<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="27">
<package pkgid="9bf4a647b9068458ef770bafb8d3d3178b69957df9b9cd973a993bd1c556feb3" name="fibpp" arch="src">
  <version epoch="0" ver="0.9.12" rel="150600.7.2"/>
  <changelog author="mike@mk-sys.cz" date="1253793600">- build dependency on firebird-devel
- devel subpackage
- ldconfig after uninstall</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265600">- update to version 0.9.12
  * nothing really important, mostly to avoid conflicts with older
    pre-git (and pre-OBS) versions running around
- moved to OBS
- specfile cleanup
- add baselibs.conf</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265601">- add Group tag to libfibpp "subpackage"</changelog>
  <changelog author="mike@mk-sys.cz" date="1352635200">- create-and-install-fibpp.pc-for-pkg-config.patch:
  install pkg-config file</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- fix libfbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- specfile cleanup (drop SLE11 tweaks)
- drop static library</changelog>
</package>
<package pkgid="a4bcc5538205d18725997c357082318bab559cf43929cb506613ba7ba4f2e647" name="fibpp-debugsource" arch="x86_64">
  <version epoch="0" ver="0.9.12" rel="150600.7.2"/>
  <changelog author="mike@mk-sys.cz" date="1253793600">- build dependency on firebird-devel
- devel subpackage
- ldconfig after uninstall</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265600">- update to version 0.9.12
  * nothing really important, mostly to avoid conflicts with older
    pre-git (and pre-OBS) versions running around
- moved to OBS
- specfile cleanup
- add baselibs.conf</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265601">- add Group tag to libfibpp "subpackage"</changelog>
  <changelog author="mike@mk-sys.cz" date="1352635200">- create-and-install-fibpp.pc-for-pkg-config.patch:
  install pkg-config file</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- fix libfbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- specfile cleanup (drop SLE11 tweaks)
- drop static library</changelog>
</package>
<package pkgid="7a78040fc0bc4e5c117f6997b6968446f1909dd4a2a1fbdf2b8daa041025cf4c" name="fibpp-devel" arch="x86_64">
  <version epoch="0" ver="0.9.12" rel="150600.7.2"/>
  <changelog author="mike@mk-sys.cz" date="1253793600">- build dependency on firebird-devel
- devel subpackage
- ldconfig after uninstall</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265600">- update to version 0.9.12
  * nothing really important, mostly to avoid conflicts with older
    pre-git (and pre-OBS) versions running around
- moved to OBS
- specfile cleanup
- add baselibs.conf</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265601">- add Group tag to libfibpp "subpackage"</changelog>
  <changelog author="mike@mk-sys.cz" date="1352635200">- create-and-install-fibpp.pc-for-pkg-config.patch:
  install pkg-config file</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- fix libfbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- specfile cleanup (drop SLE11 tweaks)
- drop static library</changelog>
</package>
<package pkgid="03c3e26db6b84c23d21389857be12b3343c4754e80ca1c15bab6919110c5a8fe" name="httpd24" arch="src">
  <version epoch="0" ver="2.4.63" rel="150600.2.2"/>
  <changelog author="mike@mk-sys.cz" date="1330344000">- initial 2.4 package forked from 2.2 sources</changelog>
  <changelog author="mike@mk-sys.cz" date="1332072000">- build as PIE to silence rpmlint/brp</changelog>
  <changelog author="mike@mk-sys.cz" date="1334664000">- update to version 2.4.2
  * envvars: Fix insecure handling of LD_LIBRARY_PATH that could
    lead to the current working directory to be searched for DSOs
  * Various bugfixes</changelog>
  <changelog author="mike@mk-sys.cz" date="1347624000">- update to version 2.4.3
  * mod_proxy_ajp, mod_proxy_http: Fix an issue in back end
    connection closing which could lead to privacy issues due
    to a response mixup. PR 53727. (CVE-2012-3502)
  * mod_negotiation: Escape filenames in variant list to prevent a
    possible XSS for a site where untrusted users can upload files
    to a location with MultiViews enabled. (CVE-2012-2687)
- httpd-2.4.3-layout.patch: refresh</changelog>
  <changelog author="mike@mk-sys.cz" date="1363608000">- update to version 2.4.4
  * various XSS flaws due to unescaped hostnames and URIs HTML
    output in mod_info, mod_status, mod_imagemap, mod_ldap, and
    mod_proxy_ftp
    (CVE-2012-3499)
  * a XSS flaw affected the mod_proxy_balancer manager interface
    (CVE-2012-4558)</changelog>
  <changelog author="mike@mk-sys.cz" date="1371902400">- add zlib-devel and openssl-devel to BuildRequires to fix build
  in Factory</changelog>
  <changelog author="mike@mk-sys.cz" date="1395576000">- update to version 2.4.9
  * mod_session_dbd: Make sure that dirty flag is respected when
    saving sessions, and ensure the session ID is changed each time
    the session changes. This changes the format of the
    updatesession SQL statement.  Existing configurations must be
    changed.
    (CVE-2013-2249)
  * mod_dav: Sending a MERGE request against a URI handled by
    mod_dav_svn with the source href (sent as part of the request
    body as XML) pointing to a URI that is not configured for DAV
    will trigger a segfault.
    (CVE-2013-1896)
  * mod_dav: Keep track of length of cdata properly when removing
    leading spaces. Eliminates a potential denial of service from
    specifically crafted DAV WRITE requests
    (CVE-2013-6438)
  * Clean up cookie logging with fewer redundant string parsing
    passes.  Log only cookies with a value assignment. Prevents
    segfaults when logging truncated cookies.
    (CVE-2014-0098)
  * APR 1.5.0 or later is now required for the event MPM.</changelog>
  <changelog author="mike@mk-sys.cz" date="1409832000">- update to version 2.4.10
  * mod_proxy: Fix crash in Connection header handling which
    allowed a denial of service attack against a reverse proxy
    with a threaded MPM.
    (CVE-2014-0117)
  * Fix a race condition in scoreboard handling, which could lead to
    a heap buffer overflow.
    (CVE-2014-0226)
  * mod_deflate: The DEFLATE input filter (inflates request bodies)
    now limits the length and compression ratio of inflated request
    bodies to avoid denial of sevice via highly compressed bodies.
    (CVE-2014-0118)
  * mod_cgid: Fix a denial of service against CGI scripts that do
    not consume stdin that could lead to lingering HTTPD child
    processes filling up the scoreboard and eventually hanging the
    server.
    (CVE-2014-0231)</changelog>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 2.4.16
  * mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
    with response headers' size above 8K (CVE-2014-3583)
  * mod_cache: Avoid a crash when Content-Type has an empty value
    (CVE-2014-3581)
  * mod_lua: Fix handling of the Require line when a
    LuaAuthzProvider is used in multiple Require directives with
    different arguments (CVE-2014-8109)
  * core: HTTP trailers could be used to replace HTTP headers late
    during request processing, potentially undoing or otherwise
    confusing modules that examined or modified request headers
    earlier.  Adds "MergeTrailers" directive to restore legacy
    behavior. (CVE-2013-5704)
  * mod_ssl: New directive SSLSessionTickets (On|Off)
  * core: Fix a crash with ErrorDocument 400 pointing to a local
    URL-path qith the INCLUDES filter active, introduced in 2.4.11
    (CVE-2015-0253)
  * mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash
    (CVE-2015-0228)
  * core: Fix chunk header parsing defect (CVE-2015-3183)
  * Replacement of ap_some_auth_required (unusable in Apache httpd
    2.4) with new ap_some_authn_required and ap_force_authn hook
    (CVE-2015-3185)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 2.4.18
  * mod_http2: added donated HTTP/2 implementation via core module;
    similar configuration options to mod_ssl
  * mod_ssl: enable support for configuring the SUITEB* cipher
    strings introduced in OpenSSL 1.0.2
  * MPMs: support SO_REUSEPORT to create multiple duplicated
    listener records for scalability</changelog>
  <changelog author="mike@mk-sys.cz" date="1467374400">- update to version 2.4.20
  * mod_log_config: Add GlobalLog to allow a globally defined log
    to be inherited by virtual hosts that define a CustomLog
  * mod_httpd2: lot of fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 2.4.23
  * mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck
    directive to opt-in previous behaviour (2.2) with CRLs
    verification when checking certificate(s) with no corresponding
    CRL.
  * mod_ssl: reset client-verify state of ssl when aborting
    renegotiations
  * mod_httpd2: lot of fixes
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1489492800">- update to version 2.4.25
  * mod_http2: mitigate DoS memory exhaustion via endless
    CONTINUATION frames
  * core: mitigate [f]cgi "httpoxy" issues (CVE-2016-5387)
  * mod_auth_digest: prevent segfaults during client entry
    allocation when the shared memory space is exhausted
    (CVE-2016-2161)
  * mod_session_crypto: authenticate the session data/cookie with a
    MAC (SipHash) to prevent deciphering or tampering with a
    padding oracle attack
  * enforce HTTP request grammar corresponding to RFC7230 for
    request lines and request headers, to prevent response
    splitting and cache pollution by malicious clients or
    downstream proxies (CVE-2016-8743)
  * validate HTTP response header grammar defined by RFC7230,
    resulting in a 500 error in the event that invalid response
    header contents are detected when serving the response, to
    avoid response splitting and cache pollution by malicious
    clients, upstream servers or faulty modules
  * core: new directive HttpProtocolOptions to control httpd
    enforcement of various RFC7230 requirements
  * mod_http2: new directive 'H2PushResource' to enable early
    pushes before processing of the main request starts
  * mod_proxy_http2: adding support for newly proposed 103 status
    code
- add explicit insserv prerequisities</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 2.4.29
  * mod_mime can read one byte past the end of a buffer when
    sending a malicious Content-Type response header
    (CVE-2017-7679)
  * bug in token list parsing, which allows ap_find_token() to
    search past the end of its input string (CVE-2017-7668)
  * a maliciously constructed HTTP/2 request could cause mod_http2
    to dereference a NULL pointer and crash the server process
    (CVE-2017-7659)
  * mod_ssl may dereference a NULL pointer when third-party modules
    call ap_hook_process_connection() during an HTTP request to an
    HTTPS port (CVE-2017-3169)
  * use of the ap_get_basic_auth_pw() by third-party modules
    outside of the authentication phase may lead to authentication
    requirements being bypassed (CVE-2017-3167)
  * mod_http2: read after free; when under stress, closing many
    connections, the HTTP/2 handling code would sometimes access
    memory after it has been freed, resulting in potentially
    erratic behaviour (CVE-2017-9789)
  * mod_auth_digest: Uninitialized memory reflection.  The value
    placeholder in [Proxy-]Authorization headers type 'Digest' was
    not initialized or reset before or between successive key=value
    assignments (CVE-2017-9788)
  * corrupted or freed memory access. &lt;Limit[Except]&gt; must now be
    used in the main configuration file (httpd.conf) to register
    HTTP methods before the .htaccess files (CVE-2017-9798)
  * HTTP/2 support no longer tagged as "experimental" but is
    instead considered fully production ready
  * mod_http2: Disable and give warning when using Prefork; the
    server will continue to run, but HTTP/2 will no longer be
    negotiated</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 2.4.33
  * mod_authnz_ldap: out of bound write with AuthLDAPCharsetConfig
    enabled (CVE-2017-15710)
  * mod_session: CGI-like applications that intend to read from
    mod_session's 'SessionEnv ON' could be fooled into reading
    user-supplied data instead (CVE-2018-1283)
  * mod_cache_socache: Fix request headers parsing to avoid a
    possible crash with specially crafted input data
    (CVE-2018-1303)
  * core: Possible crash with excessively long HTTP request headers
    (CVE-2018-1301)
  * core: Configure the regular expression engine to match '$' to
    the end of the input string only, excluding matching the end of
    any embedded newline characters; behavior can be changed with
    new directive 'RegexDefaultOptions' (CVE-2017-15715)
  * mod_auth_digest: Fix generation of nonce values to prevent
    replay attacks across servers using a common Digest domain
    (CVE-2018-1312)
  * mod_http2: Potential crash w/ mod_http2 (CVE-2018-1302)
  * many other fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- update to version 2.4.46
  * see upstream changelog
- refresh patches and rename them to more descriptive names:
  * httpd-2.4.3-layout.patch -&gt; adjust-layout-to-follow-FHS.patch
  * httpd-2.4.1-config.patch -&gt; adjust-default-config.patch
- rename also other files from ancient naming scheme
  httpd-2.4.1-init -&gt; httpd.init
  httpd-2.4.1-rpmlintrc -&gt; rpmlintrc
- update rpmlintrc to work around bogus Factory build checks
- add tarball signature and keyring with upstream maintener key
- add version to libapr1-devel build time dependency</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 2.4.54
- rename rpmlintrc to httpd24-rpmlintrc and update to keeep up
  with latest whims</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291201">- more Factory workarounds
- make devel and manual subpackages noarch where possible</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to version 2.4.63
- update specfile for "modern" %patch syntax (fix 16.0 build)</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878401">- update the keyring</changelog>
</package>
<package pkgid="f9605ae922e87658c58bc6e26d3771e93cf45e625842ef4f4b45ae02e91e97c9" name="httpd24" arch="x86_64">
  <version epoch="0" ver="2.4.63" rel="150600.2.2"/>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 2.4.16
  * mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
    with response headers' size above 8K (CVE-2014-3583)
  * mod_cache: Avoid a crash when Content-Type has an empty value
    (CVE-2014-3581)
  * mod_lua: Fix handling of the Require line when a
    LuaAuthzProvider is used in multiple Require directives with
    different arguments (CVE-2014-8109)
  * core: HTTP trailers could be used to replace HTTP headers late
    during request processing, potentially undoing or otherwise
    confusing modules that examined or modified request headers
    earlier.  Adds "MergeTrailers" directive to restore legacy
    behavior. (CVE-2013-5704)
  * mod_ssl: New directive SSLSessionTickets (On|Off)
  * core: Fix a crash with ErrorDocument 400 pointing to a local
    URL-path qith the INCLUDES filter active, introduced in 2.4.11
    (CVE-2015-0253)
  * mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash
    (CVE-2015-0228)
  * core: Fix chunk header parsing defect (CVE-2015-3183)
  * Replacement of ap_some_auth_required (unusable in Apache httpd
    2.4) with new ap_some_authn_required and ap_force_authn hook
    (CVE-2015-3185)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 2.4.18
  * mod_http2: added donated HTTP/2 implementation via core module;
    similar configuration options to mod_ssl
  * mod_ssl: enable support for configuring the SUITEB* cipher
    strings introduced in OpenSSL 1.0.2
  * MPMs: support SO_REUSEPORT to create multiple duplicated
    listener records for scalability</changelog>
  <changelog author="mike@mk-sys.cz" date="1467374400">- update to version 2.4.20
  * mod_log_config: Add GlobalLog to allow a globally defined log
    to be inherited by virtual hosts that define a CustomLog
  * mod_httpd2: lot of fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 2.4.23
  * mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck
    directive to opt-in previous behaviour (2.2) with CRLs
    verification when checking certificate(s) with no corresponding
    CRL.
