly as expected in this scenario.

Bug Fix

BZ#1056310, BZ#1109187

Prior to this update, the turbostat utility did not correctly access the energy status register on certain Intel Core processors. As a consequence, turbostat displayed the following error message:

/dev/cpu/0/msr offset 0x641 read failed

With this update, turbostat has been fixed to correctly access the proper energy status registers. As a result, turbostat now returns the expected data in the described scenario.

Enhancement

BZ#1093513

This update adds support for the Intel Broadwell Microarchitecture to the turbostat utility.

Bug Fix

BZ#895899

Previously, crash-trace-command displayed incorrect "Packager" and "Vendor" information. With this update, crash-trace-command prints "Red Hat, Inc." in these fields as expected.

Bug Fixes

BZ#1035588

Previously, the createrepo utility did not test file locking correctly. As a consequence, createrepo terminated unexpectedly with a traceback when it was executed in a directory located on a Common Internet File System (CIFS) share provided by a NetApp storage appliance. The test for file locking has been corrected and createrepo now works as expected in the described situation.

BZ#1083185

Prior to this update, if the createrepo utility was executed with the "-i" or "--pkglist" options and the specified file name did not exist, createrepo terminated unexpectedly with a traceback. The createrepo utility has been modified to handle this error condition properly, and it now exits gracefully in this situation.

BZ#1088886

Prior to this update, the createrepo packages had descriptions which did not indicate that the maintenance utilities were present in the package. This update corrects this omission.

Enhancements

BZ#952602

This update introduces support for the following new options to the modifyrepo utility: "--checksum", used to specify the checksum type; "--unique-md-filenames", used to include the file's checksum in the file name; and "--simple-md-filenames", used to not include the file's checksum in the file name. The "--unique-md-filenames" option is a default option for this utility.

BZ#1093713

Previously, certain options were not described in the modifyrepo(1) and mergerepo(1) man pages. These man pages now document the following modifyrepo utility command line options: "--mdtype", "--remove", "--compress", "--no-compress", "--compress-type", "--checksum", "--unique-md-filenames", "--simple-md-filenames", "--version", and "--help". These man pages also now document the following mergerepo utility command line options: "--no-database", "--compress-type", "--version", and "--help".

Enhancement

BZ#1009707

FIPS products are now defined by the presence of the dracut-fips package in the system. During the initialization of a library, a cryptographic module is supposed to determine if the library is a FIPS product to reduce the amount of required integrity tests. For this purpose, a new constructor function has been added to the cryptsetup-libs library. The constructor detects if the /etc/system-fips file, which is a part of dracut-fips, exists in the system, and determines if a FIPS integrity test is needed.

Bug Fixes

BZ#987099

Prior to this update, CTDB sometimes waited too long for file locks to establish. Consequently, clients accessing a CTDB file-server cluster could time out due to high latency. With this update, the underlying code has been fixed to address the problem, and clients can now access files on a CTDB file-server cluster without timeouts.

BZ#1075913

Previously, when CTDB was configured to use two bonded interfaces, CTDB failed to assign an IP address to the second bonded interface. As a consequence, the cluster status of the cluster node was shown as "PARTIALLYONLINE" even when the actual status was "OK". The script which handles the network interfaces has been fixed and the cluster status now shows the correct value.

BZ#1085413

Prior to this update, CTDB under some circumstances attempted to free allocated memory at an invalid address which caused CTDB to terminate unexpectedly with a segmentation fault. This update fixes the underlying code and CTDB uses the correct address for freeing allocated memory. As a result, the crash no longer occurs.

Security Fixes

CVE-2014-2856

A cross-site scripting (XSS) flaw was found in the CUPS web interface. An attacker could use this flaw to perform a cross-site scripting attack against users of the CUPS web interface.

CVE-2014-3537CVE-2014-5029CVE-2014-5030CVE-2014-5031

It was discovered that CUPS allowed certain users to create symbolic links in certain directories under /var/cache/cups/. A local user with the lp group privileges could use this flaw to read the contents of arbitrary files on the system or, potentially, escalate their privileges on the system.

Bug Fixes

BZ#769292

When the system was suspended during polling a configured BrowsePoll server, resuming the system left the cups-polld process awaiting a response even though the connection had been dropped causing discovered printers to disappear. Now, an HTTP timeout is used so the request can be retried. As a result, printers that use BrowsePoll now remain available in the described scenario.

BZ#852846

A problem with HTTP multipart handling in the CUPS scheduler caused some browsers to not work correctly when attempting to add a printer using the web interface. This has been fixed by applying a patch from a later version, and all browsers now work as expected when adding printers.

BZ#855431

When a discovered remote queue was determined to no longer be available, the local queue was deleted. A logic error in the CUPS scheduler caused problems in this situation when there was a job queued for such a destination. This bug has been fixed so that jobs are not started for removed queues.

BZ#884851

CUPS maintains a cache of frequently used string values. Previously, when a returned string value was modified, the cache lost its consistency, which led to increased memory usage. Instances where this happened have been corrected to treat the returned values as read-only.

BZ#971079

A missing check has been added, preventing the scheduler from terminating when logging a message about not being able to determine a job's file type.

BZ#978387

A fix for incorrect handling of collection attributes in the Internet Printing Protocol (IPP) version 2.0 replies has been applied.

BZ#984883

The CUPS scheduler did not use the fsync() function when modifying its state files, such as printers.conf, which could lead to truncated CUPS configuration files in the event of power loss. A new cupsd.conf directive, SyncOnClose, has been added to enable the use of fsync() on such files. The directive is enabled by default.

BZ#986495

The default environment variables for jobs were set before the CUPS configuration file was read, leading to the SetEnv directive in the cupsd.conf file having no effect. The variables are now set after reading the configuration, and SetEnv works correctly.

BZ#988598

Older versions of the RPM Package Manager (RPM) were unable to build the cups packages due to a newer syntax being used in the spec file. More portable syntax is now used, allowing older versions to build CUPS as expected.

BZ#1011076

A spelling typo in one of the example options for the cupsctl command has been fixed in the cupsctl(8) man page.

BZ#1012482

The cron script shipped with CUPS had incorrect permissions, allowing world-readability on the script. This file is now given permissions “0700”, removing group- and world-readability permissions.

BZ#1040293

The Generic Security Services (GSS) credentials were cached under certain circumstances. This behavior is incorrect because sending the cached copy could result in a denial due to an apparent “replay” attack. A patch has been applied to prevent replaying the GSS credentials.

BZ#1104483

A logic error in the code handling the web interface made it not possible to change the Make and Model field for a queue in the web interface. A patch has been applied to fix this bug and the field can now be changed as expected.

BZ#1110045

The CUPS scheduler did not check whether the client connection had data available to read before reading. This behavior led to a 10 second timeout in some instances. The scheduler now checks for data availability before reading, avoiding the timeout.

BZ#1120419

The Common Gateway Interface (CGI) scripts were not executed correctly by the CUPS scheduler, causing requests to such scripts to fail. Parameter handling for the CGI scripts has been fixed by applying a patch and the scripts can now be executed properly.

Bug Fixes

BZ#838628

A memory leak in the Digest MD5 plugin was discovered. Specifically, the make_client_response() function did not correctly free the output buffer. Consequently, applications that used Digest MD5 with very large datasets could terminate unexpectedly. This update corrects make_client_response() and closes the memory leak. As a result, applications using Digest MD5 as part of authentication with large datasets now work as expected.

BZ#1081445

Previously, unnecessary quote characters were used in the cyrus-sasl.spec file when the user was created using the useradd command. Consequently, the Saslauth user was created with quotes in the comment field ("Saslauthd user"). With this update, unnecessary quotes have been removed from the comment field.

Enhancement

BZ#994242

The ad_compat option has been backported to the cyrus-sasl packages from upstream. This option controls compatibility with AD or similar servers that require both integrity and confidentiality bits selected during security layer negotiation.

Bug Fixes

BZ#1009061

When running a command on a specific device, the multipath utility did not accept device specification using the major:minor format. This bug has been fixed, and a multipath device can now be associated with the multipath command using a path device major:minor specification.

BZ#1027061

Previously, the readsector0 checker did not consider the blocksize when calculating the number of blocks to read, which led to readsector0 reading too much on 512 byte devices causing device errors. With this update, readsector0 considers the device blocksize when calculating the amount to read, and 512 byte devices now work with the readsector0 checker as intended.

BZ#1049637

Prior to this update, the code that handles multipathd sysfs devices could free a device structure while other data still pointed to it. As a consequence, the multipathd daemon could occasionally experience use-after-free memory corruption leading to unexpected termination. The sysfs device handling code for multipathd has been rewritten, and multipathd no longer frees sysfs device memory while it is still in use.

BZ#1078485

Some of multipathds prioritizers run scsi commands with long timeouts. These prioritizers do not run asynchronously and multipathd becomes busy waiting for one to timeout. Consequently, the multipathd daemon can become unresponsive for as long as 5 minutes when a path fails. With this update, the prioritizers use the "checker_timeout" option to configure their timeout. Now, prioritizer timeouts can be adjusted using the checker_timeout option to prevent multipathd hangs.

BZ#1080052

When a multipath device was reloaded outside the multipathd daemon and existing paths were removed from the device, mutipathd still treated them as belonging to a multipath device. Consequently, multipathd tried to access a non-existent path_group and terminated unexpectedly. With this update, multipathd correctly disassociates removed paths and no longer crashes when existing paths are removed by external programs.

BZ#1086417

If the multipathd daemon failed to add a path to the multipath device table, the path was incorrectly orphaned. As a consequence, the multipath utility treated the path as belonging to a multipath device, and multipathd could keep attempting to switch to a non-existent path_group. The underlying source code has been fixed, and multipathd now correctly orphans paths that cannot be added to the multipath device table.

Enhancements

BZ#1054747

This update adds the force_sync multipath.conf option. Setting force_sync to "yes" keeps the multipathd daemon from calling the path checkers in asynchronous mode, which forces multipathd to run only one checker at a time. In addition, with this option set, multipathd no longer takes up a significant amount of CPU when a large number of paths is present.

BZ#1088013

Previously, the default path ordering often led to the Round Robin path selector picking multiple paths to the same controller, reducing the performance benefit from multiple paths. With this update, multipath reorders device paths in order to alternate between device controllers, leading to a performance improvement.

BZ#1099932

This update adds iscsi support for the "fast_io_fail_tmo" option to allow the user to modify the speed of multipath responding to failed iscsi devices.

BZ#1101101

With this update, "-w" and "-W" options have been added to multipath; the "-w" option removes the named WWID from the wwids file, the "-W" option removes all WWIDs from the wwids file except for the WWIDs of the current multipath devices.

Bug Fix

BZ#1035990

The thin_dump utility as well as other persistent-data tools supported only 512 B block sizes on accessed devices. Consequently, persistent-data tools could perform I/O to misaligned buffers. The underlying source code has been updated to support 4 KB block size, thus fixing this bug.

Bug Fixes

BZ#1015997

When a packet with checksum having the value of 0xffff was received by the dhcpd daemon, the packet was discarded. With this update, checksum with value 0xffff is perceived as correct, and the packet is now processed as intended.

BZ#1053155

Previously, the user could not run IPv6 version of the dhcrelay service, because there was no such initiation script. To fix this bug, the initiation script of dhcrelay has been added, and the user can now run service for IPv6 version of dhcrelay.

BZ#1053431

When IPv6 version of the dhcpd daemon served too many requests, the /var/lib/dhcpd/dhcpd.leases file grew uncontrollably in size. As a consequence, dhcpd refused to restart with the following error message:

file is too long to buffer

An upstream patch has been backported to fix this bug, and dhcpd for IPv6 now rotates /var/lib/dhcpd/dhcpd.leases to prevent it from growing.

BZ#1064416

When using ISC DHCP server and clients on Infiniband cards (IPoIB), the hardware address, called GUID, did not appear in logs. This update adds GUIDs to the logs for IPoIB.

BZ#1067142

Every time the dhcpd daemon started, the ownership of the /var/lib/dhcpd/dhcpd.leases file was changed from dhcpd:dhcpd to root:root. A Fedora patch has been backported to fix this bug, and the ownership of /var/lib/dhcpd/dhcpd.leases no longer changes.

BZ#1099698

When having failover configuration of the dhcpd daemon and using very long lease times for clients, the following error was returned when starting dhcpd:

unable to write lease

A patch has been applied to fix this bug, and error messages no longer appear in logs.

