# changelog

author: Remi Collet <rcollet@redhat.com> - 1.3.0-1
changelog:
  - release 1.3.0 (beta)
  - use system json-c when available (fedora >= 20)
  - use jsonc name for module and configuration


author: Ben Harper <ben.harper@rackspace.com> - 5.4.23-1.ius
changelog:
  - Latest sources from upstream
  - Source9, Source10 and Patch52 removed as cve-2013-6420 patched upstream


author: Mark McKinstry <mmckinst@nexcess.net> - 5.4.24-2.ius
changelog:
  - update php.ini
  - take out all the Provides/Requires stuff for the yum replace plugin
  - add scl stuff (using Red Hat's php54 spec as a guide)
  - update init script


author: Mark McKinstry <mmckinst@nexcess.net> - 5.4.28-2.ius
changelog:
  - upgrade to 5.4.28
  - update php-fpm-www.conf to listen on 127.0.0.1:9054 so it doesn't conflict
    with default one from Red Hat


author: Remi Collet <remi@remirepo.net> 5.4.45-5
changelog:
  - Fix #71498: Out-of-Bound Read in phar_parse_zipfile()
  - Fix #71587: Use-After-Free / Double-Free in WDDX Deserialize


author: Remi Collet <remi@fedoraproject.org> 5.4.45-7
changelog:
  - Fix #71860: Require valid paths for phar filenames
    CVE-2016-4072
  - Fix #71906: AddressSanitizer: negative-size-param in mbfl_strcut
    CVE-2016-4073
  - Fix #71798: Integer Overflow in php_raw_url_encode
    CVE-2016-4070
  - Fix #71704: php_snmp_error() Format String Vulnerability
    CVE-2016-4071
  - Fix #71527: Buffer over-write in finfo_open with malformed magic file
    CVE-2015-8865


author: Remi Collet <remi@fedoraproject.org> 5.4.45-8
changelog:
  - Fix #64938: libxml_disable_entity_loader setting is shared between threads
    CVE-2015-8866
  - Fix #71912: libgd signedness vulnerability
    CVE-2016-3074
  - Fix #72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset
    CVE-2016-4540 CVE-2016-4541
  - Fix #72093: bcpowmod accepts negative scale and corrupts _one_ definition
    CVE-2016-4537 CVE-2016-4538
  - Fix #72094: Out of bounds heap read access in exif header processing
    CVE-2016-4542 CVE-2016-4543 CVE-2016-4544
  - Fix #72099: xml_parse_into_struct segmentation fault
    CVE-2016-4539


author: Remi Collet <remi@fedoraproject.org> 5.4.45-9
changelog:
  - Fix #71331: Uninitialized pointer in phar_make_dirstream
    CVE-2016-4343
  - Fix #72114: int/size_t confusion in fread
    CVE-2016-5096
  - Add check for string overflow to all string add operations
  - Fix #72135: don't create strings with lengths outside int range
    CVE-2016-5094
  - Fix #72241: get_icu_value_internal out-of-bounds read
    CVE-2016-5093


author: Remi Collet <remi@fedoraproject.org> 5.4.45-10
changelog:
  - Fix #66387: Stack overflow with imagefilltoborder
  - Fix #72340: Double Free Courruption in wddx_deserialize
    CVE-2016-5772
  - Fix #72275: don't allow smart_str to overflow int
  - Fix #72400: prevent signed int overflows for string lengths
  - Fix #72403: prevent signed int overflows for string lengths
  - Fix #72268: Integer Overflow in nl2br(). (Stas)
  - Fix #72339: Integer Overflow in _gd2GetHeader() resulting in heap overflow
    CVE-2016-5766
  - Fix #72298: pass2_no_dither out-of-bounds access
  - Fix #72402: _php_mb_regex_ereg_replace_exec - double free
    CVE-2016-5768
  - Fix #72433: SPL use After Free Vulnerability in PHP's GC
    CVE-2016-5771
  - Fix #72434: ZipArchive class use After Free Vulnerability in PHP's GC
    CVE-2016-5773
  - Fix #72455: Heap Overflow due to integer overflows
    CVE-2016-5769
  - Fix #72446: Integer Overflow in gdImagePaletteToTrueColor()
    CVE-2016-5767