  * mod_ssl: reset client-verify state of ssl when aborting
    renegotiations
  * mod_httpd2: lot of fixes
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1489492800">- update to version 2.4.25
  * mod_http2: mitigate DoS memory exhaustion via endless
    CONTINUATION frames
  * core: mitigate [f]cgi "httpoxy" issues (CVE-2016-5387)
  * mod_auth_digest: prevent segfaults during client entry
    allocation when the shared memory space is exhausted
    (CVE-2016-2161)
  * mod_session_crypto: authenticate the session data/cookie with a
    MAC (SipHash) to prevent deciphering or tampering with a
    padding oracle attack
  * enforce HTTP request grammar corresponding to RFC7230 for
    request lines and request headers, to prevent response
    splitting and cache pollution by malicious clients or
    downstream proxies (CVE-2016-8743)
  * validate HTTP response header grammar defined by RFC7230,
    resulting in a 500 error in the event that invalid response
    header contents are detected when serving the response, to
    avoid response splitting and cache pollution by malicious
    clients, upstream servers or faulty modules
  * core: new directive HttpProtocolOptions to control httpd
    enforcement of various RFC7230 requirements
  * mod_http2: new directive 'H2PushResource' to enable early
    pushes before processing of the main request starts
  * mod_proxy_http2: adding support for newly proposed 103 status
    code
- add explicit insserv prerequisities</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 2.4.29
  * mod_mime can read one byte past the end of a buffer when
    sending a malicious Content-Type response header
    (CVE-2017-7679)
  * bug in token list parsing, which allows ap_find_token() to
    search past the end of its input string (CVE-2017-7668)
  * a maliciously constructed HTTP/2 request could cause mod_http2
    to dereference a NULL pointer and crash the server process
    (CVE-2017-7659)
  * mod_ssl may dereference a NULL pointer when third-party modules
    call ap_hook_process_connection() during an HTTP request to an
    HTTPS port (CVE-2017-3169)
  * use of the ap_get_basic_auth_pw() by third-party modules
    outside of the authentication phase may lead to authentication
    requirements being bypassed (CVE-2017-3167)
  * mod_http2: read after free; when under stress, closing many
    connections, the HTTP/2 handling code would sometimes access
    memory after it has been freed, resulting in potentially
    erratic behaviour (CVE-2017-9789)
  * mod_auth_digest: Uninitialized memory reflection.  The value
    placeholder in [Proxy-]Authorization headers type 'Digest' was
    not initialized or reset before or between successive key=value
    assignments (CVE-2017-9788)
  * corrupted or freed memory access. &lt;Limit[Except]&gt; must now be
    used in the main configuration file (httpd.conf) to register
    HTTP methods before the .htaccess files (CVE-2017-9798)
  * HTTP/2 support no longer tagged as "experimental" but is
    instead considered fully production ready
  * mod_http2: Disable and give warning when using Prefork; the
    server will continue to run, but HTTP/2 will no longer be
    negotiated</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 2.4.33
  * mod_authnz_ldap: out of bound write with AuthLDAPCharsetConfig
    enabled (CVE-2017-15710)
  * mod_session: CGI-like applications that intend to read from
    mod_session's 'SessionEnv ON' could be fooled into reading
    user-supplied data instead (CVE-2018-1283)
  * mod_cache_socache: Fix request headers parsing to avoid a
    possible crash with specially crafted input data
    (CVE-2018-1303)
  * core: Possible crash with excessively long HTTP request headers
    (CVE-2018-1301)
  * core: Configure the regular expression engine to match '$' to
    the end of the input string only, excluding matching the end of
    any embedded newline characters; behavior can be changed with
    new directive 'RegexDefaultOptions' (CVE-2017-15715)
  * mod_auth_digest: Fix generation of nonce values to prevent
    replay attacks across servers using a common Digest domain
    (CVE-2018-1312)
  * mod_http2: Potential crash w/ mod_http2 (CVE-2018-1302)
  * many other fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- update to version 2.4.46
  * see upstream changelog
- refresh patches and rename them to more descriptive names:
  * httpd-2.4.3-layout.patch -&gt; adjust-layout-to-follow-FHS.patch
  * httpd-2.4.1-config.patch -&gt; adjust-default-config.patch
- rename also other files from ancient naming scheme
  httpd-2.4.1-init -&gt; httpd.init
  httpd-2.4.1-rpmlintrc -&gt; rpmlintrc
- update rpmlintrc to work around bogus Factory build checks
- add tarball signature and keyring with upstream maintener key
- add version to libapr1-devel build time dependency</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 2.4.54
- rename rpmlintrc to httpd24-rpmlintrc and update to keeep up
  with latest whims</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291201">- more Factory workarounds
- make devel and manual subpackages noarch where possible</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to version 2.4.63
- update specfile for "modern" %patch syntax (fix 16.0 build)</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878401">- update the keyring</changelog>
</package>
<package pkgid="9659ccf050a7f2df555e5b9c7ce34d245ac14abb095deb1e60e486d390c3b9ea" name="httpd24-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.4.63" rel="150600.2.2"/>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 2.4.16
  * mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
    with response headers' size above 8K (CVE-2014-3583)
  * mod_cache: Avoid a crash when Content-Type has an empty value
    (CVE-2014-3581)
  * mod_lua: Fix handling of the Require line when a
    LuaAuthzProvider is used in multiple Require directives with
    different arguments (CVE-2014-8109)
  * core: HTTP trailers could be used to replace HTTP headers late
    during request processing, potentially undoing or otherwise
    confusing modules that examined or modified request headers
    earlier.  Adds "MergeTrailers" directive to restore legacy
    behavior. (CVE-2013-5704)
  * mod_ssl: New directive SSLSessionTickets (On|Off)
  * core: Fix a crash with ErrorDocument 400 pointing to a local
    URL-path qith the INCLUDES filter active, introduced in 2.4.11
    (CVE-2015-0253)
  * mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash
    (CVE-2015-0228)
  * core: Fix chunk header parsing defect (CVE-2015-3183)
  * Replacement of ap_some_auth_required (unusable in Apache httpd
    2.4) with new ap_some_authn_required and ap_force_authn hook
    (CVE-2015-3185)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 2.4.18
  * mod_http2: added donated HTTP/2 implementation via core module;
    similar configuration options to mod_ssl
  * mod_ssl: enable support for configuring the SUITEB* cipher
    strings introduced in OpenSSL 1.0.2
  * MPMs: support SO_REUSEPORT to create multiple duplicated
    listener records for scalability</changelog>
  <changelog author="mike@mk-sys.cz" date="1467374400">- update to version 2.4.20
  * mod_log_config: Add GlobalLog to allow a globally defined log
    to be inherited by virtual hosts that define a CustomLog
  * mod_httpd2: lot of fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 2.4.23
  * mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck
    directive to opt-in previous behaviour (2.2) with CRLs
    verification when checking certificate(s) with no corresponding
    CRL.
  * mod_ssl: reset client-verify state of ssl when aborting
    renegotiations
  * mod_httpd2: lot of fixes
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1489492800">- update to version 2.4.25
  * mod_http2: mitigate DoS memory exhaustion via endless
    CONTINUATION frames
  * core: mitigate [f]cgi "httpoxy" issues (CVE-2016-5387)
  * mod_auth_digest: prevent segfaults during client entry
    allocation when the shared memory space is exhausted
    (CVE-2016-2161)
  * mod_session_crypto: authenticate the session data/cookie with a
    MAC (SipHash) to prevent deciphering or tampering with a
    padding oracle attack
  * enforce HTTP request grammar corresponding to RFC7230 for
    request lines and request headers, to prevent response
    splitting and cache pollution by malicious clients or
    downstream proxies (CVE-2016-8743)
  * validate HTTP response header grammar defined by RFC7230,
    resulting in a 500 error in the event that invalid response
    header contents are detected when serving the response, to
    avoid response splitting and cache pollution by malicious
    clients, upstream servers or faulty modules
  * core: new directive HttpProtocolOptions to control httpd
    enforcement of various RFC7230 requirements
  * mod_http2: new directive 'H2PushResource' to enable early
    pushes before processing of the main request starts
  * mod_proxy_http2: adding support for newly proposed 103 status
    code
- add explicit insserv prerequisities</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 2.4.29
  * mod_mime can read one byte past the end of a buffer when
    sending a malicious Content-Type response header
    (CVE-2017-7679)
  * bug in token list parsing, which allows ap_find_token() to
    search past the end of its input string (CVE-2017-7668)
  * a maliciously constructed HTTP/2 request could cause mod_http2
    to dereference a NULL pointer and crash the server process
    (CVE-2017-7659)
  * mod_ssl may dereference a NULL pointer when third-party modules
    call ap_hook_process_connection() during an HTTP request to an
    HTTPS port (CVE-2017-3169)
  * use of the ap_get_basic_auth_pw() by third-party modules
    outside of the authentication phase may lead to authentication
    requirements being bypassed (CVE-2017-3167)
  * mod_http2: read after free; when under stress, closing many
    connections, the HTTP/2 handling code would sometimes access
    memory after it has been freed, resulting in potentially
    erratic behaviour (CVE-2017-9789)
  * mod_auth_digest: Uninitialized memory reflection.  The value
    placeholder in [Proxy-]Authorization headers type 'Digest' was
    not initialized or reset before or between successive key=value
    assignments (CVE-2017-9788)
  * corrupted or freed memory access. &lt;Limit[Except]&gt; must now be
    used in the main configuration file (httpd.conf) to register
    HTTP methods before the .htaccess files (CVE-2017-9798)
  * HTTP/2 support no longer tagged as "experimental" but is
    instead considered fully production ready
  * mod_http2: Disable and give warning when using Prefork; the
    server will continue to run, but HTTP/2 will no longer be
    negotiated</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 2.4.33
  * mod_authnz_ldap: out of bound write with AuthLDAPCharsetConfig
    enabled (CVE-2017-15710)
  * mod_session: CGI-like applications that intend to read from
    mod_session's 'SessionEnv ON' could be fooled into reading
    user-supplied data instead (CVE-2018-1283)
  * mod_cache_socache: Fix request headers parsing to avoid a
    possible crash with specially crafted input data
    (CVE-2018-1303)
  * core: Possible crash with excessively long HTTP request headers
    (CVE-2018-1301)
  * core: Configure the regular expression engine to match '$' to
    the end of the input string only, excluding matching the end of
    any embedded newline characters; behavior can be changed with
    new directive 'RegexDefaultOptions' (CVE-2017-15715)
  * mod_auth_digest: Fix generation of nonce values to prevent
    replay attacks across servers using a common Digest domain
    (CVE-2018-1312)
  * mod_http2: Potential crash w/ mod_http2 (CVE-2018-1302)
  * many other fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- update to version 2.4.46
  * see upstream changelog
- refresh patches and rename them to more descriptive names:
  * httpd-2.4.3-layout.patch -&gt; adjust-layout-to-follow-FHS.patch
  * httpd-2.4.1-config.patch -&gt; adjust-default-config.patch
- rename also other files from ancient naming scheme
  httpd-2.4.1-init -&gt; httpd.init
  httpd-2.4.1-rpmlintrc -&gt; rpmlintrc
- update rpmlintrc to work around bogus Factory build checks
- add tarball signature and keyring with upstream maintener key
- add version to libapr1-devel build time dependency</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 2.4.54
- rename rpmlintrc to httpd24-rpmlintrc and update to keeep up
  with latest whims</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291201">- more Factory workarounds
- make devel and manual subpackages noarch where possible</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to version 2.4.63
- update specfile for "modern" %patch syntax (fix 16.0 build)</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878401">- update the keyring</changelog>
</package>
<package pkgid="e9b82d9386d1766b04e50c9a3895fa483e8f8bfa0a61fc25dd89c22e93911043" name="httpd24-debugsource" arch="x86_64">
  <version epoch="0" ver="2.4.63" rel="150600.2.2"/>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 2.4.16
  * mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
    with response headers' size above 8K (CVE-2014-3583)
  * mod_cache: Avoid a crash when Content-Type has an empty value
    (CVE-2014-3581)
  * mod_lua: Fix handling of the Require line when a
    LuaAuthzProvider is used in multiple Require directives with
    different arguments (CVE-2014-8109)
  * core: HTTP trailers could be used to replace HTTP headers late
    during request processing, potentially undoing or otherwise
    confusing modules that examined or modified request headers
    earlier.  Adds "MergeTrailers" directive to restore legacy
    behavior. (CVE-2013-5704)
  * mod_ssl: New directive SSLSessionTickets (On|Off)
  * core: Fix a crash with ErrorDocument 400 pointing to a local
    URL-path qith the INCLUDES filter active, introduced in 2.4.11
    (CVE-2015-0253)
  * mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash
    (CVE-2015-0228)
  * core: Fix chunk header parsing defect (CVE-2015-3183)
  * Replacement of ap_some_auth_required (unusable in Apache httpd
    2.4) with new ap_some_authn_required and ap_force_authn hook
    (CVE-2015-3185)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 2.4.18
  * mod_http2: added donated HTTP/2 implementation via core module;
    similar configuration options to mod_ssl
  * mod_ssl: enable support for configuring the SUITEB* cipher
    strings introduced in OpenSSL 1.0.2
  * MPMs: support SO_REUSEPORT to create multiple duplicated
    listener records for scalability</changelog>
  <changelog author="mike@mk-sys.cz" date="1467374400">- update to version 2.4.20
  * mod_log_config: Add GlobalLog to allow a globally defined log
    to be inherited by virtual hosts that define a CustomLog
  * mod_httpd2: lot of fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 2.4.23
  * mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck
    directive to opt-in previous behaviour (2.2) with CRLs
    verification when checking certificate(s) with no corresponding
    CRL.