BZ#1102662

Previously, when starting the dhcpd daemon or the dhcrelay agent, the user specified the name of the network interface. If longer than 15 characters, dhcpd or dhcrelay terminated unexpectedly with the following error message:

*** buffer overflow detected ***

A patch has been backported to fix this bug, and dhcpd or dhcrelay now exit gracefully with a new error message informing the user that the interface name is too long.

Bug Fix

BZ#991473

Previously, the Dnsmasq service status verification in the init script was not sufficiently robust and only determined the presence of all the instances of Dnsmasq running on the system. As a consequence, the init script identified Dnsmasq as running even when no Dnsmasq system instance had been initiated. The init script has been fixed to explicitly verify the process with the process ID written in the PID file of the system instance. As a result, the status of the Dnsmasq system instance is now identified correctly even if there are running instances not started by the init script.

Bug Fixes

BZ#1022766

The Anaconda "fcoe=edd:<dcb_setting>" option was introduced to allow systems in multi-path configuration to boot from the Storage Area Network (SAN). Previously, the option worked correctly only with the systems that used Enhanced Disk Drive Services (EDD) BIOS. Consequently, systems that did not use EDD, such as UEFI-based systems, could fail to boot from SAN. With this update, the option has been enhanced to work correctly with all systems.

BZ#1026302

In FIPS mode, the self checking of binaries is only done if the /etc/system-fips file is present. The dracut utility did not copy /etc/system-fips and certain checksum files in the initial ram file system (initramfs). As a consequence, the self check of the binaries, which was needed to decrypt a partition, was not done so that the partition could not been unlocked. Now, dracut copies all the needed files in the initramfs, and systems with encrypted disks can now boot successfully in FIPS mode.

BZ#1033784

The dracut(8) manual page did not describe certain new features. With this update, the missing information has been added to the manual page.

BZ#1041484

The nvme driver was missing from the initrd images. Consequently, when Red Hat Enterprise Linux was installed on a non-volatile memory express (NVMe) storage, the post-installation reboot failed. This update adds the missing driver and Red Hat Enterprise Linux can be installed on NVMe storages as expected.

BZ#1051448

Only the plymouth module was responsible for creating the initramfs /emergency/ directory. When the module was omitted during the installation, /emergency/ was not created. This behavior caused errors to be returned because other modules required /emergency/ too. With this update, /emergency/ is created regardless of loaded modules.

BZ#1070676

The /dev/btrfs-control device node is only created, after the btrfs kernel module is loaded. Previously, utilities that attempted to access the node prior to the module was loaded terminated unexpectedly. Now, the dracut initramfs environment statically creates the device node. As a result, when a utility tries to access the node, the kernel loads btrfs automatically so that the utility no longer fails in the described scenario.

BZ#1099603

The iscsistart utility, which is used for adding iSCSI disks, could be executed only when network interfaces had been brought up successfully. When the interfaces had not been correctly specified on the kernel command line, it was not possible to run the utility and boot the system from iSCSI disks. Now, when iSCSI disks are requested on the kernel command line, the dracut initramfs environment runs iscsistart even if no network interface is properly specified, thus allowing the system to boot from iSCSI disks.

BZ#1126346

With the iSCSI server not being available, the iscsistart utility took a very long time to connect to it, which slowed the boot process. With this update, iscsistart is now launched in the background, thus connecting to the iSCSI server as soon as it is available. As a result, booting no longer takes enormous amount of time.

Enhancement

BZ#737687

This update enables the server to boot from a secondary device in case the primary device fails. The new "rootfallback=<secondary_device>" parameter has been added to the dracut parameters. This parameter is used when the primary device specified with the "root=<primary_device>" parameter cannot be found.

Bug Fixes

BZ#1036122

The resize2fs utility sometimes caused file system corruption during an offline resize of an ext4 file system. This happened because resize2fs did not reserve all existing metadata blocks prior to executing the resize operation. This update fixes resize2fs to reserve all existing metadata blocks as expected in this situation.

BZ#1040122

The tune2fs man page states that the "-f" option can be used to remove a file system journal even if the journal requires replay. However, earlier versions of tune2fs did not behave as documented. This update allows tune2fs to remove a dirty journal by supplying two "-f" options on the command line.

BZ#1093446

With previous versions of mke2fs, it was possible to specify an unsupported and unmountable file system revision on the command line by using the "-r" option. The mke2fs utility now refuses to create a file system with a revision higher than is currently supported.

BZ#1097061

Previously, the e2image program could run against a mounted block device, resulting in an inconsistent metadata image. With this update, the e2image program now displays a warning message if the block device is mounted, and requires the "-f" option to proceed in this case.

BZ#1112242

With previous versions of e2fsck, "zeroed-out" directory blocks were not reported or repaired. The e2fsck utility now detects and repairs this type of corruption.

Enhancement

BZ#1052409

The enable_periodic_fsck option has been added to /etc/mke2fs.conf to enable or disable periodic e2fsck operations when creating new file systems with the mke2fs utility. A periodic file system check is enabled by default.

Bug Fix

BZ#679812

Previously, the exit status of the edac-utils package init script was not set correctly. As a consequence, running the 'service edac status' command returned exit status 0, which was not expected behavior because no programs were running after executing the 'service edac start' command. With this update, the returned exit status has been changed to 3 in the described situation.

Bug Fix

BZ#1121782

Previously, during their boot process, some newer machines created variables larger than 1024 bytes, which the kernel API for Unified Extensible Firmware Interface (UEFI) does not support. Consequently, the efibootmgr utility received an error trying to read such variables, and skipped them, which caused anaconda to fail to create boot variables. This update changes efibootmgr to show the variables but not to display their contents. As a result, anaconda is able to read the large variables, and creates boot variables successfully.

Bug Fixes

BZ#755728, BZ#1059897

This update introduces an eu-stack tool that retrieves the backtrace of a process or a core file. * The elfutils libdwfl() functions have been extended to provide support for associating a process state to a Dwfl object. A state can be attached to a process or a core file using the new dwfl_core_file_attach() and dwfl_linux_proc_attach() functions. When a state is attached to a Dwfl object, a new function, dwfl_getthreads(), can be used to iterate over the running threads. It is possible for each thread to unwind and inspect the frames on the call stack using the new dwfl_getthread_frames() function. * The libraries and utilities provide various improvements to recognize DWARF version 4, DWARF GNU tool chain extensions (typed DWARF stack, call_site, entry_value, DW_AT_high_pc, DW_OP_GNU_parameter_ref, and experimental support for DWZ multifiles), and new functions to handle DWARF location expressions. * The eu-readelf utility now supports the "/SYM64/" special entry to read 64-bit ar archive files used on IBM System z architecture.

BZ#1101440

Prior to this update, the eu-readelf utility was unable to read a corrupted ELF file with a missing string table. As a consequence, eu-readelf terminated unexpectedly with a segmentation fault. With this update, eu-readelf has been fixed to skip the data sections with a non-existent string table and read only valid data. As a result, eu-readelf no longer crashes in this scenario.

BZ#806474

Previously, due to bugs in certain tool chain utilities, the main ELF file and the separate debuginfo file had different header types or flags. As a consequence, the eu-unstrip utility was unable to combine the ELF file and the separate debuginfo file. The same problem occurred when the main ELF file was prelinked after the debug information was separated into a debuginfo file. With this update, eu-unstrip displays a warning message similar to "ELF header identification (e_ident) different" and shows which header field does not match if the stripped and unstripped files cannot be combined. Also, the "--force" option has been added so that the user can ignore the warning and combine such files anyway. Additionally, eu-unstrip prints a warning message if the DWARF data need adjusting for prelinking bias. As a result, eu-unstrip now prints appropriate warning messages and the mismatching main ELF and separate debuginfo files can be recombined into one using the "--force" option.

Bug Fixes

BZ#1003891

Previously, the ethtool utility did not support the Backplane link type. As a consequence, ethtool did not return "supported link modes" and "advertised link modes" on be2net-based devices. With this update, the support for Backplane has been added, and ethtool now returns "supported link modes" and "advertised link modes" as expected.

BZ#1010843

Previously, the ethtool utility did not correctly communicate with the network device driver when attempting to set Large Receive Offload (LRO) options. Consequently, it was not possible to set the LRO options on devices supporting LRO. With this update, ethtool has been fixed to communicate correctly with the network device driver, and the LRO options can now be set on network devices.

BZ#1018367

Due to a change to the ixgbe driver, the "ethtool -d" command in non-raw mode stopped providing output. As a consequence, "ethtool -d" could not be used to examine the state of ixgbe devices. To fix this bug, ethool has been changed to work with the new ixgbe device driver, and the "ethtool -d" command in non-raw mode can now be used again on the ixgbe devices.

Enhancement

BZ#1105589

With this update, the ethtool utility supports the Medium Dependent Interface Crossover (MDI-X) mode setting on the e1000, e1000e, and igb drivers.

Bug Fixes

BZ#1052955

Previously, the option to choose the time format in the Evolution application was not offered for certain languages. As a consequence, the calendar component editor always showed time in the 24-hour format. With this update, the correct time format is displayed based on the selection the user makes in the Edit menu: Preferences, Calendar and Tasks.

BZ#1054772

Prior to this update, newly created local address books were not set correctly. Consequently, address books in the Evolution application could not be deleted, and incorrect data was displayed. With this update, address books can be removed, contacts in separated address books remain visible only in the appropriate address books, and the add, edit, and remove operations no longer cause any inconsistency.

BZ#1054865

Previously, the Evolution application did not always handle adding new attachments correctly. As a consequence, attaching a large file caused the Evolution application to terminate unexpectedly under certain circumstances. A patch has been applied to address this bug, and adding new attachments no longer causes Evolution to crash.

BZ#1070846

Previously, the Evolution application displayed only a general prompt for the Smart Card PIN. As a consequence, the user could be uncertain what PIN to enter. This update improves the prompt, and the user now knows what certificate the requested PIN belongs to.

BZ#1080467

Prior to this update, the Evolution application did not correctly handle calling the "Mark All As Read" function. Consequently, Evolution could become unresponsive until the operation was completely finished. A patch has been provided to fix this problem, and Evolution no longer hangs in the described situation.

BZ#1139166

Previously, an error could occur when displaying a new email notification. As a consequence, the Evolution application did not work correctly under certain circumstances. With this update, the bug has been fixed and email notifications are correctly displayed.

Bug Fix

BZ#1040178

Due to incorrect locking of table access, Evolution previously became unresponsive on startup. This update fixes locking of table access, and Evolution now starts up as intended.

Enhancement

BZ#1042996

With this update, support for TLS version 1.2 for mail accounts has been added to Evolution.

Bug Fixes

BZ#641632, BZ#642232, BZ#841556, BZ#1114528

Previously, timeout options could not be entered to the fence_brocade agent. In addition, issued commands were not persistent, which could lead to problems if fencing hardware was rebooted. Also, when invalid password was entered, the fence agent was terminated as a stale process without any error message being reported to the user. This update provides a new implementation of fence agents that solves the aforementioned bugs.

BZ#990537

Previously, users of the fence_ilo agent were not able to enter password that contained the quotation mark character ("). This update allows users to enter any character in the password as expected.

BZ#1018263

If the user name to log in to the fence_vmware_soap device does not have the correct privileges set, a python exception is thrown. Prior to this update, the fence_vmware_soap agent terminated the exception when the user did not have privileges for required operations. With this update, the user is informed by an error message that these privileges are not sufficient.

BZ#1048842

Previously, fence agents could use key-based authentication over SSH even if the user wanted to use password authentication. As a consequence, the user was unable to log in. This update ensures that proper authentication is used, and the user can now log in using password authentication.

BZ#1050022

Previously, using the fence_scsi_check.pl watchdog script failed to induce soft or clean reboot. But when Global File System 2 (GFS2) or other file systems were used, unmounting file systems could be blocked. This update provides a new fence_scsi_check_reboot.pl script, which ensures hard reboot, and problems with unmounting no longer occur.

BZ#1051159

Prior to this update, the fence_vmware_soap fencing agent did not support the "--delay" option, which is indispensable for avoiding fence races. This update adds the "--delay" option, which delays start of fence agents for a given amount of seconds, and thus prevents fence races from occurring.

BZ#1069618

Previously, the fence_apc utility was hard-coded with SSH1 connectivity. As a consequence, fence_apc was unable to connect to power distribution units that required SSH2 connectivity. This update introduces the "--ssh-options" option, which makes it possible to specify SSH connectivity options in fence_apc. Thus, all fencing agents that support SSH can now be adjusted to meet the SSH requirements of the fencing device.

