# changelog

author: Stephen Herr <sherr@redhat.com> 2.0.1-5
changelog:
- Related: #1115516 - don't encode proxy url if not set (mzazrivec@redhat.com)
- Related: #1115516 - encode proxy url when passing it to urlgrabber
  (mzazrivec@redhat.com)
- Resolves: #1115516 - correctly initialize proxy settings for URLGrabber
  (mzazrivec@redhat.com)


author: Tomas Kasparek <tkasparek@redhat.com> 2.0.1-7
changelog:
- Resolves: #1423007 - request failed: error reading the headers
  (CVE-2016-8743) (pstudeni@redhat.com)


author: Gennadii Altukhov <galt@redhat.com> 2.0.1-8
changelog:
- Resolves: #1398406 - update repo options from rhnplugin.conf even in
  cacheonly mode (michael.mraka@redhat.com)
- Resolves: #1391867 - pass retry_no_cache option to urlgrabber
  (michael.mraka@redhat.com)
- Resolves: #1361185 - use yum's lock to prevent concurent yum & rhn_check
  actions (michael.mraka@redhat.com)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-30
changelog:
- fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
- fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
- fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
- avoid crash when copying empty hash table (CVE-2018-7549)
- fix buffer overrun in xsymlinks (CVE-2017-18206)
- fix NULL dereference in cd (CVE-2017-18205)
- fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
- fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-34
changelog:
- make the chaselinks option work again (#1729997)
- fix off-by-one error in buffer allocation to avoid stack smashing (#1722486)


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-9
changelog:
- Fix covscan warning
- "Variable "file" going out of scope leaks the storage it points to."
  has been introduced by the original version of 0001-fix-CVE-2018-7725.patch
- Related: 1558596


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-11
changelog:
- Fix CVE-2018-6541
- Part of the original patch has already been applied in the past (CVE-2018-7726),
  so the bug should not be reproducible in a way described in the github 
  issue, even without this commit. Applying the rest of the original patch anyway.
- https://github.com/gdraheim/zziplib/issues/16
- Related: CVE-2018-6541


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-12
changelog:
- Fix a directory traversal bug
- unzip-mem should now strip all "../" prefixes from the archived files
- Resolves: CVE-2018-17828