  * mod_ssl: reset client-verify state of ssl when aborting
    renegotiations
  * mod_httpd2: lot of fixes
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1489492800">- update to version 2.4.25
  * mod_http2: mitigate DoS memory exhaustion via endless
    CONTINUATION frames
  * core: mitigate [f]cgi "httpoxy" issues (CVE-2016-5387)
  * mod_auth_digest: prevent segfaults during client entry
    allocation when the shared memory space is exhausted
    (CVE-2016-2161)
  * mod_session_crypto: authenticate the session data/cookie with a
    MAC (SipHash) to prevent deciphering or tampering with a
    padding oracle attack
  * enforce HTTP request grammar corresponding to RFC7230 for
    request lines and request headers, to prevent response
    splitting and cache pollution by malicious clients or
    downstream proxies (CVE-2016-8743)
  * validate HTTP response header grammar defined by RFC7230,
    resulting in a 500 error in the event that invalid response
    header contents are detected when serving the response, to
    avoid response splitting and cache pollution by malicious
    clients, upstream servers or faulty modules
  * core: new directive HttpProtocolOptions to control httpd
    enforcement of various RFC7230 requirements
  * mod_http2: new directive 'H2PushResource' to enable early
    pushes before processing of the main request starts
  * mod_proxy_http2: adding support for newly proposed 103 status
    code
- add explicit insserv prerequisities</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 2.4.29
  * mod_mime can read one byte past the end of a buffer when
    sending a malicious Content-Type response header
    (CVE-2017-7679)
  * bug in token list parsing, which allows ap_find_token() to
    search past the end of its input string (CVE-2017-7668)
  * a maliciously constructed HTTP/2 request could cause mod_http2
    to dereference a NULL pointer and crash the server process
    (CVE-2017-7659)
  * mod_ssl may dereference a NULL pointer when third-party modules
    call ap_hook_process_connection() during an HTTP request to an
    HTTPS port (CVE-2017-3169)
  * use of the ap_get_basic_auth_pw() by third-party modules
    outside of the authentication phase may lead to authentication
    requirements being bypassed (CVE-2017-3167)
  * mod_http2: read after free; when under stress, closing many
    connections, the HTTP/2 handling code would sometimes access
    memory after it has been freed, resulting in potentially
    erratic behaviour (CVE-2017-9789)
  * mod_auth_digest: Uninitialized memory reflection.  The value
    placeholder in [Proxy-]Authorization headers type 'Digest' was
    not initialized or reset before or between successive key=value
    assignments (CVE-2017-9788)
  * corrupted or freed memory access. &lt;Limit[Except]&gt; must now be
    used in the main configuration file (httpd.conf) to register
    HTTP methods before the .htaccess files (CVE-2017-9798)
  * HTTP/2 support no longer tagged as "experimental" but is
    instead considered fully production ready
  * mod_http2: Disable and give warning when using Prefork; the
    server will continue to run, but HTTP/2 will no longer be
    negotiated</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 2.4.33
  * mod_authnz_ldap: out of bound write with AuthLDAPCharsetConfig
    enabled (CVE-2017-15710)
  * mod_session: CGI-like applications that intend to read from
    mod_session's 'SessionEnv ON' could be fooled into reading
    user-supplied data instead (CVE-2018-1283)
  * mod_cache_socache: Fix request headers parsing to avoid a
    possible crash with specially crafted input data
    (CVE-2018-1303)
  * core: Possible crash with excessively long HTTP request headers
    (CVE-2018-1301)
  * core: Configure the regular expression engine to match '$' to
    the end of the input string only, excluding matching the end of
    any embedded newline characters; behavior can be changed with
    new directive 'RegexDefaultOptions' (CVE-2017-15715)
  * mod_auth_digest: Fix generation of nonce values to prevent
    replay attacks across servers using a common Digest domain
    (CVE-2018-1312)
  * mod_http2: Potential crash w/ mod_http2 (CVE-2018-1302)
  * many other fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- update to version 2.4.46
  * see upstream changelog
- refresh patches and rename them to more descriptive names:
  * httpd-2.4.3-layout.patch -&gt; adjust-layout-to-follow-FHS.patch
  * httpd-2.4.1-config.patch -&gt; adjust-default-config.patch
- rename also other files from ancient naming scheme
  httpd-2.4.1-init -&gt; httpd.init
  httpd-2.4.1-rpmlintrc -&gt; rpmlintrc
- update rpmlintrc to work around bogus Factory build checks
- add tarball signature and keyring with upstream maintener key
- add version to libapr1-devel build time dependency</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 2.4.54
- rename rpmlintrc to httpd24-rpmlintrc and update to keeep up
  with latest whims</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291201">- more Factory workarounds
- make devel and manual subpackages noarch where possible</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to version 2.4.63
- update specfile for "modern" %patch syntax (fix 16.0 build)</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878401">- update the keyring</changelog>
</package>
<package pkgid="ec4ebb20dbda4c9e809cc3a9532f0c959aed87706015a6b1af2dd77d6570a762" name="httpd24-demo" arch="x86_64">
  <version epoch="0" ver="2.4.63" rel="150600.2.2"/>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 2.4.16
  * mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
    with response headers' size above 8K (CVE-2014-3583)
  * mod_cache: Avoid a crash when Content-Type has an empty value
    (CVE-2014-3581)
  * mod_lua: Fix handling of the Require line when a
    LuaAuthzProvider is used in multiple Require directives with
    different arguments (CVE-2014-8109)
  * core: HTTP trailers could be used to replace HTTP headers late
    during request processing, potentially undoing or otherwise
    confusing modules that examined or modified request headers
    earlier.  Adds "MergeTrailers" directive to restore legacy
    behavior. (CVE-2013-5704)
  * mod_ssl: New directive SSLSessionTickets (On|Off)
  * core: Fix a crash with ErrorDocument 400 pointing to a local
    URL-path qith the INCLUDES filter active, introduced in 2.4.11
    (CVE-2015-0253)
  * mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash
    (CVE-2015-0228)
  * core: Fix chunk header parsing defect (CVE-2015-3183)
  * Replacement of ap_some_auth_required (unusable in Apache httpd
    2.4) with new ap_some_authn_required and ap_force_authn hook
    (CVE-2015-3185)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 2.4.18
  * mod_http2: added donated HTTP/2 implementation via core module;
    similar configuration options to mod_ssl
  * mod_ssl: enable support for configuring the SUITEB* cipher
    strings introduced in OpenSSL 1.0.2
  * MPMs: support SO_REUSEPORT to create multiple duplicated
    listener records for scalability</changelog>
  <changelog author="mike@mk-sys.cz" date="1467374400">- update to version 2.4.20
  * mod_log_config: Add GlobalLog to allow a globally defined log
    to be inherited by virtual hosts that define a CustomLog
  * mod_httpd2: lot of fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 2.4.23
  * mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck
    directive to opt-in previous behaviour (2.2) with CRLs
    verification when checking certificate(s) with no corresponding
    CRL.
  * mod_ssl: reset client-verify state of ssl when aborting
    renegotiations
  * mod_httpd2: lot of fixes
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1489492800">- update to version 2.4.25
  * mod_http2: mitigate DoS memory exhaustion via endless
    CONTINUATION frames
  * core: mitigate [f]cgi "httpoxy" issues (CVE-2016-5387)
  * mod_auth_digest: prevent segfaults during client entry
    allocation when the shared memory space is exhausted
    (CVE-2016-2161)
  * mod_session_crypto: authenticate the session data/cookie with a
    MAC (SipHash) to prevent deciphering or tampering with a
    padding oracle attack
  * enforce HTTP request grammar corresponding to RFC7230 for
    request lines and request headers, to prevent response
    splitting and cache pollution by malicious clients or
    downstream proxies (CVE-2016-8743)
  * validate HTTP response header grammar defined by RFC7230,
    resulting in a 500 error in the event that invalid response
    header contents are detected when serving the response, to
    avoid response splitting and cache pollution by malicious
    clients, upstream servers or faulty modules
  * core: new directive HttpProtocolOptions to control httpd
    enforcement of various RFC7230 requirements
  * mod_http2: new directive 'H2PushResource' to enable early
    pushes before processing of the main request starts
  * mod_proxy_http2: adding support for newly proposed 103 status
    code
- add explicit insserv prerequisities</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 2.4.29
  * mod_mime can read one byte past the end of a buffer when
    sending a malicious Content-Type response header
    (CVE-2017-7679)
  * bug in token list parsing, which allows ap_find_token() to
    search past the end of its input string (CVE-2017-7668)
  * a maliciously constructed HTTP/2 request could cause mod_http2
    to dereference a NULL pointer and crash the server process
    (CVE-2017-7659)
  * mod_ssl may dereference a NULL pointer when third-party modules
    call ap_hook_process_connection() during an HTTP request to an
    HTTPS port (CVE-2017-3169)
  * use of the ap_get_basic_auth_pw() by third-party modules
    outside of the authentication phase may lead to authentication
    requirements being bypassed (CVE-2017-3167)
  * mod_http2: read after free; when under stress, closing many
    connections, the HTTP/2 handling code would sometimes access
    memory after it has been freed, resulting in potentially
    erratic behaviour (CVE-2017-9789)
  * mod_auth_digest: Uninitialized memory reflection.  The value
    placeholder in [Proxy-]Authorization headers type 'Digest' was
    not initialized or reset before or between successive key=value
    assignments (CVE-2017-9788)
  * corrupted or freed memory access. &lt;Limit[Except]&gt; must now be
    used in the main configuration file (httpd.conf) to register
    HTTP methods before the .htaccess files (CVE-2017-9798)
  * HTTP/2 support no longer tagged as "experimental" but is
    instead considered fully production ready
  * mod_http2: Disable and give warning when using Prefork; the
    server will continue to run, but HTTP/2 will no longer be
    negotiated</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 2.4.33
  * mod_authnz_ldap: out of bound write with AuthLDAPCharsetConfig
    enabled (CVE-2017-15710)
  * mod_session: CGI-like applications that intend to read from
    mod_session's 'SessionEnv ON' could be fooled into reading
    user-supplied data instead (CVE-2018-1283)
  * mod_cache_socache: Fix request headers parsing to avoid a
    possible crash with specially crafted input data
    (CVE-2018-1303)
  * core: Possible crash with excessively long HTTP request headers
    (CVE-2018-1301)
  * core: Configure the regular expression engine to match '$' to
    the end of the input string only, excluding matching the end of
    any embedded newline characters; behavior can be changed with
    new directive 'RegexDefaultOptions' (CVE-2017-15715)
  * mod_auth_digest: Fix generation of nonce values to prevent
    replay attacks across servers using a common Digest domain
    (CVE-2018-1312)
  * mod_http2: Potential crash w/ mod_http2 (CVE-2018-1302)
  * many other fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- update to version 2.4.46
  * see upstream changelog
- refresh patches and rename them to more descriptive names:
  * httpd-2.4.3-layout.patch -&gt; adjust-layout-to-follow-FHS.patch
  * httpd-2.4.1-config.patch -&gt; adjust-default-config.patch
- rename also other files from ancient naming scheme
  httpd-2.4.1-init -&gt; httpd.init
  httpd-2.4.1-rpmlintrc -&gt; rpmlintrc
- update rpmlintrc to work around bogus Factory build checks
- add tarball signature and keyring with upstream maintener key
- add version to libapr1-devel build time dependency</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 2.4.54
- rename rpmlintrc to httpd24-rpmlintrc and update to keeep up
  with latest whims</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291201">- more Factory workarounds
- make devel and manual subpackages noarch where possible</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to version 2.4.63
- update specfile for "modern" %patch syntax (fix 16.0 build)</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878401">- update the keyring</changelog>
</package>
<package pkgid="9dff0229998e752b27ea4a696638b321e536e1e03ff6f2ed410fee44c250bcc9" name="httpd24-devel" arch="noarch">
  <version epoch="0" ver="2.4.63" rel="150600.2.2"/>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 2.4.16
  * mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
    with response headers' size above 8K (CVE-2014-3583)
  * mod_cache: Avoid a crash when Content-Type has an empty value
    (CVE-2014-3581)
  * mod_lua: Fix handling of the Require line when a
    LuaAuthzProvider is used in multiple Require directives with
    different arguments (CVE-2014-8109)
  * core: HTTP trailers could be used to replace HTTP headers late
    during request processing, potentially undoing or otherwise
    confusing modules that examined or modified request headers
    earlier.  Adds "MergeTrailers" directive to restore legacy
    behavior. (CVE-2013-5704)
  * mod_ssl: New directive SSLSessionTickets (On|Off)
  * core: Fix a crash with ErrorDocument 400 pointing to a local
    URL-path qith the INCLUDES filter active, introduced in 2.4.11
    (CVE-2015-0253)
  * mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash
    (CVE-2015-0228)
  * core: Fix chunk header parsing defect (CVE-2015-3183)
  * Replacement of ap_some_auth_required (unusable in Apache httpd
    2.4) with new ap_some_authn_required and ap_force_authn hook
    (CVE-2015-3185)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 2.4.18
  * mod_http2: added donated HTTP/2 implementation via core module;
    similar configuration options to mod_ssl
  * mod_ssl: enable support for configuring the SUITEB* cipher
    strings introduced in OpenSSL 1.0.2
  * MPMs: support SO_REUSEPORT to create multiple duplicated
    listener records for scalability</changelog>
  <changelog author="mike@mk-sys.cz" date="1467374400">- update to version 2.4.20
  * mod_log_config: Add GlobalLog to allow a globally defined log
    to be inherited by virtual hosts that define a CustomLog
  * mod_httpd2: lot of fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 2.4.23
  * mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck
    directive to opt-in previous behaviour (2.2) with CRLs
    verification when checking certificate(s) with no corresponding
    CRL.