BZ#1110428

Previously, the fence_rsb agent was unable to work with certain versions of firmware. As a consequence, fence_rsb failed after an outlet powered off. However, fence_rsb kept on issuing the command to power the outlet back on. With this update, new firmware versions are supported, and fence_rsb succeeds in turning off and on the outlet.

BZ#1075683

Prior to this update, fence agents that connected using the SSH protocol failed on login if an identity file was used as the method of authentication. The bug has been fixed, and these fence agents now successfully authenticate through an identity file.

Bug Fixes

BZ#1014238

Previously, the manual page for the fence_virt.conf file did not describe the relationship between socket path for fence_virtd and virtual machine serial socket path. This could cause confusions or misunderstandings. With this update, the description of "path" in the manual page has been extended to explain the aforementioned difference.

BZ#1104740

Prior to this update, the fence-virt agent could not fence inactive virtual machines. As a consequence, the cluster became unresponsive because the fence_virtd daemon was unable to find the running domain. The underlying source code has been patched, and fence-virt now fences both active and inactive virtual machines.

Enhancements

BZ#914144

With this update, the libvirt backend of the fence_virt daemon has been extended to support multiple KVM hypervisors.

BZ#1054225

With this update, fence-virt fencing using KVM serial ports instead of network multicast is supported for production use.

Security Fixes

CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file.

CVE-2014-1943, CVE-2014-2270

Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU.

Bug Fixes

BZ#664513

Previously, the output of the "file" command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces.

BZ#849621

Due to a bug, the "file" command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected.

BZ#873997

Previously, the "file" command could not recognize .JPG files and incorrectly labeled them as "Minix filesystem". This bug has been fixed and the command now properly detects .JPG files.

BZ#884396

Under certain circumstances, the "file" command incorrectly detected NETpbm files as "x86 boot sector". This update applies a patch to fix this bug and the command now detects NETpbm files as expected.

BZ#980941

Previously, the "file" command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files.

BZ#1037279

On 32-bit PowerPC systems, the "from" field was missing from the output of the "file" command. The underlying source code has been modified to fix this bug and "file" output now contains the "from" field as expected.

BZ#1064463

The "file" command incorrectly detected text files as "RRDTool DB version ool - Round Robin Database Tool". This update applies a patch to fix this bug and the command now correctly detects text files.

BZ#1067771

Previously, the "file" command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a "qcow2 compat=1.1" file created on Red Hat Enterprise Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected.

Bug Fix

BZ#718338

Previously, the file-roller application did not correctly handle file names with spaces. As a consequence, an error could occur when adding files to an archive because names with spaces were not properly recognized by file-roller, for example when using the 'Compress' menu item in the Nautilus file manager. With this update, file-roller uses the correct API to handle file names. As a result, archives are created as expected and errors no longer occur in the described situation.

Bug Fix

BZ#816328

When the "compat" method is specified in the nsswitch.conf file, special entries containing the "+" or "-" characters are allowed to be used in the /etc/passwd file. Previously, when the finger utility was run with a "username" argument on a host that had the special entries in /etc/passwd, finger terminated with a segmentation fault. With this update, the code that handles the "username" argument has been fixed to perform the necessary checks and the finger utility no longer crashes in the described scenario.

Bug Fix

BZ#570661

Previously, the flex static libraries for 32-bit and 64-bit architectures were included in the same package. Consequently, an attempt to compile an i386 code on an x86_64 system failed unless the 64-bit version of the flex utility had been removed. With this update, the libraries have been moved to separate packages, and flex works as expected in the described scenario.

Bug Fixes

BZ#1035416

Previously, when the font cache file was stored on a Network File System (NFS), the fontconfig library sometimes did not handle mmap() calls correctly. As a consequence, applications using fontconfig, for example the GNOME terminal, could terminate unexpectedly with a bus error. With this update, the FONTCONFIG_USE_MMAP environment variable has been added to handle the mmap() calls regardless of the file system, and these calls are no longer used if the cache file is stored on an NFS. As a result, the bus errors no longer occur in the described situation.

BZ#1099546

Previously, the 25-no-bitmap-fedora.conf file name contained the word 'fedora', although file names in Red Hat Enterprise Linux are not supposed to include the word 'Fedora'. With this update, 25-no-bitmap-fedora.conf has been renamed to 25-no-bitmap-dist.conf, and the spec file has been updated.

Enhancement

BZ#1107843

Under certain conditions, the proxy server needs the ability to time out to the home server in less than a second. With this update, three new features addressing this requirement have been added:

The home server's "response_window" configuration option now accepts fractional values with down to microsecond precision and the minimum of one millisecond.

The "response_window" configuration option with the same precision is now also supported in client sections to enable lowering of the home server's response window for specific clients.

The "response_timeouts" configuration option is now supported in home server sections, allowing to specify the number of times when a request is permitted to miss the response window before the home server enters the defunct state.

Bug Fixes

BZ#858351

Previously, the GNU Compiler Collection (GCC) did not handle compiling partial specialization invalid C++ code correctly. As a consequence, GCC could terminate unexpectedly with a segmentation fault. The bug has been fixed and GCC now provides a translation-time error instead of crashing.

BZ#875472

Previously, the GNU Compiler Collection (GCC) did not handle loop vectorization correctly. Consequently, GCC could terminate with a segmentation fault. With this update, GCC correctly ignores the debug statements when the vectorizer is looking for a loop-exit PHI node, and GCC now compiles the code as expected.

BZ#1008798

Previously, after compiling the source code of a program using the "-fprofile-arcs" and "-ftest-coverage" command-line options, the program was run and the gcov utility was started, but after that, a new source code file was created and gcov was started again. As a consequence, gcov damaged the existing .gcda files. After this update, functions are properly restored if a failure occurs, and gcov no longer damages other files.

BZ#1027003

Previously, if an invalid code in gnu++11 mode used an initializer list with an invalid value in its constructor, the g++ compiler terminated with a segmentation fault. With this update, the constructor is better tested for incorrect values, and g++ no longer crashes in the described scenario.

BZ#1061435

Previously, the Clang compiler did not handle certain headers correctly. As a consequence, a program using the typeinfo and exception headers failed to compile, and an "incomplete type" error message was displayed. With this update, the exception header in the libstdc++ library has been adjusted, and programs now compile as expected with the Clang compiler.

BZ#1085442

Previously, the standard uncaught_exception() function returned the "True" value even when the initialization of the exception object was not complete. As a consequence, the GNU Compiler Collection (GCC) could generate wrong code. With this update, uncaught_exception() returns the "True" value only after the exception object is created, and GCC always generates correct code as expected.

BZ#1087806

Prior to this update, the g++ compiler rejected code that tried to pass a type with a non-trivial copy constructor through variable arguments. As a consequence, programs compiled with the GNU Compiler Collection (GCC) terminated unexpectedly with an "Illegal instruction" error message. With this update g++ now accepts the code because it treats passing variadic arguments of non-trivial types as a pass-by-invisible reference.

BZ#1113793

Previously, the gfortran compiler did not correctly handle compiling code that involved invalid old-style initialization for derived type components. As a consequence, gfortran could terminate unexpectedly with a segmentation fault. A patch has been applied to address this bug, and the code is now properly rejected when needed, and an appropriate error message is displayed.

BZ#1113878

Larger aggregate contains the same fields as the smaller one with just some fields added at the end. Prior to this update, optimizing code that contained conversion from a larger aggregate to a smaller aggregate could cause the GNU Compiler Collection (GCC) to generate incorrect code. Consequently, using GCC with turned on optimizations failed and a segmentation fault occurred. With this update, conversions between aggregates with different sizes are never considered useless, and GCC no longer generates incorrect code in the described situation.

Enhancements

BZ#1099549

OpenMP 4.0 support has been added to the GNU OpenMP library, which allows applications built with DTS 3.0 and using OpenMP to link on Red Hat Enterprise Linux 6.

Bug Fixes

BZ#1104587

Previously, when the users tried to debug certain core dump files generated from multi-threaded applications, GDB was unable to handle correctly specific situations, for example, when a referenced DWARF Compilation Unit was aged out. As a consequence, performing the "thread apply all bt" command to display a backtrace of all threads could cause GDB to terminate unexpectedly. A patch has been provided to fix this bug, and GDB no longer crashes in this scenario.

BZ#913146

Previously, when executing the signal handling code, GDB was calling certain non-reentrant functions, such as the calloc() function. This could sometimes result in a deadlock situation. To avoid deadlocks in this scenario, the relevant GDB code has been modified to handle non-reentrant functions correctly.

BZ#1007614

Previously, due to a bug in a specific function in the support for Python, if a Python script read a memory region from the program that was being debugged, and the reference to the memory region became out of scope, GDB did not deallocate the memory. As a consequence, this led to a memory leak, which was particularly significant in memory-intensive scenarios. A patch has been applied, and GDB now frees the acquired memory correctly.

BZ#903734

Prior to this update, GDB did not add the necessary offsets when dealing with bit fields inside nested instances of the struct data type. Consequently, when the user tried to set the value of a bit field that was declared inside such a data structure, GDB was unable to calculate it correctly. With this update, GDB calculates the values of bit fields inside nested data structures correctly.

BZ#1080656

Previously, GDB was unable to correctly access Thread Local Storage (TLS) data on statically linked binaries. Consequently, the user could not inspect TLS data on the program being debugged if the program was linked statically. This bug has been fixed, and users can now inspect TLS data on statically linked binaries as expected.

BZ#981154

Prior to this update, GDB incorrectly handled symbolic links related to build-id files. As a consequence, when the user tried to debug core dump files generated from programs that were not installed on the system, GDB printed misleading error messages instructing the user to run incorrect commands to install the binary files. Subsequently, the suggested commands did not fully work and the program package was not correctly installed. This bug has been fixed, and GDB now issues a message containing correct commands to install the necessary binary files.

Enhancement

BZ#971849

This update adds the "$_exitsignal" internal variable to GDB. Now, when debugging a core dump file of a program that was killed by a signal, "$_exitsignal" provides the signal number to the user.

Bug Fixes

BZ#827257

Due to the bugs in the XDMCP remote desktop protocol chooser and indirect query code, deadlocks and incorrect size arguments occurred on GDM. As a consequence, the host chooser failed to properly delegate to other hosts. To fix this bug, correct-size information is now used, and the recursive deadlock has been removed. As a result, the indirect chooser now works more reliably.

BZ#992907

Previously, the logic for determining when to force the X server to run on virtual console 1 was inadequate, which caused the login screen and subsequent user sessions to switch to virtual console 7 after the initial logout. This update introduces a change in the logic to make virtual console 1 use the statically hardwired display. Now, only auxiliary displays needed for user switching run on virtual console 7 and above, and the main login screen with subsequent user sessions always runs on virtual console 1.

BZ#1004484

Prior to this update, the "Switch User" menu item depended on the GDM display manager for starting a login screen. Consequently, the "Switch User" menu item terminated unexpectedly if the user initially logged in with KDM. With this update, the broken "Switch User" menu item is hidden if the user has not logged in with GDM.

BZ#1004909

Due to a missing NULL check in the code, a benign error was logged in the slave log file when logging in via a remote XDMCP connection. The missing NULL check has been added to fix this bug, and error messages are no longer returned.

BZ#1013351

Previously, GDM failed to create xauth entries usable by remote X clients. Consequently, remote clients could not gain access to the host X server without resorting to ssh tunnels. With this update, GDM writes out xauth entries suitable for remote clients when the DisallowTCP option is set to "false" in the configuration. As a result, xauth entries usable by remote clients are now successfully generated.

BZ#1030163

When debugging was enabled and DNS misconfigured, errors in debug logging code made GDM enter an infinite loop. As a consequence, the XDMCP remote desktop protocol did not work or worked sporadically when debug mode was enabled; debug code printed NULL instead of remote server host in failure scenarios. To fix this bug, the debug code has been changed not to call itself and not to nullify or leak the host name. As a result, GDM no longer locks up and returns more comprehensible error messages.

BZ#1048769

Due to incorrect handling of the machine state in user switching code, user switching applet could terminate unexpectedly shortly after login. With this update, the machine state is handled differently, and user switching applet crashes no longer occur.

BZ#1073546

If the window manager attempted to focus a window before user interaction, benign warning messages were logged in the /var/log/gdm/:0-greeter.log file. With this update, window focusing in the early start up is avoided, and the window manager no longer returns warning messages.

Bug Fix

BZ#1024681

Previously, when the xgettext utility encountered an invalid file and generated a warning message it would exit with a fatal error if any additional files were supplied to be processed. Consequently, no output was generated. This update fixes the error-processing code and xgettext now works as expected in the described situation.