author: Remi Collet <remi@fedoraproject.org> 5.4.45-11
changelog:
  - Fix #70480: php_url_parse_ex() buffer overflow read
    CVE-2016-6288
  - Fix #69975: PHP segfaults when accessing nvarchar(max) defined columns
  - Fix #72479: Use After Free Vulnerability in SNMP with GC and unserialize()
    CVE-2016-6295
  - Fix #72573: HTTP_PROXY is improperly trusted by some PHP libraries
    CVE-2016-5385
  - Fix #72513: buffer overflow vulnerability in virtual_file_ex
    CVE-2016-6289
  - Fix #72520: buffer overflow vulnerability in php_stream_zip_opener
    CVE-2016-6297
  - Fix #72533: locale_accept_from_http out-of-bounds access
    CVE-2016-6294
  - Fix #72562: Use After Free in unserialize() with Unexpected Session
    Deserialization CVE-2016-6290
  - Fix #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
    CVE-2016-6291
  - Fix #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
    CVE-2016-6296
  - Partial fix #72613: do not treat negative returns from bz2 as size_t
  - Fix #72618: NULL Pointer Dereference in exif_process_user_comment
    CVE-2016-6292
  - Fix #72519: possible OOB using imagegif


author: Remi Collet <remi@fedoraproject.org> 5.4.45-12
changelog:
  - fix #72627: Memory Leakage In exif_process_IFD_in_TIFF
    CVE-2016-7128
  - fix #72926: Uninitialized Thumbail Data Leads To Memory Leakage
    in exif_process_IFD_in_TIFF
  - fix #73035: Out of bound when verify signature of tar phar
  - fix #72928: Out of bound when verify signature of zip phar
    CVE-2016-7414
  - fix #72735 regression in exif maker note parser


author: Tim College <tcollege@interworx.com> - 5.4.28-1
changelog:
  - Rename to php54iw
  - Added .iworx to the release name
  - Changed naming to use php version
  - Changed to pversion and bversion variables


author: Jeffrey Ness <jeffrey.ness@rackspace.com> - 3.1.14-1.ius
changelog:
  - Latest Beta sources, not yet a Stable branch with PHP 5.4 support.
    https://bugs.launchpad.net/ius/+bug/1098124


author: BJ Dierkes <wdierkes@rackspace.com> - 3.0.1-1.ius
changelog:
  - Latest sources from upstream.  Full changelog available at:
    http://pecl.php.net/package-changelog.php?package=imagick&release=3.0.1
  - Renaming package as php53u-pecl-imagick, Resolves LP#691755
  - Rebuild against php53u-5.3.4
  - BuildRequires: php53u-cli


author: Dustin Henry Offutt <dustin.offutt@rackspace.com> 3.1.0-RC1.1.ius
changelog:
  - Building for php54 and imagick 3.1.0RC1
  - Add define rc_version, add rc_version to Release definition, Source0 path, BuildRoot path, and setup line


author: Ben Harper <ben.harper@rackspace.com> - 0:3.0.7.ius
changelog:
  - Latest sources from upstream. Full changelog available at:
    http://pecl.php.net/package-changelog.php?package=memcache&release=3.0.7


author: Ben Harper <ben.harper@rackspace.com> - 0:3.0.8-1.ius
changelog:
  - Latest sources from upstream. Full changelog available at:
    http://pecl.php.net/package-changelog.php?package=memcache&release=3.0.8


author: Remi Collet <rcollet@redhat.com> 1:1.9.4-5
changelog:
  - update Archive_Tar to 1.3.11
  - add explicit requires on all needed extensions (phpci)
  - fix pecl launcher (need ini to be parsed for some
    extensions going to be build as shared, mainly simplexml)
  - move metadata to /var/lib/pear
  - own %{_localstatedir}/www (#956529)
  - update config only if needed in %post
  - remove %config flag for macros.pear


author: Paul Oehler <poehler@interworx.com>
changelog:
  - Set Epoch to 3, to combat incompatible updates from 3rd party repos.
  - Added port 24 to default open ports, as sftp will be there by default.


author: Remi Collet <rcollet@redhat.com> 1.0-1
changelog:
  - initial packaging from php55 from rhscl 1.1
  - install macro in /usr/lib/rpm/macros.d
  - each package requires runtime (for license)


author: Remi Collet <remi@fedoraproject.org> 2.0-4
changelog:
  - static environement module file instead of
    generated one, because of https://bugzilla.redhat.com/1197321


author: Remi Collet <remi@fedoraproject.org> 1:1.10.1-3
changelog:
  - use file triggers for pecl extensions (un)registration
  - define %pecl_install and %pecl_uninstall as noop macro


author: Remi Collet <remi@fedoraproject.org> 1:1.10.1-7
changelog:
  - fix https connection via a proxy
    patch from https://github.com/pear/pear-core/pull/51
  - silent the new scriplets (F24+)