  * mod_ssl: reset client-verify state of ssl when aborting
    renegotiations
  * mod_httpd2: lot of fixes
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1489492800">- update to version 2.4.25
  * mod_http2: mitigate DoS memory exhaustion via endless
    CONTINUATION frames
  * core: mitigate [f]cgi "httpoxy" issues (CVE-2016-5387)
  * mod_auth_digest: prevent segfaults during client entry
    allocation when the shared memory space is exhausted
    (CVE-2016-2161)
  * mod_session_crypto: authenticate the session data/cookie with a
    MAC (SipHash) to prevent deciphering or tampering with a
    padding oracle attack
  * enforce HTTP request grammar corresponding to RFC7230 for
    request lines and request headers, to prevent response
    splitting and cache pollution by malicious clients or
    downstream proxies (CVE-2016-8743)
  * validate HTTP response header grammar defined by RFC7230,
    resulting in a 500 error in the event that invalid response
    header contents are detected when serving the response, to
    avoid response splitting and cache pollution by malicious
    clients, upstream servers or faulty modules
  * core: new directive HttpProtocolOptions to control httpd
    enforcement of various RFC7230 requirements
  * mod_http2: new directive 'H2PushResource' to enable early
    pushes before processing of the main request starts
  * mod_proxy_http2: adding support for newly proposed 103 status
    code
- add explicit insserv prerequisities</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 2.4.29
  * mod_mime can read one byte past the end of a buffer when
    sending a malicious Content-Type response header
    (CVE-2017-7679)
  * bug in token list parsing, which allows ap_find_token() to
    search past the end of its input string (CVE-2017-7668)
  * a maliciously constructed HTTP/2 request could cause mod_http2
    to dereference a NULL pointer and crash the server process
    (CVE-2017-7659)
  * mod_ssl may dereference a NULL pointer when third-party modules
    call ap_hook_process_connection() during an HTTP request to an
    HTTPS port (CVE-2017-3169)
  * use of the ap_get_basic_auth_pw() by third-party modules
    outside of the authentication phase may lead to authentication
    requirements being bypassed (CVE-2017-3167)
  * mod_http2: read after free; when under stress, closing many
    connections, the HTTP/2 handling code would sometimes access
    memory after it has been freed, resulting in potentially
    erratic behaviour (CVE-2017-9789)
  * mod_auth_digest: Uninitialized memory reflection.  The value
    placeholder in [Proxy-]Authorization headers type 'Digest' was
    not initialized or reset before or between successive key=value
    assignments (CVE-2017-9788)
  * corrupted or freed memory access. &lt;Limit[Except]&gt; must now be
    used in the main configuration file (httpd.conf) to register
    HTTP methods before the .htaccess files (CVE-2017-9798)
  * HTTP/2 support no longer tagged as "experimental" but is
    instead considered fully production ready
  * mod_http2: Disable and give warning when using Prefork; the
    server will continue to run, but HTTP/2 will no longer be
    negotiated</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 2.4.33
  * mod_authnz_ldap: out of bound write with AuthLDAPCharsetConfig
    enabled (CVE-2017-15710)
  * mod_session: CGI-like applications that intend to read from
    mod_session's 'SessionEnv ON' could be fooled into reading
    user-supplied data instead (CVE-2018-1283)
  * mod_cache_socache: Fix request headers parsing to avoid a
    possible crash with specially crafted input data
    (CVE-2018-1303)
  * core: Possible crash with excessively long HTTP request headers
    (CVE-2018-1301)
  * core: Configure the regular expression engine to match '$' to
    the end of the input string only, excluding matching the end of
    any embedded newline characters; behavior can be changed with
    new directive 'RegexDefaultOptions' (CVE-2017-15715)
  * mod_auth_digest: Fix generation of nonce values to prevent
    replay attacks across servers using a common Digest domain
    (CVE-2018-1312)
  * mod_http2: Potential crash w/ mod_http2 (CVE-2018-1302)
  * many other fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- update to version 2.4.46
  * see upstream changelog
- refresh patches and rename them to more descriptive names:
  * httpd-2.4.3-layout.patch -&gt; adjust-layout-to-follow-FHS.patch
  * httpd-2.4.1-config.patch -&gt; adjust-default-config.patch
- rename also other files from ancient naming scheme
  httpd-2.4.1-init -&gt; httpd.init
  httpd-2.4.1-rpmlintrc -&gt; rpmlintrc
- update rpmlintrc to work around bogus Factory build checks
- add tarball signature and keyring with upstream maintener key
- add version to libapr1-devel build time dependency</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 2.4.54
- rename rpmlintrc to httpd24-rpmlintrc and update to keeep up
  with latest whims</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291201">- more Factory workarounds
- make devel and manual subpackages noarch where possible</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to version 2.4.63
- update specfile for "modern" %patch syntax (fix 16.0 build)</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878401">- update the keyring</changelog>
</package>
<package pkgid="2fd140e0b5728e8cd30df8fad83fb4fdb8d23c2232d8f0322368ffaa038ec357" name="httpd24-manual" arch="noarch">
  <version epoch="0" ver="2.4.63" rel="150600.2.2"/>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 2.4.16
  * mod_proxy_fcgi: Fix a potential crash due to buffer over-read,
    with response headers' size above 8K (CVE-2014-3583)
  * mod_cache: Avoid a crash when Content-Type has an empty value
    (CVE-2014-3581)
  * mod_lua: Fix handling of the Require line when a
    LuaAuthzProvider is used in multiple Require directives with
    different arguments (CVE-2014-8109)
  * core: HTTP trailers could be used to replace HTTP headers late
    during request processing, potentially undoing or otherwise
    confusing modules that examined or modified request headers
    earlier.  Adds "MergeTrailers" directive to restore legacy
    behavior. (CVE-2013-5704)
  * mod_ssl: New directive SSLSessionTickets (On|Off)
  * core: Fix a crash with ErrorDocument 400 pointing to a local
    URL-path qith the INCLUDES filter active, introduced in 2.4.11
    (CVE-2015-0253)
  * mod_lua: A maliciously crafted websockets PING after a script
    calls r:wsupgrade() can cause a child process crash
    (CVE-2015-0228)
  * core: Fix chunk header parsing defect (CVE-2015-3183)
  * Replacement of ap_some_auth_required (unusable in Apache httpd
    2.4) with new ap_some_authn_required and ap_force_authn hook
    (CVE-2015-3185)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 2.4.18
  * mod_http2: added donated HTTP/2 implementation via core module;
    similar configuration options to mod_ssl
  * mod_ssl: enable support for configuring the SUITEB* cipher
    strings introduced in OpenSSL 1.0.2
  * MPMs: support SO_REUSEPORT to create multiple duplicated
    listener records for scalability</changelog>
  <changelog author="mike@mk-sys.cz" date="1467374400">- update to version 2.4.20
  * mod_log_config: Add GlobalLog to allow a globally defined log
    to be inherited by virtual hosts that define a CustomLog
  * mod_httpd2: lot of fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 2.4.23
  * mod_ssl: Add "no_crl_for_cert_ok" flag to SSLCARevocationCheck
    directive to opt-in previous behaviour (2.2) with CRLs
    verification when checking certificate(s) with no corresponding
    CRL.
  * mod_ssl: reset client-verify state of ssl when aborting
    renegotiations
  * mod_httpd2: lot of fixes
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1489492800">- update to version 2.4.25
  * mod_http2: mitigate DoS memory exhaustion via endless
    CONTINUATION frames
  * core: mitigate [f]cgi "httpoxy" issues (CVE-2016-5387)
  * mod_auth_digest: prevent segfaults during client entry
    allocation when the shared memory space is exhausted
    (CVE-2016-2161)
  * mod_session_crypto: authenticate the session data/cookie with a
    MAC (SipHash) to prevent deciphering or tampering with a
    padding oracle attack
  * enforce HTTP request grammar corresponding to RFC7230 for
    request lines and request headers, to prevent response
    splitting and cache pollution by malicious clients or
    downstream proxies (CVE-2016-8743)
  * validate HTTP response header grammar defined by RFC7230,
    resulting in a 500 error in the event that invalid response
    header contents are detected when serving the response, to
    avoid response splitting and cache pollution by malicious
    clients, upstream servers or faulty modules
  * core: new directive HttpProtocolOptions to control httpd
    enforcement of various RFC7230 requirements
  * mod_http2: new directive 'H2PushResource' to enable early
    pushes before processing of the main request starts
  * mod_proxy_http2: adding support for newly proposed 103 status
    code
- add explicit insserv prerequisities</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 2.4.29
  * mod_mime can read one byte past the end of a buffer when
    sending a malicious Content-Type response header
    (CVE-2017-7679)
  * bug in token list parsing, which allows ap_find_token() to
    search past the end of its input string (CVE-2017-7668)
  * a maliciously constructed HTTP/2 request could cause mod_http2
    to dereference a NULL pointer and crash the server process
    (CVE-2017-7659)
  * mod_ssl may dereference a NULL pointer when third-party modules
    call ap_hook_process_connection() during an HTTP request to an
    HTTPS port (CVE-2017-3169)
  * use of the ap_get_basic_auth_pw() by third-party modules
    outside of the authentication phase may lead to authentication
    requirements being bypassed (CVE-2017-3167)
  * mod_http2: read after free; when under stress, closing many
    connections, the HTTP/2 handling code would sometimes access
    memory after it has been freed, resulting in potentially
    erratic behaviour (CVE-2017-9789)
  * mod_auth_digest: Uninitialized memory reflection.  The value
    placeholder in [Proxy-]Authorization headers type 'Digest' was
    not initialized or reset before or between successive key=value
    assignments (CVE-2017-9788)
  * corrupted or freed memory access. &lt;Limit[Except]&gt; must now be
    used in the main configuration file (httpd.conf) to register
    HTTP methods before the .htaccess files (CVE-2017-9798)
  * HTTP/2 support no longer tagged as "experimental" but is
    instead considered fully production ready
  * mod_http2: Disable and give warning when using Prefork; the
    server will continue to run, but HTTP/2 will no longer be
    negotiated</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 2.4.33
  * mod_authnz_ldap: out of bound write with AuthLDAPCharsetConfig
    enabled (CVE-2017-15710)
  * mod_session: CGI-like applications that intend to read from
    mod_session's 'SessionEnv ON' could be fooled into reading
    user-supplied data instead (CVE-2018-1283)
  * mod_cache_socache: Fix request headers parsing to avoid a
    possible crash with specially crafted input data
    (CVE-2018-1303)
  * core: Possible crash with excessively long HTTP request headers
    (CVE-2018-1301)
  * core: Configure the regular expression engine to match '$' to
    the end of the input string only, excluding matching the end of
    any embedded newline characters; behavior can be changed with
    new directive 'RegexDefaultOptions' (CVE-2017-15715)
  * mod_auth_digest: Fix generation of nonce values to prevent
    replay attacks across servers using a common Digest domain
    (CVE-2018-1312)
  * mod_http2: Potential crash w/ mod_http2 (CVE-2018-1302)
  * many other fixes</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- update to version 2.4.46
  * see upstream changelog
- refresh patches and rename them to more descriptive names:
  * httpd-2.4.3-layout.patch -&gt; adjust-layout-to-follow-FHS.patch
  * httpd-2.4.1-config.patch -&gt; adjust-default-config.patch
- rename also other files from ancient naming scheme
  httpd-2.4.1-init -&gt; httpd.init
  httpd-2.4.1-rpmlintrc -&gt; rpmlintrc
- update rpmlintrc to work around bogus Factory build checks
- add tarball signature and keyring with upstream maintener key
- add version to libapr1-devel build time dependency</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 2.4.54
- rename rpmlintrc to httpd24-rpmlintrc and update to keeep up
  with latest whims</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291201">- more Factory workarounds
- make devel and manual subpackages noarch where possible</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to version 2.4.63
- update specfile for "modern" %patch syntax (fix 16.0 build)</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878401">- update the keyring</changelog>
</package>
<package pkgid="af1639628086045843189848e7bf78b3187284708f162d0fad8401c4ec529245" name="libfibpp0_9_12" arch="x86_64">
  <version epoch="0" ver="0.9.12" rel="150600.7.2"/>
  <changelog author="mike@mk-sys.cz" date="1253793600">- build dependency on firebird-devel
- devel subpackage
- ldconfig after uninstall</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265600">- update to version 0.9.12
  * nothing really important, mostly to avoid conflicts with older
    pre-git (and pre-OBS) versions running around
- moved to OBS
- specfile cleanup
- add baselibs.conf</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265601">- add Group tag to libfibpp "subpackage"</changelog>
  <changelog author="mike@mk-sys.cz" date="1352635200">- create-and-install-fibpp.pc-for-pkg-config.patch:
  install pkg-config file</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- fix libfbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- specfile cleanup (drop SLE11 tweaks)
- drop static library</changelog>
</package>
<package pkgid="82ccf8a156a7ab92f0864eecdfa90b8f5234565ac4fb889fdee28d65b13c66e0" name="libfibpp0_9_12-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.9.12" rel="150600.7.2"/>
  <changelog author="mike@mk-sys.cz" date="1253793600">- build dependency on firebird-devel
- devel subpackage
- ldconfig after uninstall</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265600">- update to version 0.9.12
  * nothing really important, mostly to avoid conflicts with older
    pre-git (and pre-OBS) versions running around
- moved to OBS
- specfile cleanup
- add baselibs.conf</changelog>
  <changelog author="mike@mk-sys.cz" date="1349265601">- add Group tag to libfibpp "subpackage"</changelog>
  <changelog author="mike@mk-sys.cz" date="1352635200">- create-and-install-fibpp.pc-for-pkg-config.patch:
  install pkg-config file</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- fix libfbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- specfile cleanup (drop SLE11 tweaks)
- drop static library</changelog>
</package>
<package pkgid="b888a1285036d7cf2490f7cdabad973d9be039f8818cdee4afc29d6bd9ad1048" name="php56" arch="src">
  <version epoch="0" ver="5.6.40" rel="150600.2.36"/>
  <changelog author="mike@mk-sys.cz" date="1427025600">- initial checkin of PHP 5.6.7</changelog>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 5.6.13
  * apache2handler: potential remote code execution with apache 2.4
    apache2handler (CVE-2015-3330)
  * opcache: user after free (CVE-2015-1351)
  * phar: buffer over-read in unserialize when parsing phar
    (CVE-2015-2783)
  * phar: buffer overflow when parsing tar/zip/phar in
    phar_set_inode (CVE-2015-3329)
  * postgres: null pointer dereference (CVE-2015-1352)
  * core: PHP Multipart/form-data remote dos Vulnerability
    (CVE-2015-4024)
  * core: CVE-2006-7243 fix regressions in 5.4+ (CVE-2015-4025)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4022)
  * pcntl: pcntl_exec() should not allow null char (CVE-2015-4026)
  * pcre: upgrade pcrelib to 8.37 (CVE-2015-2325 CVE-2015-2326)
  * phar: memory corruption in phar_parse_tarfile when entry
    filename starts with null (CVE-2015-4021)
  * core: OS command injection vulnerability in escapeshellarg
    (CVE-2015-4642)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4643)
  * postgres: segfault in php_pgsql_meta_data (CVE-2015-4644)
  * sqlite3: upgrade bundled sqlite to 3.8.10.2 (CVE-2015-3414
    CVE-2015-3415 CVE-2015-3416)
  * mysqlnd: mysqlnd is vulnerable to BACKRONYM (CVE-2015-3152)
  * phar: segfault in Phar::convertToData on invalid file
    (CVE-2015-5589)
  * phar: buffer overflow and stack smashing error in
    phar_fix_filepath (CVE-2015-5590)
  * phar: files extracted from archive may be placed outside of
    destination directory (CVE-2015-6833)
  * spl: dangling pointer in the unserialization of ArrayObject
    items (CVE-2015-6832)
  * spl: use after free vulnerability in unserialize() with
    SPLArrayObject (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6831)
  * core: use after free vulnerability in unserialize()).