Bug Fix

BZ#1067294

Previously, the ghostscript-fonts package contained fonts with a restrictive license. With this update, the fonts with restricted rights causing a licensing problem are removed from the package.

Security Fixes

CVE-2013-4237

An out-of-bounds write flaw was found in the way the glibc's readdir_r() function handled file system entries longer than the NAME_MAX character constant. A remote attacker could provide a specially crafted NTFS or CIFS file system that, when processed by an application using readdir_r(), would cause that application to crash or, potentially, allow the attacker to execute arbitrary code with the privileges of the user running the application.

CVE-2013-4458

It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash.

Bug Fixes

BZ#845218

When performing an address lookup to a defective Domain Name System (DNS) server using the getaddrinfo utility with the ai_family option set to AF_UNSPEC, the server could respond with a valid response for the A record and a referral response for the AAAA record, which resulted in a lookup failure. With this update, getaddrinfo has been fixed to return the valid response in such a case.

BZ#905941

Under certain rare circumstances, the pthreads utility terminated unexpectedly during stack unwinding on thread cancellation on the PowerPC architecture. The bug has been fixed and pthreads no longer crashes in the described case.

BZ#981942

Name lookup of internationalized domain names using the getaddrinfo utility occasionally caused the calling program to abort unexpectedly. This update fixes the getaddrinfo code to prevent the abort.

BZ#995972

Due to a bug in the thread local storage (TLS) initialization, the dlopen() function occasionally terminated unexpectedly with a segmentation fault. This bug has been fixed, and dlopen() no longer crashes.

BZ#1019916

The order of relocations was incorrect during symbol dependency testing in the dynamic linker. Consequently, IFUNC resolvers terminated unexpectedly if the dependent symbols have not yet been relocated. This occurred when one of the environment variables LD_WARN or LD_TRACE_PRELINKING was set. This update ensures that relocations done during symbol dependency testing are performed in correct order, thus avoiding the crash.

BZ#1027101

This update modifies certain code paths used by the C library's memory allocator "fastbins" feature to be thread-safe, which prevents segmentation faults previously caused by a corruption in the memory allocator.

BZ#1032628

This update fixes the symbol lookup in the elf/dl-lookup.c function to return correct values.

BZ#1039988

Previously, querying for a non-existent netgroup when the nscd daemon was running returned a spurious empty result and no error message. For example, executing 'getent netgroup foo' retured a spurious empty netgroup and exited successfully with status 0 even if no netgroup named 'foo' existed. This bug has been fixed, and the above command now exits with non-zero exit status, as expected.

BZ#1043557

Due to problems with the buffer extension and reallocation, the nscd daemon terminated unexpectedly with a segmentation fault when processing long netgroup entries. With this update, the handling of long netgroup entries has been fixed, and nscd no longer crashes in the described scenario.

BZ#1044628

The getaddrinfo() function returned an incorrect permanent error EAI_NONAME when the Domain Name System (DNS) server was unreachable or the DNS query timed out. Now, getaddrinfo() returns EAI_AGAIN to indicate a temporary failure in name resolution.

BZ#1054846

This update fixes a bug in the nscd daemon that caused the sudo utility to deny access for valid users in permitted netgroups.

BZ#1074342

This update prevents a memory corruption and a subsequent unexpected crash due to a segmentation fault in the nscd daemon when querying certain netgroups with nested members.

BZ#1085273

When querying an empty netgroup, the nscd daemon occasionally became unresponsive. This has been fixed so that an appropriate error code is returned in the described case.

BZ#1099025

This update fixes a bug in the gettimeofday() function's implementation of the Virtual Dynamic Shared Object (VDSO) that caused the gettimeofday() function to return an incorrect non-changing value.

Enhancements

BZ#1027261

This update adds information about the malloc() function requests satisfied by the mmap system call to the output created by the malloc_info() function.

BZ#1028285

This update adds Virtual Dynamic Shared Object (VDSO) indirect function support for the gettimeofday() system call on 64-bit PowerPC system to improve the performance of gettimeofday().

Bug Fixes

BZ#1044797

When trying to mount a remote gluster share using the "backupvolfile-server" option, the process failed and returned an "Invalid argument" error message. A new mount point option, backup-volfile-servers, has been added to provide backward compatibility and allows remote gluster shares to be mounted successfully.

BZ#1119205

Previously, when updating the gluster utility from Red Hat Enterprise Linux 6.5 to version 6.6, glusterfs-libs POSTIN scriptlet terminated unexpectedly. The underlying source code has been patched, and POSTIN no longer fails.

Bug Fixes

BZ#720922

Previously, if a search query was issued in the gnome-packagekit GUI before the list of packages in the left pane was populated, gnome-packagekit became unresponsive. With this update, gnome-packagekit has been modified so that it does not permit search queries before loading the package list. As a result, gnome-packagekit no longer hangs in the described case.

BZ#732796

Prior to this update, the "Install Updates" button in the gpk-update-viewer GUI was incorrectly re-enabled when the authentication dialog started. This bug has been fixed, and the button remains disabled when the authentication dialog appears.

Bug Fixes

BZ#684767

Due to insufficient checking, the "Switch User" button appeared in the logout dialog window even when user switching was disabled by the lock down configuration. A patch has been provided to fix this bug, and the "Switch User" button is now removed when the user logs out.

BZ#785828, BZ#1069503

Due to incorrect clean up of resources at shutdown, the "Startup Applications" GUI did not submit changes immediately. If the user closed the dialog window earlier than 2 seconds after making a change, the change failed to be committed. To fix this bug, the dialog window on shutdown has been deleted, so that its dispose handler commits pending changes immediately. As a result, the user can enable or disable additional startup programs and quickly close the dialog window without the risk of losing changes.

BZ#982423

Prior to this update, there were inadequate checks in the gnome-session utility for a preexisting gnome-session instance. Consequently, running gnome-session within a GNOME session started a nested broken session. With this update, a check for the SESSION_MANAGER environment variable has been added. As a result, if the user runs gnome-session within a preexisting session by mistake, an error message is returned.

Enhancement

BZ#786573

Previously, if the user accidentally clicked "Remember Running Applications" and was using the custom session selector, they could not proceed without saving. This update provides the close button for the session selector to enable the user to refrain from saving.

Bug Fixes

BZ#638635

Previously, the secret key management daemon for GnuPG, gpg-agent, failed to encode a new iteration count value when it created a new protected key or changed an existing key. As a consequence, the key could not be unprotected and gpg-agent thus did not properly interact with a number of programs that use key decryption, such as KMail or Kleopatra. With this update, the new iteration count is encoded properly and the decryption of keys created or modified by gpg-agent no longer fails.

BZ#966493

Prior to this update, the GnuPG encryption and signing tool, gpg2, by default used CAST5, an encryption algorithm not approved by FIPS standards. Consequently, when gpg2 was run in FIPS mode, data encryption and decryption failed and caused gpg2 to terminate unexpectedly. With this update, GnuPG uses AES, a FIPS-approved encryption algorithm, and gpg2 data encryption and decryption in FIPS mode work as intended.

BZ#1006879

Previously, the GnuPG signature checking tool, gpgv2, did not correctly interact with the Libgcrypt library. As a consequence, when the gpgv command was used on a file, gpgv2 terminated unexpectedly. This update fixes the error and the gpgv command now functions correctly.

BZ#1078957

Prior to this update, GnuPG did not check for availability of the RIPEMD-160 hash function digest. Because the RIPEMD-160 algorithm is not approved by FIPS standards, GnuPG therefore terminated unexpectedly when the "gpg --verify" command was used in FIPS mode to verify a signature that contained a RIPEMD-160 hash. With this update, GnuPG properly checks for RIPEMD-160 support and the crash no longer occurs.

Bug Fixes

BZ#1057249

The PXE booting did not respect the specified boot order when multiple NICs of the same type were configured for a virtual machine. Instead, the gPXE image attempted to boot from all NICs supported by the loaded image in the PCI bus scan order. This resulted in boot delays, attempting to perform a PXE boot on unintended devices, as well as in booting from unintended devices in case of success. This update provides the gPXE boot image with the PCI address of the intended boot device, ensuring that the image only attempts to boot on the intended device.

BZ#1105189

HTTP requests generated by gPXE set wrong TCP flag (SYN & PSH) in the first packet of a session. Consequently, when using a firewall, the TCP packet flow would be blocked and the HTTP module integrated with gPXE would not work. With this update, gPXE no longer set the PSH flag in the first packet of a session and the system now boots as expected.

Bug Fix

BZ#683753

Previously, the grep utility did not request processing of UTF-8 from the Perl-compatible regular expressions (PCRE) library if a UTF-8 locale was in effect. As a consequence, Unicode symbols were not correctly matched if a Perl regular expression (the "-P" option) was used with a UTF-8 locale. This update adds a request for UTF-8 processing to the PCRE library, and grep now correctly handles Unicode symbols in the described situation.

Bug Fixes

BZ#1002809

On some systems that are not case sensitive, the "bootx64" command incorrectly launched the GRUB shell instead of booting the GRUB installer. With this update, "bootx64" also checks for the existence of the GRUB booting file (BOOTX64), which allows for using "bootx64" to boot GRUB on systems which are not case sensitive.

BZ#1121321

A regular expression in the grub-install program could not match multipath devices when the "user_friendly_name" option was set to "no". As a consequence, the user was not able to install the GRUB utility on a specified device. To fix this bug, the regular expression has been updated to match the requested device names. As a result, GRUB now installs successfully.

BZ#1129466

Prior to this update, exiting the GRUB shell menu and rebooting the ISO file on an extensible firmware interface (EFI) system changed the boot device path, which in turn caused an assert error. As a consequence, GRUB sometimes failed to boot. This update prevents the boot device path from being changed, and as a result, exiting the GRUB shell and rebooting the ISO file now proceeds as expected.

BZ#1130209

Previously, the biodisk function incorrectly returned "0" instead of the correct values of the read and write calls. Due to this bug, the kernel under some circumstances detected disk errors when booting, which caused the boot to fail. This update fixes the behavior of biodisk, and the boot failure no longer occurs.

BZ#1128137

Previously, booting GRUB with trusted boot (tboot) enabled under some circumstances caused the tboot screen to be blue, making the text output impossible to read. This update adds a number of conditions for graphic initialization to GRUB, which ensure that the tboot screen displays in normal colors.

BZ#1131205

Previously, the graphics_cls() and graphics_init() calls did not correctly co-operate with GRUB. As a consequence, booting an ISO file with disabled VGA caused the system to encounter an exception and automatically reboot. With this update, the behavior of the mentioned calls has been corrected and the system now successfully boots with disabled VGA.

BZ#1094978, BZ#1074914, BZ#1048681

When the "splashimage" option parameter was commented out or a serial console was enabled in the /boot/EFI/redhat/grub.cfg file, the kernel did not initialize the efifb graphic back end when booting an EFI system. As a consequence, VGA text consoles displayed a blank screen instead of the intended output. With this update, booting an EFI system uses efifb regardless of whether GRUB splash image or a serial console are used, and the content of VGA consoles now displays as expected.

BZ#1129436

Prior to this update, if a splash image was not used when booting an EFI system, the serial console displayed a redundant grub_read() failure message during the boot process. With this update, the underlying code has been fixed and booting an EFI system without the GRUB splash image no longer generates redundant failure messages.

Bug Fixes

BZ#1098846

Prior to this update, the Trusted Boot (tboot) module incorrectly used the tboot.gz multiboot image to search for a grub configuration file. As a consequence, running the "yum update" command led to grubby corrupting the grub.conf file when tboot was enabled and two or more kernels were updated. With this update, tboot uses specific kernel names to search for grub configuration, and corruption of grub.conf no longer occurs in the described scenario.

BZ#997934

Previously, enabling tboot caused the kernel configuration to not be displayed properly when running the "grubby --info=DEFAULT" command. With this update, multiboot module parameters have been included in the output of "grubby --info", and the configuration displays as expected when tboot is running.

Bug Fixes

BZ#909454

The gtk_cups_connection_test_new() function used the default IPP port instead of the real one. Consequently, the GTK print dialog failed to get printer information from remote CUPS servers with a non-standard port number. With this update, the correct port number is used and GTK no longer fails.

BZ#1015044

The rsvg-convert utility of the librsvg2 library did not respect the width and height specified with the viewBox attribute in SVG files. As a consequence, avatar icons were smaller than they were supposed to be. With this update, the utility uses the correct width and height.