    (CVE-2015-6834)
  * core: use after free vulnerability in session deserializer
    (CVE-2015-6835)
  * soap: SOAP serialize_function_call() type confusion / RCE
    (CVE-2015-6836)
  * spl: use-after-free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6834)
  * spl: use-after-free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6834)
  * xslt: null pointer dereference (CVE-2015-6837 CVE-2015-6838)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 5.6.16
  * phar: null pointer dereference in phar_get_fp_offset()
    (CVE-2015-7803)
  * phar: uninitialized pointer in phar_make_dirstream when zip
    entry filename is "/" (CVE-2015-7804)
  * various segfaults</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- update to version 5.6.23
  * fpm: fpm_log.c memory leak and buffer overflow (CVE-2016-5114)
  * gd: memory Read via gdImageRotateInterpolated Array Index Out
    of Bounds (CVE-2016-1903)
  * wddx: use After Free Vulnerability in WDDX Packet
    Deserialization
  * wddx: session WDDX Packet Deserialization Type Confusion
    Vulnerability
  * xmlrpc: type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  * pcre: upgrade bundled PCRE library to 8.38. (CVE-2015-8383,
    CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
    CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
  * phar: heap corruption in tar/zip/phar parser (CVE-2016-4342)
  * phar: uninitialized pointer in phar_make_dirstream()).
    (CVE-2016-4343)
  * phar: NULL Pointer Dereference in phar_tar_setupmetadata()
  * phar: stack overflow when decompressing tar archives
    (CVE-2016-2554)
  * add support for HTTP 451 error code
  * fileinfo: buffer over-write in finfo_open with malformed magic
    file (CVE-2015-8865)
  * mbstring: addressSanitizer: negative-size-param (-1) in
    mbfl_strcut (CVE-2016-4073)
  * odbc: invalid memory write in phar on filename with \0 in
    name (CVE-2016-4072)
  * snmp: php_snmp_error() format string vulnerability
    (CVE-2016-4071)
  * standard: integer overflow in php_raw_url_encode
    (CVE-2016-4070)
  * bcmath: bcpowmod accepts negative scale and corrupts _one_
    definition (CVE-2016-4537, CVE-2016-4538)
  * exif: out of bounds heap read access in exif header
    processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
  * gd: libgd: signedness vulnerability (CVE-2016-3074)
  * intl: out-of-bounds reads in zif_grapheme_stripos with negative
    offset (CVE-2016-4540, CVE-2016-4541)
  * xml: xml_parse_into_struct segmentation fault (CVE-2016-4539)
  * core: integer underflow / arbitrary null write in fread/gzread
    (CVE-2016-5096)
  * core: integer Overflow in php_html_entities (CVE-2016-5094)
  * gd: imagescale out-of-bounds read (CVE-2013-7456)
  * intl: get_icu_value_internal out-of-bounds read (CVE-2016-5093)
  * stack overflow with imagefilltoborder (CVE-2015-8874)
  * integer Overflow in _gd2GetHeader() resulting in heap
    overflow (CVE-2016-5766)
  * integer overflow in gdImagePaletteToTrueColor() resulting in
    heap overflow (CVE-2016-5767)
  * mbstring: _php_mb_regex_ereg_replace_exec - double free
    (CVE-2016-5768)
  * mcrypt: heap Overflow due to integer overflows (CVE-2016-5769)
  * spl: int/size_t confusion in SplFileObject::fread
    (CVE-2016-5770)
  * spl: use after free vulnerability in PHP's GC algorithm and
    unserialize (CVE-2016-5771)
  * wddx: double free courruption in wddx_deserialize
    (CVE-2016-5772)
  * zip: ZipArchive class use after free vulnerability in PHP's GC
    algorithm and unserialize (CVE-2016-5773)
- avoid-gcc-warnings-in-mbstring-extensions.patch:
  update (drop part added to upstream)</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374401">- fix fbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 5.6.25
  * core: stack-based buffer overflow vulnerability in
    virtual_file_ex (CVE-2016-6289)
  * core: use after free in unserialize() with unexpected session
    deserialization (CVE-2016-6290)
  * HTTP_PROXY is improperly trusted by some PHP libraries and
    applications (CVE-2016-5385)
  * bz2: inadequate error handling in bzread() (CVE-2016-5399)
  * exif: out of bound read in exif_process_IFD_in_MAKERNOTE
    (CVE-2016-6291)
  * exif: null pointer dereference in exif_process_user_comment
    (CVE-2016-6292)
  * gd: integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  * intl: locale_accept_from_http out-of-bounds access
    (CVE-2016-6294)
  * odbc: PHP segfaults when accessing nvarchar(max) defined
    columns (CVE-2015-8879)
  * snmp: use after free vulnerability in SNMP with GC and
    unserialize() (CVE-2016-6295)
  * xmlrpc: heap-buffer-overflow (write) simplestring_addn
    simplestring.c (CVE-2016-6296)
  * zip: stack-based buffer overflow vulnerability in
    php_stream_zip_opener). (CVE-2016-6297)</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- update to version 5.6.28
  * intl: add locale length check (CVE-2016-7416)
  * mysqlnd: eap overflow in mysqlnd related to bit fields
    (CVE-2016-7412)
  * out of bound when verify signature of zip phar in
    phar_parse_zipfile (CVE-2016-7414)
  * spl: missing type check when unserializing SplArray
    (CVE-2016-7417)
  * standard: memory corruption in during deserialized-object
    destruction (CVE-2016-7411)
  * wddx: wddx_deserialize use-after-free (CVE-2016-7413)
  * wddx: out-of-bounds read in php_wddx_push_element
    (CVE-2016-7418)</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 5.6.32
  * wddx: invalid read when wddx decodes empty boolean element
    (CVE-2016-9935)
  * openssl: invalid parameter in memcpy function trough
    openssl_pbkdf2
  * exif: FPE when parsing a tag format (CVE-2016-10158)
  * gd: DOS vulnerability in gdImageCreateFromGd2Ctx()
    (CVE-2016-10167)
  * gd: signed Integer Overflow gd_io.c (CVE-2016-10168)
  * phar: crash while loading hostile phar archive (CVE-2016-10159)
  * phar: memory corruption when loading hostile phar
    (CVE-2016-10160)
  * standard: heap out of bounds read on unserialize in
    finish_nested_data() (CVE-2016-10161)
  * gd: buffer over-read into uninitialized memory (CVE-2017-7890)
  * mbstring: add oniguruma upstream fix (CVE-2017-9224,
    CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
  * pcre: fixed bug #75207 (applied upstream patch for
    CVE-2016-1283)</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 5.6.36
  * potential infinite loop in gdImageCreateFromGifCtx
    (CVE-2018-5711)
  * reflected XSS in .phar 404 page (CVE-2018-5712)
  * stack-buffer-overflow while parsing HTTP response
    (CVE-2018-7584)
  * dumpable FPM child processes allow bypassing opcache access
    controls (CVE-2018-10545)
  * heap Buffer Overflow (READ: 1786) in exif_iif_add_value
    (CVE-2018-10549)
  * stream filter convert.iconv leads to infinite loop on invalid
    sequence (CVE-2018-10546)
  * malicious LDAP-Server response causes crash (CVE-2018-10548)
  * fix for CVE-2018-5712 may have not been complete
    (CVE-2018-10547)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- use spdx tag for License</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 5.6.40</changelog>
</package>
<package pkgid="94fc40c0968108fed54b071735b5f883bc2ba164954ba944e55862e1a0784cd9" name="php56" arch="x86_64">
  <version epoch="0" ver="5.6.40" rel="150600.2.36"/>
  <changelog author="mike@mk-sys.cz" date="1427025600">- initial checkin of PHP 5.6.7</changelog>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 5.6.13
  * apache2handler: potential remote code execution with apache 2.4
    apache2handler (CVE-2015-3330)
  * opcache: user after free (CVE-2015-1351)
  * phar: buffer over-read in unserialize when parsing phar
    (CVE-2015-2783)
  * phar: buffer overflow when parsing tar/zip/phar in
    phar_set_inode (CVE-2015-3329)
  * postgres: null pointer dereference (CVE-2015-1352)
  * core: PHP Multipart/form-data remote dos Vulnerability
    (CVE-2015-4024)
  * core: CVE-2006-7243 fix regressions in 5.4+ (CVE-2015-4025)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4022)
  * pcntl: pcntl_exec() should not allow null char (CVE-2015-4026)
  * pcre: upgrade pcrelib to 8.37 (CVE-2015-2325 CVE-2015-2326)
  * phar: memory corruption in phar_parse_tarfile when entry
    filename starts with null (CVE-2015-4021)
  * core: OS command injection vulnerability in escapeshellarg
    (CVE-2015-4642)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4643)
  * postgres: segfault in php_pgsql_meta_data (CVE-2015-4644)
  * sqlite3: upgrade bundled sqlite to 3.8.10.2 (CVE-2015-3414
    CVE-2015-3415 CVE-2015-3416)
  * mysqlnd: mysqlnd is vulnerable to BACKRONYM (CVE-2015-3152)
  * phar: segfault in Phar::convertToData on invalid file
    (CVE-2015-5589)
  * phar: buffer overflow and stack smashing error in
    phar_fix_filepath (CVE-2015-5590)
  * phar: files extracted from archive may be placed outside of
    destination directory (CVE-2015-6833)
  * spl: dangling pointer in the unserialization of ArrayObject
    items (CVE-2015-6832)
  * spl: use after free vulnerability in unserialize() with
    SPLArrayObject (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6831)
  * core: use after free vulnerability in unserialize()).
    (CVE-2015-6834)
  * core: use after free vulnerability in session deserializer
    (CVE-2015-6835)
  * soap: SOAP serialize_function_call() type confusion / RCE
    (CVE-2015-6836)
  * spl: use-after-free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6834)
  * spl: use-after-free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6834)
  * xslt: null pointer dereference (CVE-2015-6837 CVE-2015-6838)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 5.6.16
  * phar: null pointer dereference in phar_get_fp_offset()
    (CVE-2015-7803)
  * phar: uninitialized pointer in phar_make_dirstream when zip
    entry filename is "/" (CVE-2015-7804)
  * various segfaults</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- update to version 5.6.23
  * fpm: fpm_log.c memory leak and buffer overflow (CVE-2016-5114)
  * gd: memory Read via gdImageRotateInterpolated Array Index Out
    of Bounds (CVE-2016-1903)
  * wddx: use After Free Vulnerability in WDDX Packet
    Deserialization
  * wddx: session WDDX Packet Deserialization Type Confusion
    Vulnerability
  * xmlrpc: type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  * pcre: upgrade bundled PCRE library to 8.38. (CVE-2015-8383,
    CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
    CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
  * phar: heap corruption in tar/zip/phar parser (CVE-2016-4342)
  * phar: uninitialized pointer in phar_make_dirstream()).
    (CVE-2016-4343)
  * phar: NULL Pointer Dereference in phar_tar_setupmetadata()
  * phar: stack overflow when decompressing tar archives
    (CVE-2016-2554)
  * add support for HTTP 451 error code
  * fileinfo: buffer over-write in finfo_open with malformed magic
    file (CVE-2015-8865)
  * mbstring: addressSanitizer: negative-size-param (-1) in
    mbfl_strcut (CVE-2016-4073)
  * odbc: invalid memory write in phar on filename with \0 in
    name (CVE-2016-4072)
  * snmp: php_snmp_error() format string vulnerability
    (CVE-2016-4071)
  * standard: integer overflow in php_raw_url_encode
    (CVE-2016-4070)
  * bcmath: bcpowmod accepts negative scale and corrupts _one_
    definition (CVE-2016-4537, CVE-2016-4538)
  * exif: out of bounds heap read access in exif header
    processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
  * gd: libgd: signedness vulnerability (CVE-2016-3074)
  * intl: out-of-bounds reads in zif_grapheme_stripos with negative
    offset (CVE-2016-4540, CVE-2016-4541)
  * xml: xml_parse_into_struct segmentation fault (CVE-2016-4539)
  * core: integer underflow / arbitrary null write in fread/gzread
    (CVE-2016-5096)
  * core: integer Overflow in php_html_entities (CVE-2016-5094)
  * gd: imagescale out-of-bounds read (CVE-2013-7456)
  * intl: get_icu_value_internal out-of-bounds read (CVE-2016-5093)
  * stack overflow with imagefilltoborder (CVE-2015-8874)
  * integer Overflow in _gd2GetHeader() resulting in heap
    overflow (CVE-2016-5766)
  * integer overflow in gdImagePaletteToTrueColor() resulting in
    heap overflow (CVE-2016-5767)
  * mbstring: _php_mb_regex_ereg_replace_exec - double free
    (CVE-2016-5768)
  * mcrypt: heap Overflow due to integer overflows (CVE-2016-5769)
  * spl: int/size_t confusion in SplFileObject::fread
    (CVE-2016-5770)
  * spl: use after free vulnerability in PHP's GC algorithm and
    unserialize (CVE-2016-5771)
  * wddx: double free courruption in wddx_deserialize
    (CVE-2016-5772)
  * zip: ZipArchive class use after free vulnerability in PHP's GC
    algorithm and unserialize (CVE-2016-5773)
- avoid-gcc-warnings-in-mbstring-extensions.patch:
  update (drop part added to upstream)</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374401">- fix fbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 5.6.25
  * core: stack-based buffer overflow vulnerability in
    virtual_file_ex (CVE-2016-6289)
  * core: use after free in unserialize() with unexpected session
    deserialization (CVE-2016-6290)
  * HTTP_PROXY is improperly trusted by some PHP libraries and
    applications (CVE-2016-5385)
  * bz2: inadequate error handling in bzread() (CVE-2016-5399)
  * exif: out of bound read in exif_process_IFD_in_MAKERNOTE
    (CVE-2016-6291)
  * exif: null pointer dereference in exif_process_user_comment
    (CVE-2016-6292)
  * gd: integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  * intl: locale_accept_from_http out-of-bounds access
    (CVE-2016-6294)
  * odbc: PHP segfaults when accessing nvarchar(max) defined
    columns (CVE-2015-8879)
  * snmp: use after free vulnerability in SNMP with GC and
    unserialize() (CVE-2016-6295)
  * xmlrpc: heap-buffer-overflow (write) simplestring_addn
    simplestring.c (CVE-2016-6296)
  * zip: stack-based buffer overflow vulnerability in
    php_stream_zip_opener). (CVE-2016-6297)</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- update to version 5.6.28
  * intl: add locale length check (CVE-2016-7416)
  * mysqlnd: eap overflow in mysqlnd related to bit fields
    (CVE-2016-7412)
  * out of bound when verify signature of zip phar in
    phar_parse_zipfile (CVE-2016-7414)
  * spl: missing type check when unserializing SplArray
    (CVE-2016-7417)
  * standard: memory corruption in during deserialized-object
    destruction (CVE-2016-7411)
  * wddx: wddx_deserialize use-after-free (CVE-2016-7413)
  * wddx: out-of-bounds read in php_wddx_push_element
    (CVE-2016-7418)</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 5.6.32
  * wddx: invalid read when wddx decodes empty boolean element
    (CVE-2016-9935)
  * openssl: invalid parameter in memcpy function trough
    openssl_pbkdf2
  * exif: FPE when parsing a tag format (CVE-2016-10158)
  * gd: DOS vulnerability in gdImageCreateFromGd2Ctx()
    (CVE-2016-10167)
  * gd: signed Integer Overflow gd_io.c (CVE-2016-10168)
  * phar: crash while loading hostile phar archive (CVE-2016-10159)
  * phar: memory corruption when loading hostile phar
    (CVE-2016-10160)
  * standard: heap out of bounds read on unserialize in
    finish_nested_data() (CVE-2016-10161)
  * gd: buffer over-read into uninitialized memory (CVE-2017-7890)
  * mbstring: add oniguruma upstream fix (CVE-2017-9224,
    CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
  * pcre: fixed bug #75207 (applied upstream patch for
    CVE-2016-1283)</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 5.6.36
  * potential infinite loop in gdImageCreateFromGifCtx
    (CVE-2018-5711)
  * reflected XSS in .phar 404 page (CVE-2018-5712)
  * stack-buffer-overflow while parsing HTTP response
    (CVE-2018-7584)
  * dumpable FPM child processes allow bypassing opcache access
    controls (CVE-2018-10545)
  * heap Buffer Overflow (READ: 1786) in exif_iif_add_value
    (CVE-2018-10549)
  * stream filter convert.iconv leads to infinite loop on invalid
    sequence (CVE-2018-10546)
  * malicious LDAP-Server response causes crash (CVE-2018-10548)
  * fix for CVE-2018-5712 may have not been complete
    (CVE-2018-10547)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- use spdx tag for License</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 5.6.40</changelog>
</package>
<package pkgid="f506c50ee011d5b180c765ed842bf7842a626e399ec3c86686ede223a8c192bb" name="php56-debuginfo" arch="x86_64">
  <version epoch="0" ver="5.6.40" rel="150600.2.36"/>
  <changelog author="mike@mk-sys.cz" date="1427025600">- initial checkin of PHP 5.6.7</changelog>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 5.6.13
  * apache2handler: potential remote code execution with apache 2.4
    apache2handler (CVE-2015-3330)
  * opcache: user after free (CVE-2015-1351)
  * phar: buffer over-read in unserialize when parsing phar
    (CVE-2015-2783)
  * phar: buffer overflow when parsing tar/zip/phar in
    phar_set_inode (CVE-2015-3329)
  * postgres: null pointer dereference (CVE-2015-1352)
  * core: PHP Multipart/form-data remote dos Vulnerability
    (CVE-2015-4024)
  * core: CVE-2006-7243 fix regressions in 5.4+ (CVE-2015-4025)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4022)
  * pcntl: pcntl_exec() should not allow null char (CVE-2015-4026)
  * pcre: upgrade pcrelib to 8.37 (CVE-2015-2325 CVE-2015-2326)
  * phar: memory corruption in phar_parse_tarfile when entry
    filename starts with null (CVE-2015-4021)
  * core: OS command injection vulnerability in escapeshellarg
    (CVE-2015-4642)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4643)
  * postgres: segfault in php_pgsql_meta_data (CVE-2015-4644)
  * sqlite3: upgrade bundled sqlite to 3.8.10.2 (CVE-2015-3414
    CVE-2015-3415 CVE-2015-3416)
  * mysqlnd: mysqlnd is vulnerable to BACKRONYM (CVE-2015-3152)
  * phar: segfault in Phar::convertToData on invalid file
    (CVE-2015-5589)
  * phar: buffer overflow and stack smashing error in
    phar_fix_filepath (CVE-2015-5590)
  * phar: files extracted from archive may be placed outside of
    destination directory (CVE-2015-6833)
  * spl: dangling pointer in the unserialization of ArrayObject
    items (CVE-2015-6832)
  * spl: use after free vulnerability in unserialize() with
    SPLArrayObject (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6831)
  * core: use after free vulnerability in unserialize()).
    (CVE-2015-6834)
  * core: use after free vulnerability in session deserializer
    (CVE-2015-6835)
  * soap: SOAP serialize_function_call() type confusion / RCE
    (CVE-2015-6836)
  * spl: use-after-free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6834)
  * spl: use-after-free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6834)
  * xslt: null pointer dereference (CVE-2015-6837 CVE-2015-6838)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 5.6.16
  * phar: null pointer dereference in phar_get_fp_offset()
    (CVE-2015-7803)
  * phar: uninitialized pointer in phar_make_dirstream when zip
    entry filename is "/" (CVE-2015-7804)
  * various segfaults</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- update to version 5.6.23
  * fpm: fpm_log.c memory leak and buffer overflow (CVE-2016-5114)
  * gd: memory Read via gdImageRotateInterpolated Array Index Out
    of Bounds (CVE-2016-1903)
  * wddx: use After Free Vulnerability in WDDX Packet
    Deserialization
  * wddx: session WDDX Packet Deserialization Type Confusion
    Vulnerability
  * xmlrpc: type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  * pcre: upgrade bundled PCRE library to 8.38. (CVE-2015-8383,
    CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
    CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
  * phar: heap corruption in tar/zip/phar parser (CVE-2016-4342)
  * phar: uninitialized pointer in phar_make_dirstream()).