BZ#1104681, BZ#1104684

The gdk-pixbuf loaders were moved to a separate directory as part of the separation of the gdk-pixbuf2 library to its own package. This update moves the loaders present in the librsvg2 and libwmf libraries to the new directory.

BZ#1126916

The newly-added GtkComboBoxText widget could cause applications that used it to terminate unexpectedly due to the incorrect initialization of one of the widget's properties. With this update, the initialization has been fixed and the applications no longer crash in the described scenario.

BZ#1127719

Missing forward declarations for various functions caused the compiler to assume an implicit 32-bit integer return type. Consequently, the compiler terminated unexpectedly because the string pointer was truncated to 32-bits and then extended back to 64-bits. With this update, the "#include" lines for the appropriate headers have been added at the top of the affected source files. As a result, the compiler no longer crashes.

BZ#1128798

Previously, the GTK+ print dialog failed to print to a file in the default directory due to an incorrect path generation of the file. The generation of the path has been fixed, and GTK+ prints to a file as intended.

Bug Fixes

BZ#902448

Previously, when several clients using the same home directory located on remote NFS (Network File System) modified the gvfs-metadata database files, a conflict could occur. In addition, GVFS produced heavy traffic on the remote NFS server. With this update, countermeasures for possible conflicts have been put in place and metadata journal files have been relocated to a temporary directory, and GVFS no longer produces heavy traffic on the NFS mount.

BZ#1011835

Prior to this update, GVFS did not pass a mount prefix into the rename operation. Consequently, it was not possible to rename files on the WebDAV shares if mount prefix was specified, and the following message was displayed when attempting to do so:

The item could not be renamed. Sorry, could not rename "dir1" to "dir2": Thespecified location is not mounted

This bug has been fixed and the mount prefix is now passed into the rename operation as expected. As a result, the rename operation works correctly on the WebDAV shares.

BZ#1049232

When the GDesktopAppInfoLookup extension processed a URL scheme that contained invalid characters, for example from Thunderbird messages, a request for URL handlers was unsuccessful. Consequently, an error dialog notifying about the invalid character was shown. With this update, GDesktopAppInfoLookup has been modified to check the URL scheme for invalid characters before it is used. As a result, the aforementioned error no longer occurs.

BZ#883021

A previous GLib2 rebase

BZ#1118325

Previously, GVFS used the select() function to communicate with the OpenSSH utility. Due to changes introduced with the OpenSSH update, select() could return incomplete results. Consequently, mounting of SFTP locations failed with the following message:

Error mounting location: Error reading from unix: Input/output error

GVFS has been updated to use the poll() function instead of select(), thus fixing this bug.

BZ#1101389

A previous GLib2 rebase

Bug Fixes

BZ#949820

Previously, the "-h" option of the zgrep command was absent from the source code of the gzip utility. As a consequence, the output of running the "zgrep -h" command was not parsed, and the file name was printed. With this update, the possibility to use the short "-h" option besides the "--no-filename" option has been added. As a result, running the zgrep command with the "-h" option now prints the correct lines and suppresses the prefixing of the file names on output when multiple files are searched.

BZ#961810

Prior to this update, the time stamp of an archive was set by the futimesat() or utime() system calls when using the gzip utility. Consequently, the archived file had a lower time stamp than expected because only microsecond resolution was enabled, and a nanosecond time stamp was not provided. The underlying source code has been modified to attempt to use the utimensat() or futimens() system calls for nanosecond resolution. As a result, the archived file has exactly the same time stamp as the original file.

Bug Fixes

BZ#736415

Prior to this update, the HAL daemon did not properly handle the hot plug addition and removal events. Consequently, the HAL daemon terminated unexpectedly with a segmentation fault during device probing. With this update, hot plug events are properly handled and the HAL daemon no longer crashes in the aforementioned scenario.

BZ#755209

Prior to this update, the /usr/libexec/hald-probe-smbios script, as well as certain other hald-probe scripts, terminated unexpectedly after they were manually started. This bug has been fixed and the aforementioned scripts can be started manually without complications.

Enhancement

BZ#1076664

Previously, the HAL daemon did not recognize touchscreen monitors correctly. Consequently, these monitors were not added to the list of hot plugged devices in the Xorg window system. Support for touchscreen devices has been added to HAL and these devices are now recognized correctly.

Bug Fix

BZ#1016706

The .hmac files are used to check the kernel image at the boot time; if the check fails, the boot process is expected to be halted. Previously, the hmaccalc utility did not flag empty .hmac files as an error, allowing the system to boot even if the boot was supposed to fail. With this update, a patch has been provided to address this bug. As a result, the system is no longer allowed to boot in the described scenario.

Bug Fix

BZ#905143

Previously, the udev rules files were not in the correct location on the file system. As a consequence, permissions on the device node after connecting a device were insufficient. This update moves the udev rules files to the correct location, and udev rules now work correctly in the described situation.

Bug Fixes

BZ#876626

Previously, the system did not initialize shared memory session cache when the Apache HTTP Server loaded the mod_ssl module for the first time during a configuration reload. As a consequence, the system terminated the httpd service unexpectedly in the described situation. With this update, the problem has been fixed, and httpd no longer crashes when loaded for the first time after a configuration reload.

BZ#972949

Previously, the bybusyness algorithm, contained in the mod_proxy_balancer module, did not balance the workload after a worker tried to send a request to a non-working node. Consequently, once the non-working node became working again, mod_proxy_balancer did not recover the worker that tried to send the request because it still considered the worker busy. With this update, the algorithm has been fixed and mod_proxy_balancer now uses the worker after a node recovery as expected.

BZ#976644

Prior to this update, the mod_proxy module did not ignore the EINTR return value of the poll() function. As a consequence, mod_proxy broke the connection during an attempt to send a request using the CONNECT method when the child process was terminated. A patch has been applied to fix this problem, and mod_proxy now ignores EINTR and continues with the CONNECT request as expected in the described situation.

BZ#979129

Previously, the mod_cgi module did not correctly handle the situation when a client failed to send a request before timeout. Consequently, the client received the "500 Internal Server Error" HTTP status code instead of the "408 Request Timeout" HTTP status code. With this update, the problem has been fixed, and the client now receives "408 Request Timeout" after a failed attempt to send a request before timeout.

BZ#991556

Previously, the Apache Portable Runtime (APR) library bucket brigade in the mod_proxy_http module contained objects allocated from another APR pool that could be freed before the APR bucket brigade. Consequently, trying to free already freed objects in an APR bucket brigade cleanup could cause the httpd service to terminate unexpectedly. With this update, the APR bucket brigade in mod_proxy_http is now destroyed sooner than the APR pool from which the objects stored in the APR bucket brigade are allocated. As a result, httpd no longer crashes in mod_proxy_http during an APR bucket brigade cleanup.

BZ#1012766

Prior to this update, the mod_proxy_http module did not honor the ErrorLog directive defined in VirtualHost configuration for certain errors. As a consequence, the "proxy: error reading response" message could be logged into the global error log even though a VirtualHost-specific error log was configured. A patch has been applied to fix this bug, and mod_proxy_http now logs "proxy: error reading response" into the correct log file.

BZ#1032733

Prior to this update, the status line of an HTTP response message from server did not, under certain circumstances, include the HTTP reason phrase if it contained the status code. As a consequence, the server displayed only the status code to the HTTP client. With this update, the bug has been fixed, and the status line issued to the HTTP client now contains both the status code and the reason phrase as expected.

BZ#1034984

Previously, the mod_ssl module directives did not contain support for using the Transport Layer Security cryptographic protocol version 1.2 (TLSv1.2). As a consequence, the user could not set up mod_ssl to disable TLSv1.2. With this update, support for TLSv1.2 configuration options has been added to mod_ssl. As a result, it is now possible to set up mod_ssl to disable TLSv1.2.

BZ#1035666

Prior to this update, the mod_ssl module did not support wildcard certificates with the SSLProxy directive. As a consequence, SSLProxy did not work when a wildcard certificate was used, and the user had to set the SSLProxyCheckPeerCN directive to "off" as a workaround. A patch has been applied to fix this bug, and mod_ssl now supports wildcard certificates with SSLProxy.

BZ#1037832

Previously, the mod_ssl module stored all Certificate Revocation Lists (CRL) in cache, and the user could not disable the caching. Consequently, the httpd service could consume a lot of memory when a large amount of CRLs were stored in cache. To fix this problem, the DisableCRLCaching directive has been added to mod_ssl to disable CRL caching. As a result, mod_ssl can now be configured to no longer store CRLs in cache.

BZ#1048757

Previously, a function handling dynamic groups, which is included in the mod_ldap module, contained an incorrect pointer assignment. As a consequence, the system caused the httpd service to terminate unexpectedly with a segmentation fault when multiple dynamic groups were used. A patch has been applied to fix this bug, and httpd no longer crashes when more than one dynamic group is used.

BZ#1071883, 1100680

Prior to this update, the mod_ssl module only supported ephemeral Diffie-Hellman (DH) keys of 512-bit and 1024-bit lengths. Consequently, Secure Sockets Layer (SSL) cipher suites using ephemeral DH keys could not be used in FIPS mode. With this update, mod_ssl uses ephemeral DH keys of key lengths up to 8192 bits. As a result, mod_ssl now works as expected in FIPS mode.

BZ#1077336

Previously, when running the "apachectl status" command, the exit code failed to be changed when the httpd service was not running. As a consequence, "apachectl status" could return the exit code 0, indicating success, even when httpd was not running. A patch has been provided to fix this bug and "apachectl status" now exits with the correct exit code when httpd is not running.

BZ#1090445

Prior to this update, the SSLProtocol directive exposed by the mod_ssl module did not allow control over whether the TLSv1.1 or TLSv1.2 protocols were enabled. Consequently, the user could not set mod_ssl to disable TLSv1.1 or TLSV1.2. With this update, support for TLSv1.2 and TLSv1.2 configuration options has been added to mod_ssl, and mod_ssl now supports TLSv1.1 and TLSv1.2 in the SSLProtocol Directive.

BZ#1094990

Previously, the mod_cache module did not correctly handle requests to the back-end server due to a race condition between removing and renaming cached files and due to inconsistencies in generating the cache hash codes when handling the HTTP Range requests. Consequently, mod_cache could pass multiple requests to the back-end server to refresh the cache instead of a single request. With this update, the race condition has been fixed and hash codes for an object in cache are generated consistently even when handling Range requests. As a result, mod_cache now passes only a single request to the back-end server when refreshing the cache.

BZ#1103115

Prior to this update, the %post script of the mod_ssl module used an RSA key hard-coded to a 1024-bit length. As a consequence, the user could not install mod_ssl in FIPS mode. To fix this bug, the mod_ssl %post script has been updated to use 2048-bit RSA key. As a result, it is now possible to install mod_ssl in FIPS mode.

BZ#1111410

Previously, the mod_proxy module did not close the client connection when the back-end server connection was closed. Consequently, mod_proxy kept the client connection open until it timed out. A patch has been provided to fix this bug and mod_proxy now closes the client connection immediately after mod_proxy closes connection to the back-end server.

Enhancements

BZ#1035818

This update introduces support for Elliptic Curve Cryptography (ECC) keys and Elliptic Curve Diffie-Hellman (ECDH) ciphers in Red Hat Enterprise Linux 6 because the OpenSSL toolkit in Red Hat Enterprise Linux 6 also supports ECDH.

Enhancement

BZ#1064381

The PCI, USB, and vendor ID files have been updated with information about recently released hardware. Hardware utility tools that use these ID files are now able to correctly identify recently released hardware.

Bug Fix

BZ#914728

The i2cdetect utility requires the i2c-dev module to be loaded so that it can detect devices present on a specified bus. Previously, this was not done automatically, and as a consequence, the user could be mistaken that no buses or devices existed when running i2cdetect. With this update, i2c-dev has been made automatically-loadable. Now, i2cdetect correctly scans an I2C bus for devices and outputs a table with detected devices as expected.

Bug Fix

BZ#983497

Previously, indexing for the compose.db and latex.db files was handled by the post-installation script. As a consequence, running the "rpm -V" command returned an unnecessary warning that the SQLite database files had been changed since the installation. With this update, the indexed files are already included in the packages, and no warning messages are displayed in the described situation.

Bug Fixes

BZ#1018095

Previously, certain network device drivers did not accept ethtool commands right after they appeared in the user-space. As a consequence, the current setting of the specified device driver was not applied and an error message was returned. This update adds the ETHTOOL_DELAY variable, which makes sure the ethtool utility waits for some time before it tries to apply the options settings, thus fixing the bug.