    (CVE-2016-4343)
  * phar: NULL Pointer Dereference in phar_tar_setupmetadata()
  * phar: stack overflow when decompressing tar archives
    (CVE-2016-2554)
  * add support for HTTP 451 error code
  * fileinfo: buffer over-write in finfo_open with malformed magic
    file (CVE-2015-8865)
  * mbstring: addressSanitizer: negative-size-param (-1) in
    mbfl_strcut (CVE-2016-4073)
  * odbc: invalid memory write in phar on filename with \0 in
    name (CVE-2016-4072)
  * snmp: php_snmp_error() format string vulnerability
    (CVE-2016-4071)
  * standard: integer overflow in php_raw_url_encode
    (CVE-2016-4070)
  * bcmath: bcpowmod accepts negative scale and corrupts _one_
    definition (CVE-2016-4537, CVE-2016-4538)
  * exif: out of bounds heap read access in exif header
    processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
  * gd: libgd: signedness vulnerability (CVE-2016-3074)
  * intl: out-of-bounds reads in zif_grapheme_stripos with negative
    offset (CVE-2016-4540, CVE-2016-4541)
  * xml: xml_parse_into_struct segmentation fault (CVE-2016-4539)
  * core: integer underflow / arbitrary null write in fread/gzread
    (CVE-2016-5096)
  * core: integer Overflow in php_html_entities (CVE-2016-5094)
  * gd: imagescale out-of-bounds read (CVE-2013-7456)
  * intl: get_icu_value_internal out-of-bounds read (CVE-2016-5093)
  * stack overflow with imagefilltoborder (CVE-2015-8874)
  * integer Overflow in _gd2GetHeader() resulting in heap
    overflow (CVE-2016-5766)
  * integer overflow in gdImagePaletteToTrueColor() resulting in
    heap overflow (CVE-2016-5767)
  * mbstring: _php_mb_regex_ereg_replace_exec - double free
    (CVE-2016-5768)
  * mcrypt: heap Overflow due to integer overflows (CVE-2016-5769)
  * spl: int/size_t confusion in SplFileObject::fread
    (CVE-2016-5770)
  * spl: use after free vulnerability in PHP's GC algorithm and
    unserialize (CVE-2016-5771)
  * wddx: double free courruption in wddx_deserialize
    (CVE-2016-5772)
  * zip: ZipArchive class use after free vulnerability in PHP's GC
    algorithm and unserialize (CVE-2016-5773)
- avoid-gcc-warnings-in-mbstring-extensions.patch:
  update (drop part added to upstream)</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374401">- fix fbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 5.6.25
  * core: stack-based buffer overflow vulnerability in
    virtual_file_ex (CVE-2016-6289)
  * core: use after free in unserialize() with unexpected session
    deserialization (CVE-2016-6290)
  * HTTP_PROXY is improperly trusted by some PHP libraries and
    applications (CVE-2016-5385)
  * bz2: inadequate error handling in bzread() (CVE-2016-5399)
  * exif: out of bound read in exif_process_IFD_in_MAKERNOTE
    (CVE-2016-6291)
  * exif: null pointer dereference in exif_process_user_comment
    (CVE-2016-6292)
  * gd: integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  * intl: locale_accept_from_http out-of-bounds access
    (CVE-2016-6294)
  * odbc: PHP segfaults when accessing nvarchar(max) defined
    columns (CVE-2015-8879)
  * snmp: use after free vulnerability in SNMP with GC and
    unserialize() (CVE-2016-6295)
  * xmlrpc: heap-buffer-overflow (write) simplestring_addn
    simplestring.c (CVE-2016-6296)
  * zip: stack-based buffer overflow vulnerability in
    php_stream_zip_opener). (CVE-2016-6297)</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- update to version 5.6.28
  * intl: add locale length check (CVE-2016-7416)
  * mysqlnd: eap overflow in mysqlnd related to bit fields
    (CVE-2016-7412)
  * out of bound when verify signature of zip phar in
    phar_parse_zipfile (CVE-2016-7414)
  * spl: missing type check when unserializing SplArray
    (CVE-2016-7417)
  * standard: memory corruption in during deserialized-object
    destruction (CVE-2016-7411)
  * wddx: wddx_deserialize use-after-free (CVE-2016-7413)
  * wddx: out-of-bounds read in php_wddx_push_element
    (CVE-2016-7418)</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 5.6.32
  * wddx: invalid read when wddx decodes empty boolean element
    (CVE-2016-9935)
  * openssl: invalid parameter in memcpy function trough
    openssl_pbkdf2
  * exif: FPE when parsing a tag format (CVE-2016-10158)
  * gd: DOS vulnerability in gdImageCreateFromGd2Ctx()
    (CVE-2016-10167)
  * gd: signed Integer Overflow gd_io.c (CVE-2016-10168)
  * phar: crash while loading hostile phar archive (CVE-2016-10159)
  * phar: memory corruption when loading hostile phar
    (CVE-2016-10160)
  * standard: heap out of bounds read on unserialize in
    finish_nested_data() (CVE-2016-10161)
  * gd: buffer over-read into uninitialized memory (CVE-2017-7890)
  * mbstring: add oniguruma upstream fix (CVE-2017-9224,
    CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
  * pcre: fixed bug #75207 (applied upstream patch for
    CVE-2016-1283)</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 5.6.36
  * potential infinite loop in gdImageCreateFromGifCtx
    (CVE-2018-5711)
  * reflected XSS in .phar 404 page (CVE-2018-5712)
  * stack-buffer-overflow while parsing HTTP response
    (CVE-2018-7584)
  * dumpable FPM child processes allow bypassing opcache access
    controls (CVE-2018-10545)
  * heap Buffer Overflow (READ: 1786) in exif_iif_add_value
    (CVE-2018-10549)
  * stream filter convert.iconv leads to infinite loop on invalid
    sequence (CVE-2018-10546)
  * malicious LDAP-Server response causes crash (CVE-2018-10548)
  * fix for CVE-2018-5712 may have not been complete
    (CVE-2018-10547)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- use spdx tag for License</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 5.6.40</changelog>
</package>
<package pkgid="76f9808ae123173d3798a01d004e0cff9d344cf3ce11efd7a5df24966d390f2a" name="php56-debugsource" arch="x86_64">
  <version epoch="0" ver="5.6.40" rel="150600.2.36"/>
  <changelog author="mike@mk-sys.cz" date="1427025600">- initial checkin of PHP 5.6.7</changelog>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 5.6.13
  * apache2handler: potential remote code execution with apache 2.4
    apache2handler (CVE-2015-3330)
  * opcache: user after free (CVE-2015-1351)
  * phar: buffer over-read in unserialize when parsing phar
    (CVE-2015-2783)
  * phar: buffer overflow when parsing tar/zip/phar in
    phar_set_inode (CVE-2015-3329)
  * postgres: null pointer dereference (CVE-2015-1352)
  * core: PHP Multipart/form-data remote dos Vulnerability
    (CVE-2015-4024)
  * core: CVE-2006-7243 fix regressions in 5.4+ (CVE-2015-4025)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4022)
  * pcntl: pcntl_exec() should not allow null char (CVE-2015-4026)
  * pcre: upgrade pcrelib to 8.37 (CVE-2015-2325 CVE-2015-2326)
  * phar: memory corruption in phar_parse_tarfile when entry
    filename starts with null (CVE-2015-4021)
  * core: OS command injection vulnerability in escapeshellarg
    (CVE-2015-4642)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4643)
  * postgres: segfault in php_pgsql_meta_data (CVE-2015-4644)
  * sqlite3: upgrade bundled sqlite to 3.8.10.2 (CVE-2015-3414
    CVE-2015-3415 CVE-2015-3416)
  * mysqlnd: mysqlnd is vulnerable to BACKRONYM (CVE-2015-3152)
  * phar: segfault in Phar::convertToData on invalid file
    (CVE-2015-5589)
  * phar: buffer overflow and stack smashing error in
    phar_fix_filepath (CVE-2015-5590)
  * phar: files extracted from archive may be placed outside of
    destination directory (CVE-2015-6833)
  * spl: dangling pointer in the unserialization of ArrayObject
    items (CVE-2015-6832)
  * spl: use after free vulnerability in unserialize() with
    SPLArrayObject (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6831)
  * core: use after free vulnerability in unserialize()).
    (CVE-2015-6834)
  * core: use after free vulnerability in session deserializer
    (CVE-2015-6835)
  * soap: SOAP serialize_function_call() type confusion / RCE
    (CVE-2015-6836)
  * spl: use-after-free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6834)
  * spl: use-after-free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6834)
  * xslt: null pointer dereference (CVE-2015-6837 CVE-2015-6838)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 5.6.16
  * phar: null pointer dereference in phar_get_fp_offset()
    (CVE-2015-7803)
  * phar: uninitialized pointer in phar_make_dirstream when zip
    entry filename is "/" (CVE-2015-7804)
  * various segfaults</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- update to version 5.6.23
  * fpm: fpm_log.c memory leak and buffer overflow (CVE-2016-5114)
  * gd: memory Read via gdImageRotateInterpolated Array Index Out
    of Bounds (CVE-2016-1903)
  * wddx: use After Free Vulnerability in WDDX Packet
    Deserialization
  * wddx: session WDDX Packet Deserialization Type Confusion
    Vulnerability
  * xmlrpc: type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  * pcre: upgrade bundled PCRE library to 8.38. (CVE-2015-8383,
    CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
    CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
  * phar: heap corruption in tar/zip/phar parser (CVE-2016-4342)
  * phar: uninitialized pointer in phar_make_dirstream()).
    (CVE-2016-4343)
  * phar: NULL Pointer Dereference in phar_tar_setupmetadata()
  * phar: stack overflow when decompressing tar archives
    (CVE-2016-2554)
  * add support for HTTP 451 error code
  * fileinfo: buffer over-write in finfo_open with malformed magic
    file (CVE-2015-8865)
  * mbstring: addressSanitizer: negative-size-param (-1) in
    mbfl_strcut (CVE-2016-4073)
  * odbc: invalid memory write in phar on filename with \0 in
    name (CVE-2016-4072)
  * snmp: php_snmp_error() format string vulnerability
    (CVE-2016-4071)
  * standard: integer overflow in php_raw_url_encode
    (CVE-2016-4070)
  * bcmath: bcpowmod accepts negative scale and corrupts _one_
    definition (CVE-2016-4537, CVE-2016-4538)
  * exif: out of bounds heap read access in exif header
    processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
  * gd: libgd: signedness vulnerability (CVE-2016-3074)
  * intl: out-of-bounds reads in zif_grapheme_stripos with negative
    offset (CVE-2016-4540, CVE-2016-4541)
  * xml: xml_parse_into_struct segmentation fault (CVE-2016-4539)
  * core: integer underflow / arbitrary null write in fread/gzread
    (CVE-2016-5096)
  * core: integer Overflow in php_html_entities (CVE-2016-5094)
  * gd: imagescale out-of-bounds read (CVE-2013-7456)
  * intl: get_icu_value_internal out-of-bounds read (CVE-2016-5093)
  * stack overflow with imagefilltoborder (CVE-2015-8874)
  * integer Overflow in _gd2GetHeader() resulting in heap
    overflow (CVE-2016-5766)
  * integer overflow in gdImagePaletteToTrueColor() resulting in
    heap overflow (CVE-2016-5767)
  * mbstring: _php_mb_regex_ereg_replace_exec - double free
    (CVE-2016-5768)
  * mcrypt: heap Overflow due to integer overflows (CVE-2016-5769)
  * spl: int/size_t confusion in SplFileObject::fread
    (CVE-2016-5770)
  * spl: use after free vulnerability in PHP's GC algorithm and
    unserialize (CVE-2016-5771)
  * wddx: double free courruption in wddx_deserialize
    (CVE-2016-5772)
  * zip: ZipArchive class use after free vulnerability in PHP's GC
    algorithm and unserialize (CVE-2016-5773)
- avoid-gcc-warnings-in-mbstring-extensions.patch:
  update (drop part added to upstream)</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374401">- fix fbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 5.6.25
  * core: stack-based buffer overflow vulnerability in
    virtual_file_ex (CVE-2016-6289)
  * core: use after free in unserialize() with unexpected session
    deserialization (CVE-2016-6290)
  * HTTP_PROXY is improperly trusted by some PHP libraries and
    applications (CVE-2016-5385)
  * bz2: inadequate error handling in bzread() (CVE-2016-5399)
  * exif: out of bound read in exif_process_IFD_in_MAKERNOTE
    (CVE-2016-6291)
  * exif: null pointer dereference in exif_process_user_comment
    (CVE-2016-6292)
  * gd: integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  * intl: locale_accept_from_http out-of-bounds access
    (CVE-2016-6294)
  * odbc: PHP segfaults when accessing nvarchar(max) defined
    columns (CVE-2015-8879)
  * snmp: use after free vulnerability in SNMP with GC and
    unserialize() (CVE-2016-6295)
  * xmlrpc: heap-buffer-overflow (write) simplestring_addn
    simplestring.c (CVE-2016-6296)
  * zip: stack-based buffer overflow vulnerability in
    php_stream_zip_opener). (CVE-2016-6297)</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- update to version 5.6.28
  * intl: add locale length check (CVE-2016-7416)
  * mysqlnd: eap overflow in mysqlnd related to bit fields
    (CVE-2016-7412)
  * out of bound when verify signature of zip phar in
    phar_parse_zipfile (CVE-2016-7414)
  * spl: missing type check when unserializing SplArray
    (CVE-2016-7417)
  * standard: memory corruption in during deserialized-object
    destruction (CVE-2016-7411)
  * wddx: wddx_deserialize use-after-free (CVE-2016-7413)
  * wddx: out-of-bounds read in php_wddx_push_element
    (CVE-2016-7418)</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 5.6.32
  * wddx: invalid read when wddx decodes empty boolean element
    (CVE-2016-9935)
  * openssl: invalid parameter in memcpy function trough
    openssl_pbkdf2
  * exif: FPE when parsing a tag format (CVE-2016-10158)
  * gd: DOS vulnerability in gdImageCreateFromGd2Ctx()
    (CVE-2016-10167)
  * gd: signed Integer Overflow gd_io.c (CVE-2016-10168)
  * phar: crash while loading hostile phar archive (CVE-2016-10159)
  * phar: memory corruption when loading hostile phar
    (CVE-2016-10160)
  * standard: heap out of bounds read on unserialize in
    finish_nested_data() (CVE-2016-10161)
  * gd: buffer over-read into uninitialized memory (CVE-2017-7890)
  * mbstring: add oniguruma upstream fix (CVE-2017-9224,
    CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
  * pcre: fixed bug #75207 (applied upstream patch for
    CVE-2016-1283)</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 5.6.36
  * potential infinite loop in gdImageCreateFromGifCtx
    (CVE-2018-5711)
  * reflected XSS in .phar 404 page (CVE-2018-5712)
  * stack-buffer-overflow while parsing HTTP response
    (CVE-2018-7584)
  * dumpable FPM child processes allow bypassing opcache access
    controls (CVE-2018-10545)
  * heap Buffer Overflow (READ: 1786) in exif_iif_add_value
    (CVE-2018-10549)
  * stream filter convert.iconv leads to infinite loop on invalid
    sequence (CVE-2018-10546)
  * malicious LDAP-Server response causes crash (CVE-2018-10548)
  * fix for CVE-2018-5712 may have not been complete
    (CVE-2018-10547)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- use spdx tag for License</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 5.6.40</changelog>
</package>
<package pkgid="7f3f0f2f279784a7088b6edda43f8d149498ab5ad368b7f4063c1d35b6cb9ed3" name="php56-devel" arch="x86_64">
  <version epoch="0" ver="5.6.40" rel="150600.2.36"/>
  <changelog author="mike@mk-sys.cz" date="1427025600">- initial checkin of PHP 5.6.7</changelog>
  <changelog author="mike@mk-sys.cz" date="1443614400">- update to version 5.6.13
  * apache2handler: potential remote code execution with apache 2.4
    apache2handler (CVE-2015-3330)
  * opcache: user after free (CVE-2015-1351)
  * phar: buffer over-read in unserialize when parsing phar
    (CVE-2015-2783)
  * phar: buffer overflow when parsing tar/zip/phar in
    phar_set_inode (CVE-2015-3329)
  * postgres: null pointer dereference (CVE-2015-1352)
  * core: PHP Multipart/form-data remote dos Vulnerability
    (CVE-2015-4024)
  * core: CVE-2006-7243 fix regressions in 5.4+ (CVE-2015-4025)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4022)
  * pcntl: pcntl_exec() should not allow null char (CVE-2015-4026)
  * pcre: upgrade pcrelib to 8.37 (CVE-2015-2325 CVE-2015-2326)
  * phar: memory corruption in phar_parse_tarfile when entry
    filename starts with null (CVE-2015-4021)
  * core: OS command injection vulnerability in escapeshellarg
    (CVE-2015-4642)
  * ftp: integer overflow in ftp_genlist() resulting in heap
    overflow (CVE-2015-4643)
  * postgres: segfault in php_pgsql_meta_data (CVE-2015-4644)
  * sqlite3: upgrade bundled sqlite to 3.8.10.2 (CVE-2015-3414
    CVE-2015-3415 CVE-2015-3416)
  * mysqlnd: mysqlnd is vulnerable to BACKRONYM (CVE-2015-3152)
  * phar: segfault in Phar::convertToData on invalid file
    (CVE-2015-5589)
  * phar: buffer overflow and stack smashing error in
    phar_fix_filepath (CVE-2015-5590)
  * phar: files extracted from archive may be placed outside of
    destination directory (CVE-2015-6833)
  * spl: dangling pointer in the unserialization of ArrayObject
    items (CVE-2015-6832)
  * spl: use after free vulnerability in unserialize() with
    SPLArrayObject (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6831)
  * spl: use after free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6831)
  * core: use after free vulnerability in unserialize()).