BZ#1024561

When issuing a reboot or halt, the system sometimes killed the S01reboot process and never completed the reboot or shutdown. This update changes the regex for the sed utility to fix this bug, and the S01reboot process now completes successfully.

BZ#1053098

Previously, the ipcalc utility handled netmask parameters incorrectly using the "-c" option. As a consequence, invalid CIDR was ignored and netmask in allowed format was not accepted. The updated "-c" option validates IP addresses for specified address families as expected, invalid CIDR is no longer ignored, and allowed formats of netmask are accepted.

BZ#1086897

Due to a race condition, the "multicast_router" and "hash_max" BRIDGING_OPTS options failed to apply when creating the bridge. With this update, "multicast_router" and "hash_max" are applied after the bridge is up, and BRIDGING_OPTS options now work as intended.

BZ#1101795

Prior to this update, the udev device manager called the hotplug script when a VLAN network was added. However, because the VLAN network has the same default hardware address as the default network adapter device, hotplug reverted the network adapter's IP configuration to the values in the /etc/sysconfig/network-scripts/ directory, and in some cases disconnected the network adapter. This update removes the triggering of the hotplug script for VLAN networks and, as a result, the network adapter now retains its IP address, and thus no longer fails.

Enhancements

BZ#1005355

Previously, the only way to set up VLAN ID was through the name of the new virtual device (vlan10 or eth0.10). With this update, the ID can be specified by the VID option in ifcfg file.

BZ#1023471

The saved seed size in the /etc/rc.sysinit file has been increased from 512 bytes to 4096 bytes to comply with the updated crypto requirements.

BZ#1082765, BZ#1099486

With this update, the user can set PRIO and AGEING options for bridges in ifcfg files, which allow ageing to be set in ifcfg-* scripts.

Bug Fixes

BZ#1034478

Previously, the ipa-replica-install script tried to add the "A" and "PTR" records if the master managed Domain Name System (DNS). If the master did not manage the replica's zone, an error message "DNS zone not found" was returned, and the installation of a replica failed. With this update, the ipa-replica-install script has been fixed to properly handle the described situation, and the replica's installation now succeeds. Please note that the "A" and "PTR" records for the replica need to be added manually.

BZ#1083878

Previously, when Identity Management Public Key Infrastructure (PKI) clone in Red Hat Enterprise Linux 7 was being installed, an access to the /ca/ee/ca/profileSubmit URI on the Identity Management server, from which it was replicating, was required. However, Identity Management in Red Hat Enterprise Linux 6 did not export this URI in the httpd proxy configuration. As a consequence, the installation of Identity Management replica with the PKI component in Red Hat Enterprise Linux 7 failed when installed against a Red Hat Enterprise Linux 6 master. With this update, the /ca/ee/ca/profileSubmit URI has been added to Red Hat Enterprise Linux 6 Identity Management proxy configuration and a replica installation now succeeds in this scenario.

BZ#1022199

Prior to this update, disabling a sudo rule did not trigger the removal of its entry from the sudo compat tree in Lightweight Directory Access Protocol (LDAP). Consequently, the disabled sudo rules were still followed on clients using the sudo compat tree. This bug has been fixed, and the described problem no longer occurs.

BZ#1029921

Previously, an Identity Management password policy was not applied to passwords changed using the Directory Manager or PassSync agent. As a consequence, the default expiration time (90 days) was always applied even if the Identity Management administrator had defined a different policy. The Identity Management Password Change Extended Operation Plug-in has been updated, and the password changes made by the Directory Manager or PassSync agent now respect the "max lifetime" field of the user password policy.

BZ#905064

Previously, an intermittent race condition happened when the ipa-server-install utility tried to read the "preop.pin" value from the CS.cfg file, which was still unwritten to the disk by the pkicreate utility. As a consequence, the Identity Management server installation failed. With this update, ipa-server-install has been modified to anticipate such a race condition. Now, when ipa-server-install is unable to read from CS.cfg, it waits until it times out or the file is written to the disk. Additionally, these events are now properly logged in the installation log if they occur.

BZ#1040009

Prior to this update, a bug in the Python readline module caused a stray escape sequence to be prepended to the output of the script that the certmonger utility uses to acquire renewed certificates on the Certification Authority (CA) clones. Consequently, certmonger failed to parse the output of the script and the certificate was not renewed. A patch has been provided to address this bug and certmonger is now able to successfully parse the output of the script and complete the certificate renewal.

BZ#1082590

The ipa-client-automount utility uses the Remote Procedure Call (RPC) interface to validate the automount location. Previously, the RPC interface only allowed clients whose API version was earlier than or the same as the server API version to validate the automount location. As a consequence, running ipa-client-automount with a client whose API version was later than the server's failed with an incompatibility error message. With this update, ipa-client-automount has been modified to report a fixed API version in the RPC call and ipa-client-automount now runs successfully when the client API version is later than the server's.

BZ#1016042

Previously, the ipa-replica-manage utility contained a bug in the re-initialize command causing the MemberOf task to fail with an error message under certain circumstances. Consequently, when the ipa-replica-manage re-initialize command was run for a Windows Synchronization (WinSync) replication agreement, it succeeded in the re-initialization part, but failed during execution of the MemberOf task which was run after the re-initialization part. The following error message was returned:

Update succeeded 
Can't contact LDAP server

However, the error was harmless as running the MemberOf task was not required in this case. A patch has been applied and the error message is no longer returned in the described scenario.

BZ#1088772

Users in Identity Management in Red Hat Enterprise Linux 7 can be added without the password policy explicitly defined in the "krbPwdPolicyReference" attribute in the user object. The User Lockout plug-in locks out users authenticating or binding through the LDAP interface after configured number of failed attempts. In Identity Management in Red Hat Enterprise Linux 7, the plug-in does not require this attribute to be present to correctly apply the lock-out policy. Previously, the Identity Management User Lockout plug-in in Red Hat Enterprise Linux 6 required this attribute to function properly. Consequently, the password lock-out policy was not applied to users created in Identity Management in Red Hat Enterprise Linux 7 that were replicated to Red Hat Enterprise Linux 6. Such users had an unlimited number of authentication attempts in the LDAP interface. The User Lockout plug-in has been updated to respect users without the defined custom policy and to properly fall back to the defined global password policy, and now only a defined number of authentication attempts are allowed to users in the LDAP interface.

BZ#1095250

Previously, the validator in Identity Management did not allow slash characters in the DNS names. As a consequence, it was not possible to add reverse zones in the classless form. With this update, the DNS name validators allow slash characters where necessary, and thus the recommendations of RFC 2317 are now followed.

BZ#1108661

Prior to this update, Identity Management installers could call the ldapmodify utility without explicitly specifying the authentication method. Consequently, the installer could fail when the authentication method was set in the ldapmodify user configuration. This bug has been fixed, the installer now always calls ldapmodify with the authentication method explicitly specified, and the described problem no longer occurs.

BZ#1109050

Previously, when a Red Hat Enterprise Linux 6 master was being installed or upgraded, an extra default value was added to the "nsDS5ReplicaId" attribute of the LDAP entry "cn=replication,cn=etc". In Red Hat Enterprise Linux 7, Identity Management uses a stricter validation, which prevents installing a replica on such a system. As a consequence, after a Red Hat Enterprise Linux 6 master was installed or upgraded on a system with more than one master, installing a Red Hat Enterprise Linux 7 replica failed. This bug has been fixed, the extra value is no longer added, and Red Hat Enterprise Linux 7 replicas can be installed successfully in this scenario.

BZ#1015481

Identity Management administration framework API contains two checks on the server side to verify that a request on its API can be passed further:

1. A check to see if the client API version is not higher than the server API version. If it is, the request is rejected.
2. A check to see if the client API request does not use an attribute or a parameter unknown to the server. If it does, the request is rejected.

Prior to this update, the Identity Management server performed the checks in an incorrect order. First, the attribute and parameter check was done, then the API version check. As a consequence, when a client (for example, Red Hat Enterprise Linux 6.5) ran the ipa administration utility against a server with an earlier operating system (for instance, Red Hat Enterprise Linux 6.4), the command returned a confusing error message. For example, instead of stating API incompatibility, an error message regarding an unknown option was displayed. This bug has been fixed, the checks on the server are now performed in the correct order and a correct error message is displayed in this scenario.

Enhancements

BZ#1111121

Automated configuration of the sudo command has been added to the ipa-client-install utility. By default, ipa-client-install now configures sudo on Identity Management clients by leveraging the newly-added ipa provider in the sssd utility.

BZ#1095333

A set of Apache modules has been added to Red Hat Enterprise Linux 6.6 as a Technology Preview. The Apache modules can be used by external applications to achieve tighter interaction with Identity Management beyond simple authentication.

Bug Fix

BZ#1147593

Previously, the ipmitool default timeout values signified a time period which was too short. As a consequence, during retries, the ipmitool utility could terminate unexpectedly with a segmentation fault, or could produce a nonsensical error message. With this update, the ipmitool options passed from environment variable are parsed correctly from IPMITOOL_OPTS and IPMI_OPTS variables, IPMITOOL_* taking precedence over IPMI_* variables. As a result, ipmitool no longer crashes in the described situation.

Bug Fix

BZ#1029529

The IPMI kernel code was missing aliases for the IPMI kernel modules. Consequently, not all of the IPMI kernel modules could be automatically loaded when the appropriate hardware was detected, and the hardware thus could not be used. To fix this problem, the module alias configuration file has been added to the /etc/modprobe.d/ directory, linking all of the separate IPMI modules to the IPI* device class alias. Note that the system must be rebooted for this change to take effect.

Enhancement

BZ#1056581

To improve usage of ipmitool as a part of the software stack, certain environment variables were unified and several new variables were introduced to ipmitool, specifically:

IPMITOOL_* variables now take precedence over IPMI_* variables.

The IPMITOOL_KGKEY variable has been added to unify the name space usage.

* Limited IPv6 support has been added to the ipmitool packages; the IPMI standard does not include the IPv6 data definitions, and therefore this change includes only IPv6 connectivity. The OEM-vendor-specific command values related to IPv6 are beyond the scope of this feature.

Bug Fix

BZ#1127825

Previously, information on "Read Intensive" disks did not display in the iprconfig menu. The underlying source code has been patched, and the disks information is now displayed correctly.

Bug Fix

BZ#888571

Prior to this update, ipset initiation script which would load the ipset rules was missing. Consequently, security problems at system initiation could occur. This update provides all the files necessary to add an ipset systemd service, which starts up before iptables and stops afterwards. As a result, ipset rules can be started, stopped, and saved as intended.

Bug Fixes

BZ#1059214

Previously, when alternative packages were removed manually, it was impossible to uninstall the iptables-ipv6 packages. The underlying source code has been patched, and iptables-ipv6 can now be uninstalled regardless of manually modified alternatives.

BZ#1070123

When upgrading the Red Hat Enterprise Linux 6.5 minimal installation to version 7.0 using the redhat-upgrade-tool utility, the "%postun" scriptlet of iptables-ipv6 failed. Blocks preventing the old package from uninstalling have been removed, and iptables-ipv6 can now be uninstalled successfully.

Enhancement

BZ#1033270

With this update, IPv6 support has been added to the ipset utility, and thus the user can now manage IPSets of IPv6 addresses.

Bug Fix

BZ#1099687

Previously, the ipvsadm tool did not handle printing of existing sync daemons correctly under certain circumstances. Consequently, the "ipvsadm --list --daemon" command did not report the existence of a backup sync daemon when only a backup sync daemon was running on a node. A patch has been applied to address this bug, and "ipvsadm --list --daemon" now correctly shows the backup sync daemon even if it is the only daemon running.

Bug Fixes

BZ#1039178

Previously, the irqbalance daemon did not consider the NUMA node assignment for an interrupt request (IRQ) for the banned CPU set. Consequently, irqbalance set the affinity incorrectly when the IRQBALANCE_BANNED_IRQS variable was set to a single CPU. In addition, IRQs could be assigned to a node that had no eligible CPUs. Node assignment has been restricted to nodes that have eligible CPUs as defined by the unbanned_cpus bitmask, thus fixing the bug. As a result, irqbalance now sets the affinity properly, and IRQs are assigned to the respective nodes correctly.

BZ#987801

Prior to this update, the dependency of the irqbalance daemon was set incorrectly referring to a wrong kernel version. As a consequence, irqbalance could not balance IRQs on NUMA systems. With this update, the dependency has been fixed, and IRQs are now balanced correctly on NUMA systems. Note that users of irqbalance packages have to update the kernel to 2.6.32-358.2.1 or later in order to use the irqbalance daemon in the correct manner.