    (CVE-2015-6834)
  * core: use after free vulnerability in session deserializer
    (CVE-2015-6835)
  * soap: SOAP serialize_function_call() type confusion / RCE
    (CVE-2015-6836)
  * spl: use-after-free vulnerability in unserialize() with
    SplObjectStorage (CVE-2015-6834)
  * spl: use-after-free vulnerability in unserialize() with
    SplDoublyLinkedList (CVE-2015-6834)
  * xslt: null pointer dereference (CVE-2015-6837 CVE-2015-6838)</changelog>
  <changelog author="mike@mk-sys.cz" date="1451131200">- update to version 5.6.16
  * phar: null pointer dereference in phar_get_fp_offset()
    (CVE-2015-7803)
  * phar: uninitialized pointer in phar_make_dirstream when zip
    entry filename is "/" (CVE-2015-7804)
  * various segfaults</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374400">- update to version 5.6.23
  * fpm: fpm_log.c memory leak and buffer overflow (CVE-2016-5114)
  * gd: memory Read via gdImageRotateInterpolated Array Index Out
    of Bounds (CVE-2016-1903)
  * wddx: use After Free Vulnerability in WDDX Packet
    Deserialization
  * wddx: session WDDX Packet Deserialization Type Confusion
    Vulnerability
  * xmlrpc: type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  * pcre: upgrade bundled PCRE library to 8.38. (CVE-2015-8383,
    CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390,
    CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)
  * phar: heap corruption in tar/zip/phar parser (CVE-2016-4342)
  * phar: uninitialized pointer in phar_make_dirstream()).
    (CVE-2016-4343)
  * phar: NULL Pointer Dereference in phar_tar_setupmetadata()
  * phar: stack overflow when decompressing tar archives
    (CVE-2016-2554)
  * add support for HTTP 451 error code
  * fileinfo: buffer over-write in finfo_open with malformed magic
    file (CVE-2015-8865)
  * mbstring: addressSanitizer: negative-size-param (-1) in
    mbfl_strcut (CVE-2016-4073)
  * odbc: invalid memory write in phar on filename with \0 in
    name (CVE-2016-4072)
  * snmp: php_snmp_error() format string vulnerability
    (CVE-2016-4071)
  * standard: integer overflow in php_raw_url_encode
    (CVE-2016-4070)
  * bcmath: bcpowmod accepts negative scale and corrupts _one_
    definition (CVE-2016-4537, CVE-2016-4538)
  * exif: out of bounds heap read access in exif header
    processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
  * gd: libgd: signedness vulnerability (CVE-2016-3074)
  * intl: out-of-bounds reads in zif_grapheme_stripos with negative
    offset (CVE-2016-4540, CVE-2016-4541)
  * xml: xml_parse_into_struct segmentation fault (CVE-2016-4539)
  * core: integer underflow / arbitrary null write in fread/gzread
    (CVE-2016-5096)
  * core: integer Overflow in php_html_entities (CVE-2016-5094)
  * gd: imagescale out-of-bounds read (CVE-2013-7456)
  * intl: get_icu_value_internal out-of-bounds read (CVE-2016-5093)
  * stack overflow with imagefilltoborder (CVE-2015-8874)
  * integer Overflow in _gd2GetHeader() resulting in heap
    overflow (CVE-2016-5766)
  * integer overflow in gdImagePaletteToTrueColor() resulting in
    heap overflow (CVE-2016-5767)
  * mbstring: _php_mb_regex_ereg_replace_exec - double free
    (CVE-2016-5768)
  * mcrypt: heap Overflow due to integer overflows (CVE-2016-5769)
  * spl: int/size_t confusion in SplFileObject::fread
    (CVE-2016-5770)
  * spl: use after free vulnerability in PHP's GC algorithm and
    unserialize (CVE-2016-5771)
  * wddx: double free courruption in wddx_deserialize
    (CVE-2016-5772)
  * zip: ZipArchive class use after free vulnerability in PHP's GC
    algorithm and unserialize (CVE-2016-5773)
- avoid-gcc-warnings-in-mbstring-extensions.patch:
  update (drop part added to upstream)</changelog>
  <changelog author="mkubecek@suse.cz" date="1467374401">- fix fbclient build dependency
- specfile cleanup</changelog>
  <changelog author="mkubecek@suse.cz" date="1473076800">- update to version 5.6.25
  * core: stack-based buffer overflow vulnerability in
    virtual_file_ex (CVE-2016-6289)
  * core: use after free in unserialize() with unexpected session
    deserialization (CVE-2016-6290)
  * HTTP_PROXY is improperly trusted by some PHP libraries and
    applications (CVE-2016-5385)
  * bz2: inadequate error handling in bzread() (CVE-2016-5399)
  * exif: out of bound read in exif_process_IFD_in_MAKERNOTE
    (CVE-2016-6291)
  * exif: null pointer dereference in exif_process_user_comment
    (CVE-2016-6292)
  * gd: integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  * intl: locale_accept_from_http out-of-bounds access
    (CVE-2016-6294)
  * odbc: PHP segfaults when accessing nvarchar(max) defined
    columns (CVE-2015-8879)
  * snmp: use after free vulnerability in SNMP with GC and
    unserialize() (CVE-2016-6295)
  * xmlrpc: heap-buffer-overflow (write) simplestring_addn
    simplestring.c (CVE-2016-6296)
  * zip: stack-based buffer overflow vulnerability in
    php_stream_zip_opener). (CVE-2016-6297)</changelog>
  <changelog author="mkubecek@suse.cz" date="1480075200">- update to version 5.6.28
  * intl: add locale length check (CVE-2016-7416)
  * mysqlnd: eap overflow in mysqlnd related to bit fields
    (CVE-2016-7412)
  * out of bound when verify signature of zip phar in
    phar_parse_zipfile (CVE-2016-7414)
  * spl: missing type check when unserializing SplArray
    (CVE-2016-7417)
  * standard: memory corruption in during deserialized-object
    destruction (CVE-2016-7411)
  * wddx: wddx_deserialize use-after-free (CVE-2016-7413)
  * wddx: out-of-bounds read in php_wddx_push_element
    (CVE-2016-7418)</changelog>
  <changelog author="mkubecek@suse.cz" date="1510401600">- update to version 5.6.32
  * wddx: invalid read when wddx decodes empty boolean element
    (CVE-2016-9935)
  * openssl: invalid parameter in memcpy function trough
    openssl_pbkdf2
  * exif: FPE when parsing a tag format (CVE-2016-10158)
  * gd: DOS vulnerability in gdImageCreateFromGd2Ctx()
    (CVE-2016-10167)
  * gd: signed Integer Overflow gd_io.c (CVE-2016-10168)
  * phar: crash while loading hostile phar archive (CVE-2016-10159)
  * phar: memory corruption when loading hostile phar
    (CVE-2016-10160)
  * standard: heap out of bounds read on unserialize in
    finish_nested_data() (CVE-2016-10161)
  * gd: buffer over-read into uninitialized memory (CVE-2017-7890)
  * mbstring: add oniguruma upstream fix (CVE-2017-9224,
    CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
  * pcre: fixed bug #75207 (applied upstream patch for
    CVE-2016-1283)</changelog>
  <changelog author="mkubecek@suse.cz" date="1527422400">- update to version 5.6.36
  * potential infinite loop in gdImageCreateFromGifCtx
    (CVE-2018-5711)
  * reflected XSS in .phar 404 page (CVE-2018-5712)
  * stack-buffer-overflow while parsing HTTP response
    (CVE-2018-7584)
  * dumpable FPM child processes allow bypassing opcache access
    controls (CVE-2018-10545)
  * heap Buffer Overflow (READ: 1786) in exif_iif_add_value
    (CVE-2018-10549)
  * stream filter convert.iconv leads to infinite loop on invalid
    sequence (CVE-2018-10546)
  * malicious LDAP-Server response causes crash (CVE-2018-10548)
  * fix for CVE-2018-5712 may have not been complete
    (CVE-2018-10547)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619524800">- use spdx tag for License</changelog>
  <changelog author="mkubecek@suse.cz" date="1669291200">- update to version 5.6.40</changelog>
</package>
<package pkgid="76ae91fdc31070b8164ab3ac8d4a7af8be553c375ccf8cd27bee402579234f7e" name="php81" arch="src">
  <version epoch="0" ver="8.1.32" rel="150600.2.34"/>
  <changelog author="mkubecek@suse.cz" date="1669291200">- initial import of PHP 8.1.12 package</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to PHP 8.1.32
- update the keyring to new GPG format
- update specfile to "modern" %patch syntax (fix 16.0 build)</changelog>
</package>
<package pkgid="ebbf049dfd1078f770615d962754e9563a063801e1b742885b4ee11a90a91fb7" name="php81" arch="x86_64">
  <version epoch="0" ver="8.1.32" rel="150600.2.34"/>
  <changelog author="mkubecek@suse.cz" date="1669291200">- initial import of PHP 8.1.12 package</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to PHP 8.1.32
- update the keyring to new GPG format
- update specfile to "modern" %patch syntax (fix 16.0 build)</changelog>
</package>
<package pkgid="35cc4236aea5c28145a2f8ecb37a9c21675320a4782107d971cfa32ec6f4ca3c" name="php81-debuginfo" arch="x86_64">
  <version epoch="0" ver="8.1.32" rel="150600.2.34"/>
  <changelog author="mkubecek@suse.cz" date="1669291200">- initial import of PHP 8.1.12 package</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to PHP 8.1.32
- update the keyring to new GPG format
- update specfile to "modern" %patch syntax (fix 16.0 build)</changelog>
</package>
<package pkgid="1b50c865c71b0f3f4fd644dabe5c0995e27a215fbbe9a0d912378086afeaf3e9" name="php81-debugsource" arch="x86_64">
  <version epoch="0" ver="8.1.32" rel="150600.2.34"/>
  <changelog author="mkubecek@suse.cz" date="1669291200">- initial import of PHP 8.1.12 package</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to PHP 8.1.32
- update the keyring to new GPG format
- update specfile to "modern" %patch syntax (fix 16.0 build)</changelog>
</package>
<package pkgid="a617fa378bb57a6b32b17f0958c2bbf6e0c053937fe3fa701e2e942b6a66ae41" name="php81-devel" arch="x86_64">
  <version epoch="0" ver="8.1.32" rel="150600.2.34"/>
  <changelog author="mkubecek@suse.cz" date="1669291200">- initial import of PHP 8.1.12 package</changelog>
  <changelog author="mkubecek@suse.cz" date="1746878400">- update to PHP 8.1.32
- update the keyring to new GPG format
- update specfile to "modern" %patch syntax (fix 16.0 build)</changelog>
</package>
<package pkgid="198773e91ef86a7184b420c3446411f5a061f0a6272273f8851f0a71e62cb914" name="php84" arch="src">
  <version epoch="0" ver="8.4.7" rel="150600.1.34"/>
  <changelog author="mkubecek@suse.cz" date="1746878400">- initial import of PHP 8.4.7 package</changelog>
</package>
<package pkgid="f437cd36fbe898af3219c05f9e764a7f00221b81cb929c8ed988e52492bb99e2" name="php84" arch="x86_64">
  <version epoch="0" ver="8.4.7" rel="150600.1.34"/>
  <changelog author="mkubecek@suse.cz" date="1746878400">- initial import of PHP 8.4.7 package</changelog>
</package>
<package pkgid="4df6540b45cc5b3329d7772ea43a9973c3ddfe6548c0a1b8341d8052e926ec7f" name="php84-debuginfo" arch="x86_64">
  <version epoch="0" ver="8.4.7" rel="150600.1.34"/>
  <changelog author="mkubecek@suse.cz" date="1746878400">- initial import of PHP 8.4.7 package</changelog>
</package>
<package pkgid="90be2c9b24151799b3e795fcae821d3e3cf2b222e08be76c2fbb5c33bf43e02a" name="php84-debugsource" arch="x86_64">
  <version epoch="0" ver="8.4.7" rel="150600.1.34"/>
  <changelog author="mkubecek@suse.cz" date="1746878400">- initial import of PHP 8.4.7 package</changelog>
</package>
<package pkgid="31bc8c0e0d8a9d3e342f7e5069694a7edb30ea04786322f305c2836dc332a3fa" name="php84-devel" arch="x86_64">
  <version epoch="0" ver="8.4.7" rel="150600.1.34"/>
  <changelog author="mkubecek@suse.cz" date="1746878400">- initial import of PHP 8.4.7 package</changelog>
</package>
</otherdata>