BZ#1079109

Prior to this update, irqbalance could not accurately determine the NUMA node it was local to or the device to which an IRQ was sent. The kernel affinity_hint values were created to work around this issue. With this update, irqbalance is now capable of parsing all information about an IRQ provided by the sysfs() function. IRQ balancing now works correctly, and the affinity_hint values are now ignored by default not to distort the irqbalance functionality.

Bug Fixes

BZ#0009299, BZ#1052361

Due to changes in the addressing of inter-process communication (IPC) sockets, updating the isciadm administration utility caused it to be incompatible with the already-running iscsid processes. As a consequence, iscsiadm could no longer communicate with the running iscsid processes after the update. This update adds a retroactive compatibility IPC mode, which automatically triggers when a new IPC socket fails to connect. As a result, iscsiadm can now correctly be used to control pre-existing iscsid processes after an update.

BZ#1132490

Prior to this update, the uip_reset() function was in some cases called with an invalid ustack address. As a consequence, the iscsiuio process was terminated unexpectedly with a segmentation fault. With this update, the ustack address calling uip_reset() has been fixed and the described crash no longer occurs.

BZ#1076344

Prior to this update, the iscsid daemon could not handle more than 31 iSCSI asynchronous events. Consequently, when performing an iSCSI operation with 32 or more target protocol data units, iscsid entered an infinite loop and became unresponsive. With this update, iscsid can properly handle more than 31 iSCSI asynchronous events, and the described hang no longer occurs.

Bug Fixes

BZ#1112806

A bug previously caused the LineBreakMeasurer class to produce the ArrayIndexOutOfBoundsException error when Java attempted to display certain characters in certain fonts. This update fixes the bug and Java now displays the affected characters correctly.

BZ#1098399

Prior to this update, an application accessing an unsynchronized HashMap could potentially enter an infinite loop and consume an excessive amount of CPU resources. As a consequence, the OpenJDK server became unresponsive. This update prevents unsynchronized HashMap access from causing an infinite loop and as a result, the OpenJDK server no longer hangs in the described scenario.

Enhancement

BZ#1059925

Shared Java libraries have been modified to allow users to run Java with the cap_net_bind_service, cap_net_admin, and cap_net_raw capabilities granted.

Security Fixes

CVE-2014-6506, CVE-2014-6531, CVE-2014-6502, CVE-2014-6511, CVE-2014-6504, CVE-2014-6519

Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions.

CVE-2014-6517

It was discovered that the StAX XML parser in the JAXP component in OpenJDK performed expansion of external parameter entities even when external entity substitution was disabled. A remote attacker could use this flaw to perform XML eXternal Entity (XXE) attack against applications using the StAX parser to parse untrusted XML documents.

CVE-2014-6512

It was discovered that the DatagramSocket implementation in OpenJDK failed to perform source address checks for packets received on a connected socket. A remote attacker could use this flaw to have their packets processed as if they were received from the expected source.

CVE-2014-6457

It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication.

CVE-2014-6558

It was discovered that the CipherInputStream class implementation in OpenJDK did not properly handle certain exceptions. This could possibly allow an attacker to affect the integrity of an encrypted stream handled by this class.

Bug Fix

BZ#1148309

The TLS/SSL implementation in OpenJDK previously failed to handle Diffie-Hellman (DH) keys with more than 1024 bits. This caused client applications using JSSE to fail to establish TLS/SSL connections to servers using larger DH keys during the connection handshake. This update adds support for DH keys with size up to 2048 bits.

Bug Fixes

BZ#857002

Previously, the umbrello UML modeller used logic based on recursive calls. As a consequence if a user created a diagram that had dependency graph cycles, umbrello entered an infinite loop and terminated unexpectedly with a segmentation fault. With this update, the application logic has been changed to use stack-based parent resolution. As a result, umbrello no longer terminates in the described scenario.

BZ#908709

Prior to this update, the kompare utility hid underscore characters located at the bottom of a highlighted difference block when using certain fonts. This update fixes this bug. As a result, kompare correctly displays underscore characters in the described situation.

Bug Fixes

BZ#967641

Previously, the VRRP alert emails sent by the keepalived daemon did not contain the "to" header, which complicated filtering and sorting such messages by email software. With this update, keepalived has been modified to include the "to" header into email alerts as expected.

BZ#1007575

Previously, when keepalived compared the local primary IP address with another IP address, these two addresses had different byte-ordering. Consequently, multiple routers were created in a master state. With this update, the local primary IP address is converted to network byte order before the comparison, thus fixing this bug.

Security Fixes

CVE-2015-1805, Important

It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

CVE-2015-3331, Important

A buffer overflow flaw was found in the way the Linux kernel's Intel AES-NI instructions optimized version of the RFC4106 GCM mode decryption functionality handled fragmented packets. A remote attacker could use this flaw to crash, or potentially escalate their privileges on, a system over a connection with an active AES-GCM mode IPSec security association.

CVE-2014-9419, Low

An information leak flaw was found in the way the Linux kernel changed certain segment registers and thread-local storage (TLS) during a context switch. A local, unprivileged user could use this flaw to leak the user space TLS base address of an arbitrary process.

CVE-2014-9420, Low

It was found that the Linux kernel's ISO file system implementation did not correctly limit the traversal of Rock Ridge extension Continuation Entries (CE). An attacker with physical access to the system could use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service.

CVE-2014-9585, Low

An information leak flaw was found in the way the Linux kernel's Virtual Dynamic Shared Object (vDSO) implementation performed address randomization. A local, unprivileged user could use this flaw to leak kernel memory addresses to user-space.

Bug Fixes

BZ#1201674

When repeating a Coordinated Universal Time (UTC) value during a leap second (when the UTC time should be 23:59:60), the International Atomic Time (TAI) timescale previously stopped as the kernel NTP code incremented the TAI offset one second later than expected. A patch has been provided, which fixes the bug by incrementing the offset during the leap second itself. Now, the correct TAI is set during the leap second.

BZ#1204626

Due to a race condition, deleting a cgroup while pages belonging to that group were being swapped in could trigger a kernel crash. This update fixes the race condition, and deleting a cgroup is now safe even under heavy swapping.

BZ#1207815

Previously, the open() system call in some cases failed with an EBUSY error if the opened file was also being renamed at the same time. With this update, the kernel automatically retries open() when this failure occurs, and if the retry is not successful either, open() now fails with an ESTALE error.

BZ#1208620

Prior to this update, cgroup blocked new threads from joining the target thread group during cgroup migration, which led to a race condition against exec() and exit() functions, and a consequent kernel panic. This bug has been fixed by extending thread group locking such that it covers all operations which can alter the thread group - fork(), exit(), and exec(), and cgroup migration no longer causes the kernel to panic.

BZ#1211940

The hrtimer_start() function previously attempted to reinsert a timer which was already defined. As a consequence, the timer node pointed to itself and the rb_insert_color() function entered an infinite loop. This update prevents the hrtimer_enqueue_reprogram() function from racing and makes sure the timer state in remove_hrtimer() is preserved, thus fixing the bug.

BZ#1144442

Previously, the bridge device did not propagate VLAN information to its ports and Generic Receive Offload (GRO) information to the connected devices. This resulted in lower receive performance of VLANs over bridge devices because GRO was not enabled. An attempt to resolve this problem was made with BZ#858198 by introducing a patch that allows VLANs to be registered with the participating bridge ports and adds GRO to the bridge device feature set. However, this attempt introduced a number of regressions, which broke the vast majority of stacked setups involving bridge devices and VLANs. This update reverts the patch provided by BZ#858198 and removes support for this capability.

BZ#1199900

Previously, the kernel initialized FPU state for the signal handler too early, right after the current state was saved for the sigreturn() function. As a consequence, a task could lose its floating-point unit (FPU) context if the signal delivery failed. The fix ensures that the drop_init_fpu() fuction is only called when the signal is delivered successfully, and FPU context is no longer lost in the described situation.

BZ#1203366

On mounting a Common Internet File System (CIFS) share using kerberos authentication, the CIFS module uses the request_key mechanism to obtain the user's krb5 credentials. Once the key has been used and is no longer needed, CIFS revoked it. This caused key revoked errors to be returned when attempting to refetch the key. To fix this bug, the key_invalidate() call has been backported from the upstream code to discard the key. This call renders the discarded key invisible to further searches and wakes up the garbage collector immediately to remove the key from the keyrings and to destroy it. As a result, discarded keys are immediately cleared and are no longer returned on key searches.

BZ#1203544

Previously, the fc_remote_port_del() call preceded the calls to re-establish the session with the Fibre Channel (FC) transport with the fc_remote_port_add() and fc_remote_port_rolechg() functiones. With this update, the fc_remote_port_del() call has been removed before re-establishing the connection, which prevents the race condition from occurring.

BZ#1210593

Due to a race condition in the build_id_cache__add_s() function, system files could be truncated. This update fixes the race condition, and system files are no longer truncated in the aforementioned situation.

BZ#1212057

Prior to this update, the "--queue-balance" option did not distribute traffic over multiple queues as the option ignored a request to balance among the given range and only used the first queue number given. As a consequence, the kernel traffic was limited to one queue. The underlying source code has been patched, and the kernel traffic is now balanced within the given range.

Enhancements

BZ#1173501, BZ#1173562

This update introduces a set of patches with a new VLAN model to conform to upstream standards. In addition, this set of patches fixes other issues such as transmision of Internet Control Message Protocol (ICMP) fragments.

Security Fixes

CVE-2014-3215, Important

A flaw was found in the way seunshare, a utility for running executables under a different security context, used the capng_lock functionality of the libcap-ng library. The subsequent invocation of suid root binaries that relied on the fact that the setuid() system call, among others, also sets the saved set-user-ID when dropping the binaries' process privileges, could allow a local, unprivileged user to potentially escalate their privileges on the system. Note: the fix for this issue is the kernel part of the overall fix, and introduces the PR_SET_NO_NEW_PRIVS functionality and the related SELinux exec transitions support.

CVE-2015-1421, Important

A use-after-free flaw was found in the way the Linux kernel's SCTP implementation handled authentication key reference counting during INIT collisions. A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system.

CVE-2014-3690, Moderate

It was found that the Linux kernel's KVM implementation did not ensure that the host CR4 control register value remained unchanged across VM entries on the same virtual CPU. A local, unprivileged user could use this flaw to cause a denial of service on the system.

CVE-2014-7825, Moderate

An out-of-bounds memory access flaw was found in the syscall tracing functionality of the Linux kernel's perf subsystem. A local, unprivileged user could use this flaw to crash the system.

CVE-2014-7826, Moderate

An out-of-bounds memory access flaw was found in the syscall tracing functionality of the Linux kernel's ftrace subsystem. On a system with ftrace syscall tracing enabled, a local, unprivileged user could use this flaw to crash the system, or escalate their privileges.

CVE-2014-8171, Moderate

It was found that the Linux kernel memory resource controller's (memcg) handling of OOM (out of memory) conditions could lead to deadlocks. An attacker able to continuously spawn new processes within a single memory-constrained cgroup during an OOM event could use this flaw to lock up the system.

CVE-2014-9529, Moderate

A race condition flaw was found in the way the Linux kernel keys management subsystem performed key garbage collection. A local attacker could attempt accessing a key while it was being garbage collected, which would cause the system to crash.

CVE-2014-8884, Low

A stack-based buffer overflow flaw was found in the TechnoTrend/Hauppauge DEC USB device driver. A local user with write access to the corresponding device could use this flaw to crash the kernel or, potentially, elevate their privileges on the system.

CVE-2014-9584, Low

An information leak flaw was found in the way the Linux kernel's ISO9660 file system implementation accessed data on an ISO9660 image with RockRidge Extension Reference (ER) records. An attacker with physical access to the system could use this flaw to disclose up to 255 bytes of kernel memory.

Bug Fixes

BZ#1195747

Due to a regression, when large reads which partially extended beyond the end of the underlying device were done, the raw driver returned the EIO error code instead of returning a short read covering the valid part of the device. The underlying source code has been patched, and the raw driver now returns a short read for the remainder of the device.

BZ#1187639

Previously, a NULL pointer check that is needed to prevent an oops in the nfs_async_inode_return_delegation() function was removed. As a consequence, a NFS4 client could terminate unexpectedly. The missing NULL pointer check has been added back, and NFS4 client no longer crashes in this situation.

BZ#1187666

A failure to leave a multicast group which had previously been joined prevented the attempt to unregister from the "sa" service. Multiple locking issues in the IPoIB multicast join and leave processing have been fixed so that leaving a group that has completed its join process is successful. As a result, attempts to unregister from the "sa" service no longer lock up due to leaked resources.

BZ#1187664

Due to unbalanced multicast join and leave processing, the attempt to leave a multicast group that had not previously completed a join became unresponsive. This update resolves multiple locking issues in the IPoIB multicast code that allowed multicast groups to be left before the joining was entirely completed. Now, multicast join and leave failures or lockups no longer occur in the described situation.

BZ#1188339

The kernel source code contained two definitions of the cpu_logical_map() function, which maps logical CPU numbers to physical CPU addresses. When translating the logical CPU number to the corresponding physical CPU number, the kernel used the second definition of cpu_logical_map(), which always used a one-to-one mapping of logical to physical CPU addresses. This mapping was, however, wrong after a reboot, especially if the target CPU was in the "stopped" state. Consequently, the system became unresponsive or showed unexpected latencies. With this update, the second definition of cpu_logical_map() has been removed. As a result, the kernel now correctly translates the CPU number to its physical address, and no unexpected latencies occur in this scenario.

BZ#1188838

Previously, the kernel could under certain circumstances provide the tcp_collapse() function with a socket buffer (SKB) whose "headroom" was equal to the value of the PAGE_SIZE variable. Consequently, the copy value was zero in the loop, which could never exit because it was not making forward progress. To fix this problem, the loop has been rewritten to avoid the incorrect calculation. Instead, the loop copies either the value of the PAGE_SIZE variable or the size of the buffer, whichever is bigger. As a result, the tcp_collapse() function is no longer apt to get stuck in the loop, because the copy is always non-zero as long as long as the "end" differs from the "start".

BZ#1188941

Prior to this update, when using the fibre channel driver, a race condition occurred in the rport scsi_remove_target() function. As a consequence, the kernel terminated unexpectedly when dereferencing an invalid address. To fix this bug, the changes to the reference counting infrastructure have been reverted, and the system no longer crashes.

BZ#1191916

On older systems without the QCI instruction, all possible domains are probed via TAPQ instruction. Prior to this update, a specification exception could occur when this instruction was called for probing values greater than 16; for example, during the execution of the "insmod" command or the reset of the AP bus on machines without the QCI instruction (z10, z196, z114). zEC12 and newer systems were not affected. Consequently, loading the z90crypt kernel module caused a panic. Now, the domain checking function has been corrected to limit the allowed range if no QCI information is available. As a result, users are able to successfully load and perform cryptographic functions with the z90crypt device driver.

BZ#1192055

Previously, KVM took a page fault with interrupts disabled. Consequently, the page fault handler tried to take a lock, but KSM sent an IPI while taking the same lock. Then KSM waited for the IPI to be processed, but KVM would not process it until it took the lock. KSM and KVM would eventually encounter a deadlock, each waiting for the other. With this update, the kernel avoids operations that can page fault while interrupts are disabled. As a result, KVM and KSM are no longer prone to a deadlock in the aforementioned scenario.

BZ#1192105

The USB core uses the "hcpriv" member of the USB request block to determine whether a USB Request Block (URB) is active, but the ehci-hcd driver was not setting this correctly when it queued isochronous URBs. This in combination with a defect in the snd-usb-audio driver could cause URBs to be reused without waiting for them to complete. Consequently, list corruption followed by system freeze or a kernel crash occurred. To fix this problem, the ehci-hcd driver code has been updated to properly set the "hcpriv" variable for isochronous URBs, and the snd-usb-audio driver has been updated to synchronize pending stop operations on an endpoint before continuing with preparing the PCM stream. As a result, list corruption followed by system freeze or a crash no longer occurs.

BZ#1193639

Previously, the Hewlett Packard Smart Array (HPSA) driver in conjunction with an older version of the HPSA firmware and the hp-snmp-agent monitoring software used the "system work queue" shared resource for an extensively long time. Consequently, random other tasks were blocked until the HPSA driver released the work queue, and messages such as the following were logged:

INFO: task sshd:6425 blocked for more than 120 seconds.
INFO: task ptymonitor:22510 blocked for more than 120 seconds.

With this update, the HPSA driver creates its own local work queue, which fixes this problem.

BZ#1198329

Prior to this update, the GFS2 file system's "Splice Read" operation, which is used for functions such as sendfile(), was not properly allocating a required multi-block reservation structure in memory. As a consequence, when the GFS2 block allocator was called to assign blocks of data, it tried to dereference the structure, which resulted in a kernel panic. Now, GFS2's "Splice read" operation has been changed so that it properly allocates the necessary reservation structure in memory prior to calling the block allocator. As a result, sendfile() now works properly for GFS2.

Security Fixes

CVE-2014-7841, Important

A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system.

CVE-2014-4656, Moderate

An integer overflow flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use this flaw to crash the system.

Bug Fixes

BZ#1161420

LVM2 thin provisioning is sensitive to I/Os within a full RAID stripe is issued to the controller's write-back cache in close proximity. This update improves LVM2 thin provisioning to work more efficiently on RAID devices.

BZ#1161421

Previously, under a heavy I/O load, a timeout of an unresponsive task could occur while using LVM2 thin provisioning. With this update, various infrastructure used by LVM2 thin provisioning have been improved to be more efficient and correct. This includes the use of more efficient data structures, throttling worker threads to prevent an application from sending more I/O than can be handled, and pre-fetching metadata. This update also fixes the eviction logic used by the metadata I/O buffering layer, which ensures that metadata blocks are not evicted prematurely.

BZ#1162072

Due to a malfunction in the USB controller driver, some data stream metadata was dropped. As a consequence, the integrated camera to failed to record with the following error message:

libv4l2: error turning on stream: No space left on device

This update fixes the data stream metadata handling, and the integrated camera works as expected.

BZ#1165986

Before this update, a race condition occurred in the spin-lock logic on the PowerPC platform. Consequently, workloads caused heavy use of Inter-Process Communication (IPC), and the kernel could terminate unexpectedly. This update adds proper synchronization to the PowerPC spin-lock framework. As a result, the kernel no longer crashes under heavy use of IPC.

BZ#1163214

Due to an overlooked piece of code that initializes the pre-operation change attribute, certain workloads could generate unnecessary cache invalidations and additional NFS read operations. This update fixes the initialization of the pre_change_attr field, which prevents unnecessarily cached data invalidation.

BZ#1165001

Previously, under certain error conditions gfs2_converter introduced incorrect values for the on-disk inode's di_goal_meta field. As a consequence, gfs2_converter returned the EBADSLT error on such inodes and did not allow creation of the new files in directories or new blocks in regular files. The fix allows gfs2_converter to set a sensible goal value if a corrupt one is encountered and proceed with normal operations. With this update, gfs2_converter implicitly fixes any corrupt goal values, and thus no longer disrupts normal operations.

BZ#1165002

Previously, under certain error conditions using the semaphore utility caused the kernel to become unresponsive. With update a patch has been applied to fix this bug. As a result, the the kernel hangs no longer occur while using semaphore.

BZ#1165985

Before this update, due to a coding error in the e100 Ethernet driver update, physical layers (PHYs) did not initialize correctly. This could cause RX errors and decreased throughput, especially when using long UTP cabling. This update fixes the coding error, and as a result, the aforementioned scenario no longer occurs on the e100 Ethernet device.

BZ#1168129

Before this update, a flaw in the duplicate reply cache in the NFS daemon allowed entries to be freed while they were still used. Consequently, a heavily loaded NFS daemon could terminate unexpectedly if an RPC call took a long time to process. The cache has been fixed to protect such entries from freeing, and the server now functions normally in the aforementioned scenario.

BZ#1168504

Previously, external journal blocks were handled as blocks causing an increase of processor usage. Consequently, on the ext4 file systems configured with an external journal device, the df command could show negative values due to the subtraction of such journal blocks amount from the used blocks amount. With this update, the external journal blocks are handled properly, and therefore df no longer returns negative values.

BZ#1169433

Before this update, raising the SIGBUS signal did not include a siginfo structure describing the cause of the SIGBUS exception. As a consequence, applications that use huge pages using the libhugetlbfs library failed. The PACKAGE_NAME has been updated to raise SIGBUS with a siginfo structure, to deliver BUS_ADRERR as si_code, and to deliver the address of the fault in the si_addr field. As a result, applications that use huge pages no longer fail in the aforementioned scenario.

BZ#1172022

Previously, accessing a FUSE-based file system from kernel space could cause the kernel to become unresponsive during an inode look-up operation. To fix this bug, existing flags are verified before dereference occurs in the FUSE look-up handler. As a result, accessing a FUSE-based file system from kernel space works as expected.

BZ#1172024

Previously, hot plugging of a USB EHCI controller could cause the kernel to become unresponsive. This update fixes the handling of a race condition in the EHCI error path during the hot-plugging event, and the kernel no longer hangs.

BZ#1172025

Previously, the system functions semop() and semtimedop() did not update the time of the semaphore update located in the structure sem_otime, which was inconsistent with the function description in the man pages. With this update, a patch has been applied to fix this bug. As a result, semop() and semtimedop() now properly update the sem_otime structure.

BZ#1172027

Before this update, when forwarding a packet, the iptables target TCPOPTSTRIP used the tcp_hdr() function to locate the option space. Consequently, TCPOPTSTRIP located the incorrect place in the packet, and therefore did not match options for stripping. With this update, TCPOPTSTRIP now uses the TCP header itself to locate the option space. As a result, the options are now properly stripped.

BZ#1172764

Prior to this update, the ipset utility computed incorrect values of timeouts from an old IP set, and these values were then supplied to a IP new set. As a consequence, a resize on a IP set with a timeouts option enabled could supply corrupted data from an old IP set. This bug has been fixed by properly reading timeout values from an old set before supplying them to a new set.

BZ#1172029

Previously, under certain conditions, a race condition between the semaphore creation code and the semop() function caused the kernel to become unresponsive. With this update, a patch has been applied, and the kernel hangs no longer occur.

BZ#1172030

Prior to this update, a NULL pointer dereference could occur when then usb_wwan device driver was performing a disconnect operation. The usb_wwan disconnect procedure has been replaced with the port_remove procedure and, as a result, the kernel no longer hangs when removing a WWAN USB device.

BZ#1175509

The usage of PCLMULQDQ instruction required the invocation of the kernel_fpu_begin() and kernel_fpu_end() functions. Consequently, the usage of the PCLMULQDQ instruction for the CRC32C checksum calculation incurred some increase of processor usage. With this update, a new function has been added in order to calculate the CRC32C checksum using the PCLMULQDQ instruction on processors that support this feature, which provides speedup over using the CRC32 instruction only.

Security Fixes

CVE-2014-5077, Important

A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system.

CVE-2013-2596, Important

An integer overflow flaw was found in the way the Linux kernel's Frame Buffer device implementation mapped kernel memory to user space via the mmap syscall. A local user able to access a frame buffer device file (/dev/fb*) could possibly use this flaw to escalate their privileges on the system.

CVE-2013-4483, Moderate

A flaw was found in the way the ipc_rcu_putref() function in the Linux kernel's IPC implementation handled reference counter decrementing. A local, unprivileged user could use this flaw to trigger an Out of Memory (OOM) condition and, potentially, crash the system.

CVE-2014-0181, Moderate

It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. A local, unprivileged user could potentially bypass these restrictions by passing a netlink socket as stdout or stderr to a more privileged process and altering the output of this process.

CVE-2014-3122, Moderate

It was found that the try_to_unmap_cluster() function in the Linux kernel's Memory Managment subsystem did not properly handle page locking in certain cases, which could potentially trigger the BUG_ON() macro in the mlock_vma_page() function. A local, unprivileged user could use this flaw to crash the system.

CVE-2014-3601, Moderate

A flaw was found in the way the Linux kernel's kvm_iommu_map_pages() function handled IOMMU mapping failures. A privileged user in a guest with an assigned host device could use this flaw to crash the host.

CVE-2014-4653, CVE-2014-4654, CVE-2014-4655, Moderate

Multiple use-after-free flaws were found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use either of these flaws to crash the system.

CVE-2014-5045, Moderate

A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation.

CVE-2014-4608, Low

An integer overflow flaw was found in the way the lzo1x_decompress_safe() function of the Linux kernel's LZO implementation processed Literal Runs. A local attacker could, in extremely rare cases, use this flaw to crash the system or, potentially, escalate their privileges on the system.